SAST and OWASP Top 10:2025
How SAST contributes evidence for OWASP Top 10:2025 risks, why coverage varies, and which risks require additional analysis techniques.
Primary question: Which OWASP Top 10:2025 risks can SAST help identify, and which require other controls?
Direct answer
SAST supports OWASP Top 10 testing, but no single static scan covers the entire list
SAST can identify code patterns associated with some weaknesses mapped to OWASP Top 10:2025 categories, particularly where the weakness is represented in supported source code and data flow. [owasp-top10-2025][owasp-source-code-analysis]
OWASP Top 10 categories also include design, configuration, dependency, integrity, operational, and runtime conditions that require controls beyond source-code analysis. [owasp-top10-2025][owasp-modern-appsec]
Definitions
OWASP Top 10:2025
OWASP's current awareness document describing ten broad categories of critical web application security risk.
Category coverage
The extent to which an analysis technique can identify weakness patterns mapped to a broader risk category.
CWE mapping
A relationship between a reported weakness and a Common Weakness Enumeration identifier used to classify software weakness types.
The engineering problem
A claim that a scanner covers an entire OWASP category can hide the difference between detecting selected mapped weaknesses and verifying the full category in a real application. [owasp-top10-risks]
OWASP Top 10:2025 includes Software Supply Chain Failures and Mishandling of Exceptional Conditions, reflecting risks that cannot be reduced to a single scanner rule or technique. [owasp-top10-2025]
Teams can mistake a clean SAST result for proof that all OWASP Top 10 risks have been evaluated.
Security controls
Each control inspects a different artifact and produces evidence for an engineering decision.
Source-code weakness analysis
Static Application Security Testing- Artifact
- Supported application source code and code-level data flows.
- Risk
- Implementation weaknesses that map to CWEs represented within OWASP Top 10:2025 categories.
- Output
- Findings with weakness classification and code evidence that can be mapped to relevant categories.
Evidence: OWASP Source Code Analysis ToolsDerScanner static analysis documentation
Multi-technique OWASP verification
Application Security Verification- Artifact
- Source code, dependencies, configuration, running application behavior, design, and operational evidence.
- Risk
- Category-level gaps that remain when assessment relies on one analysis technique.
- Output
- A documented coverage matrix identifying the techniques and evidence used for each relevant risk.
Evidence: OWASP Top 10:2025 — Establishing a Modern Application Security Program
Verification workflow
- Identify the OWASP Top 10:2025 categories relevant to the application and its architecture.
- Map supported SAST rules and findings to specific CWEs rather than broad marketing labels.
- Run SAST against the controlled source revision.
- Record which code-level weakness patterns were analyzed and which were outside scope.
- Apply SCA, DAST, configuration review, design review, and manual testing where appropriate.
- Validate and remediate confirmed findings.
- Retain a coverage matrix that distinguishes tested evidence from unverified assumptions.
DerScanner · Enterprise
Relationship to DerScanner
DerScanner provides SAST, SCA, and DAST modules that can contribute different evidence to an OWASP-oriented application security program.
DerScanner performs static analysis across documented languages and reports findings classified with security weakness information. [derscanner-sast][derscanner-supported-languages]
DerScanner also documents separate SCA and DAST modules; their presence does not by itself establish complete OWASP Top 10 coverage for a specific application. [derscanner-server-requirements]
Limits of verification
- The OWASP Top 10 is an awareness document, not a complete application security verification standard.
- SAST coverage varies by language, framework, rule, and implementation pattern.
- Some risks depend on runtime behavior, deployment configuration, architecture, or operational processes.
- Mapping a finding to a category does not prove full coverage of that category.
- A clean result from one tool does not demonstrate that an application is free from OWASP Top 10 risks.
Related knowledge
What Is SAST?
The source-code analysis technique used for part of OWASP-oriented testing
Relationship: related-toSAST Detection Coverage
How to measure actual rule, language, framework, and weakness coverage
Relationship: related-toSAST, DAST, and SCA Together
Combining evidence across proprietary code, dependencies, and runtime behavior
Relationship: related-toCanonical terms used: OWASP Top 10:2025; Static Application Security Testing; OWASP category coverage; Common Weakness Enumeration; application security verification.
Evidence and references
- OWASP Top 10:2025OWASP publishes the official 2025 list and describes it as an awareness document for critical web application security risks.
owasp-top10-2025 - OWASP Top 10:2025 — What Are Application Security Risks?OWASP documents the data, CWE mappings, incidence, coverage, and scoring methodology behind the category model.
owasp-top10-risks - OWASP Top 10:2025 — Establishing a Modern Application Security ProgramOWASP frames application security as a program using multiple practices rather than a single scanner result.
owasp-modern-appsec - OWASP Source Code Analysis ToolsStatic analysis identifies selected security weaknesses in source code without executing the application.
owasp-source-code-analysis - DerScanner static analysis documentationDerScanner documents its static source-code analysis capabilities.
derscanner-sast - DerScanner analysis modules and supported languagesDerScanner documents the language scope of its analysis modules.
derscanner-supported-languages - DerScanner server requirementsDerScanner documents separate SAST, DAST, and SCA modules.
derscanner-server-requirements
Measure real OWASP coverage