SAST Detection Coverage
How to measure and evaluate the extent to which a SAST tool detects vulnerability classes, frameworks, and code patterns in a codebase.
Primary question: What is SAST detection coverage and how should organizations assess it?
Direct answer
SAST detection coverage is the extent to which a static analysis tool identifies genuine weaknesses across the vulnerability classes, frameworks, and code patterns present in a codebase — measured by rule mapping, language support, and separate analysis
SAST detection coverage is determined by the tool's rule set, language support, framework awareness, and analysis depth. It can be assessed by mapping enabled rules to known vulnerability classes, verifying coverage of frameworks used in the codebase, and identifying areas where no rule exists. Detection coverage is bounded by the tool's rule set and configuration — no tool can cover every vulnerability class, framework, or code pattern.
Organizations should assess detection coverage periodically, especially when adopting new frameworks, languages, or vulnerability classes. A separate SAST analysis with different detection coverage can reveal gaps that the primary tool cannot identify. Unique findings from a second analysis require validation before being treated as genuine vulnerabilities.
Definitions
Detection coverage
The extent to which a SAST tool's enabled rules identify genuine vulnerabilities across the vulnerability classes, frameworks, languages, and code patterns present in the target codebase.
Rule mapping
The process of mapping each enabled SAST rule to a specific vulnerability class, CWE, or security weakness to understand what the tool can detect.
Coverage gap
A vulnerability class, framework, or code pattern present in the codebase that has no corresponding enabled SAST rule, representing undetected risk.
The engineering problem
Organizations cannot know their detection coverage quality if they only have results from a single scanner and no process for mapping rules to vulnerability classes.
The technology landscape evolves as new frameworks, libraries, and code patterns emerge, which may introduce vulnerability classes that existing SAST rules do not address.
Organizations should measure detection coverage against their own codebase rather than assuming coverage based on marketing claims.
Security controls
Each control inspects a different artifact and produces evidence for an engineering decision.
Rule-to-class mapping
Coverage mapping- Artifact
- Mapping of each enabled SAST rule to specific vulnerability classes, CWE identifiers, or security weaknesses.
- Risk
- Unknown coverage gaps — enabling rules without understanding what they detect.
- Output
- A coverage map that identifies which vulnerability classes are covered, partially covered, or not covered by the active rule set.
Evidence:
Framework coverage verification
Framework-specific coverage check- Artifact
- Verification that SAST rules exist for each framework and library used in the codebase that has known vulnerability classes.
- Risk
- Undetected vulnerabilities in framework-specific patterns not covered by generic rules.
- Output
- Confirmation that framework-specific vulnerability classes have corresponding SAST rules, or documentation of gaps.
Evidence:
Separate coverage verification
Additional analysis scan- Artifact
- Analysis of the same codebase by a second SAST tool with different detection coverage.
- Risk
- Overconfidence in the primary scanner's coverage.
- Output
- Additional evidence about which vulnerability classes each tool detects, revealing gaps in the primary tool's coverage. Unique findings require validation.
Evidence:
Verification workflow
- Inventory the vulnerability classes, frameworks, languages, and code patterns present in the codebase.
- Map each enabled SAST rule to specific vulnerability classes and identify which classes have no corresponding rule.
- For coverage gaps, evaluate whether rules can be enabled, whether the gap is acceptable for the risk profile, or whether complementary techniques should be used.
- Periodically reassess coverage as the technology stack evolves and new vulnerability classes emerge.
- Consider a separate SAST analysis to validate coverage assessments. Treat scanner agreement as supporting evidence and unique findings as requiring independent validation.
DerScanner · Enterprise
Relationship to DerScanner
DerScanner provides SAST analysis that can serve as a complementary analysis tool to assess coverage gaps in the primary scanner.
DerScanner performs static analysis of supported source and binary formats, providing additional analysis results that can be compared with an incumbent scanner. [derscanner-sast]
Limits of verification
- Coverage mapping requires effort and expertise. Organizations must understand both their codebase and the SAST tool's rule catalog.
- Some vulnerability classes may not have any static analysis rule in any SAST tool, requiring alternative detection methods.
- Detection coverage is specific to the codebase and technology stack. A tool that covers one stack well may have significant gaps in another.
- Two tools may share blind spots for certain vulnerability classes, meaning coverage agreement is not proof of completeness.
Related knowledge
SAST False Negatives
How coverage gaps lead to missed vulnerabilities
Relationship: related-toSAST Accuracy
How accuracy encompasses both coverage and precision
Relationship: related-toSAST Second Opinion
Using a second SAST tool to identify coverage gaps
Relationship: related-toHow to Validate SAST Results
Methodology for validating SAST analysis quality
Relationship: related-toWhy SAST Tools Find Different Vulnerabilities
Why different tools have different coverage profiles
Relationship: related-toCanonical terms used: Detection coverage; SAST rule coverage; Coverage gap; Rule mapping.
Evidence and references
- DerScanner SAST documentationDerScanner performs static analysis of supported source and binary formats, provides configuration-file analysis, and reports and compares analysis results. DerTriage and DerCodeFix are available within static analysis.
derscanner-sast
Detection coverage