SAST/DAST Results Correlation
How correlation between SAST findings and DAST findings provides structured, code-to-runtime evidence that is more actionable than displaying results from both scanners side by side.
Primary question: What is SAST/DAST results correlation?
Direct answer
SAST/DAST correlation links findings from static and dynamic analysis to provide code-to-runtime evidence for prioritization
SAST/DAST correlation connects findings from static analysis with findings from dynamic analysis that relate to the same underlying weakness. A correlated finding has both code-level evidence (from SAST) and runtime evidence (from DAST), providing more context for prioritization than either finding alone. [derscanner-sast][derscanner-dast]
Correlation is different from simply running both SAST and DAST and displaying results side by side. Correlation requires establishing a supported relationship between findings — for example, linking a SAST finding about a vulnerable code path to a DAST finding about exploitable behavior at the same endpoint. [derscanner-sast][derscanner-dast]
A SAST finding that is also confirmed by dynamic analysis may have stronger evidence for prioritization. A DAST finding that has a corresponding SAST finding provides code-level context that can help locate and fix the root cause. [derscanner-sast][derscanner-dast]
Definitions
SAST/DAST correlation
The process of identifying and connecting findings from static analysis with findings from dynamic analysis that relate to the same underlying weakness, providing both code-level and runtime evidence for the same issue.
Aggregation
Displaying findings from multiple sources together without establishing relationships between them. Aggregation shows what each tool found; correlation shows how findings from different tools relate to each other.
Correlated finding
A finding from one analysis technique that has been linked to a related finding from another technique, providing additional context about the weakness.
The engineering problem
When SAST and DAST findings are displayed side by side without correlation, security teams must manually determine which findings relate to the same underlying weakness, which is time-consuming and error-prone at scale.
Without correlation, a SAST finding and a DAST finding that both relate to the same vulnerability are treated as separate issues, leading to duplicated triage effort and potential confusion about the actual risk.
Correlation requires a supported mechanism — simply having both SAST and DAST results does not automatically establish which findings are related. The correlation must be based on identifiable relationships between the findings.
Security controls
Each control inspects a different artifact and produces evidence for an engineering decision.
Static analysis finding
SAST finding- Artifact
- Application source code with identified security weaknesses.
- Risk
- Code-level weaknesses that may or may not be exploitable at runtime.
- Output
- SAST findings with code location, severity, and analysis context.
Evidence: DerScanner static analysis documentation
Dynamic analysis finding
DAST finding- Artifact
- Running application with identified exploitable behavior.
- Risk
- Runtime weaknesses that may have a code-level root cause not identified by SAST.
- Output
- DAST findings with endpoint, attack vector, and runtime evidence.
Finding correlation
SAST/DAST correlation- Artifact
- SAST findings and DAST findings that relate to the same underlying weakness.
- Risk
- Correlated findings treated as separate issues, leading to duplicated effort and incomplete risk assessment.
- Output
- Correlated findings that provide both code-level and runtime evidence for the same issue.
Evidence: DerScanner SAST results with dynamic confirmation documentation
Verification workflow
- SAST analyzes source code and produces findings about code-level weaknesses.
- DAST analyzes the running application and produces findings about runtime weaknesses.
- Findings from both analyses are correlated to identify relationships between them.
- Correlated findings are reviewed together, combining code-level and runtime evidence.
- Prioritization and remediation decisions are informed by the combined evidence.
DerScanner · Enterprise
Relationship to DerScanner
DerScanner provides SAST and DAST analysis with results-correlation functionality that links findings from both techniques.
DerScanner performs static analysis and dynamic analysis, and when source code is available, dynamic-analysis results can be correlated with static-analysis results for better accuracy and easier prioritization. [derscanner-sast][derscanner-dast]
Limits of verification
- Correlation requires a supported mechanism; not all SAST and DAST tools provide correlation functionality.
- Correlation is based on identifiable relationships between findings; not every SAST finding will have a corresponding DAST finding and vice versa.
- A correlated finding provides additional evidence but does not automatically prove exploitability.
- Correlation does not replace individual analysis — both SAST and DAST must still produce quality findings for correlation to be effective.
Step-by-step guides
Related knowledge
Combining SAST and DAST
Why organizations should use SAST and DAST together
Relationship: related-toCorrelation vs Aggregation
The difference between correlating findings and simply displaying them side by side
Relationship: related-toDAST-Confirmed SAST Findings
What it means when a SAST finding is also confirmed by dynamic analysis
Relationship: related-toCode-to-Runtime Security Testing
Connecting code-level weaknesses with runtime application behavior
Relationship: related-toDerScanner
Product line providing SAST, DAST, and correlation capabilities
Relationship: related-toCanonical terms used: SAST/DAST correlation; Correlated finding; Code-to-runtime evidence; Finding correlation.
Evidence and references
- DerScanner static analysis documentationDerScanner performs static analysis and reports source-code security findings.
derscanner-sast - DerScanner dynamic analysis documentationDerScanner DAST is a web-application scanner that detects vulnerabilities and backdoors by providing malformed or random inputs, using the black-box method without requiring source code. When source code is available, dynamic-analysis results can be correlated with static-analysis results for better accuracy and easier prioritization.
derscanner-dast - DerScanner SAST results with dynamic confirmation documentationViewing correlation between static- and dynamic-analysis projects; SAST vulnerabilities confirmed by dynamic analysis being marked with a D; automatic update of results and tags after a new dynamic scan; rejected vulnerabilities being included in correlation.
derscanner-sast-dast-confirmation
SAST/DAST correlation