SAST False Negatives
Why SAST tools miss genuine vulnerabilities — coverage gaps, analysis limitations, configuration issues, and code patterns that evade detection.
Primary question: What are SAST false negatives and why do they occur?
Direct answer
SAST false negatives are genuine vulnerabilities that a static analysis tool failed to detect, caused by limitations in rule coverage, analysis depth, framework awareness, configuration, or code patterns that the tool's engine cannot model
SAST false negatives occur when a static analysis tool fails to detect a genuine vulnerability in the codebase within the defined evaluation scope. This can happen because the tool lacks a rule for that vulnerability class, cannot model the required data flow, does not recognize a framework-specific pattern, or is configured with rules disabled. False negatives are distinct from false positives — a false negative means the vulnerability exists but was not reported.
Each SAST tool has detection limits determined by its rule set, analysis depth, language support, and configuration. No tool provides complete coverage of all vulnerability classes. A clean SAST report indicates only what the configured rules found — it does not establish that the codebase is free of vulnerabilities.
Definitions
False negative (SAST)
A genuine vulnerability within the defined evaluation scope that a SAST tool failed to detect and report. It is a gap in the tool's detection coverage, not a finding that was reported and incorrectly dismissed.
Detection gap
A vulnerability class, framework, language feature, or code pattern that a SAST tool does not detect, due to limitations in its rule set, data-flow model, or analysis configuration.
Recall (SAST)
The proportion of genuine vulnerabilities within a defined evaluation scope that a SAST tool successfully detects. High recall means few false negatives; low recall means many genuine vulnerabilities are missed. Recall requires a sufficiently complete ground truth for the evaluated scope.
The engineering problem
Organizations may treat a clean SAST report as proof of security, when it actually reflects only the detection boundaries of the specific tool and configuration used.
Custom or uncommon code patterns, framework-specific APIs, and proprietary technologies may not be covered by default rule sets, which can result in undetected vulnerabilities in those areas.
Disabling rules to reduce false positives can inadvertently increase false negatives, creating a trade-off between precision and recall that organizations must manage carefully.
Seeded vulnerability testing can reveal some false negatives, but only for the injected cases. It does not establish the total number of false negatives in a production codebase.
Security controls
Each control inspects a different artifact and produces evidence for an engineering decision.
Rule coverage review
SAST rule coverage assessment- Artifact
- Inventory of enabled SAST rules mapped to known vulnerability classes and frameworks present in the codebase.
- Risk
- Undetected vulnerabilities in areas not covered by the active rule set.
- Output
- Identification of coverage gaps between the enabled rules and the vulnerability classes or frameworks used in the codebase.
Evidence:
Detection gap remediation
Coverage gap closure- Artifact
- Process for evaluating and enabling rules for uncovered vulnerability classes, adding framework-specific patterns, or supplementing SAST with other techniques.
- Risk
- Persistent blind spots in the detection pipeline.
- Output
- Expanded detection coverage that reduces the number and severity of undetected vulnerabilities.
Evidence:
Complementary analysis
Multi-technique testing- Artifact
- Use of DAST, manual review, or a separate SAST tool to detect vulnerabilities that the primary SAST tool misses.
- Risk
- Overreliance on a single technique's coverage.
- Output
- Additional detection coverage that compensates for the primary tool's blind spots.
Evidence:
Verification workflow
- Map the organization's known vulnerability classes and frameworks to the SAST tool's enabled rules.
- Identify rules that are disabled, not yet implemented, or not applicable to the codebase's technology stack.
- Evaluate whether enabling additional rules would meaningfully improve coverage without unacceptably increasing false positives.
- For vulnerability classes with no corresponding SAST rules, consider complementary techniques such as DAST, manual code review, or a separate SAST tool with different detection coverage.
- Periodically review detection coverage as new vulnerability classes, frameworks, or code patterns emerge.
- Treat findings from a separate analysis as additional evidence — unique findings require validation before being treated as genuine false negatives in the primary tool.
DerScanner · Enterprise
Relationship to DerScanner
DerScanner provides SAST analysis of supported source and binary formats and can serve as a complementary analysis tool when organizations need to investigate gaps in their primary scanner's coverage.
DerScanner performs static analysis of supported source and binary formats, which may produce findings that differ from another scanner due to different analysis approaches. [derscanner-sast]
Limits of verification
- Increasing rule coverage to reduce false negatives may increase false positives, requiring additional triage effort.
- Some vulnerability classes may have no corresponding static analysis rule in any SAST tool, requiring alternative detection methods.
- Detection coverage depends on the specific language, framework, and code patterns used. A tool that covers one stack well may have gaps in another.
- Two tools may share blind spots for certain vulnerability classes, meaning finding agreement is not proof of complete coverage.
Related knowledge
SAST False Positives
The complementary problem of over-reporting — genuine findings reported as vulnerabilities
Relationship: related-toSAST Detection Coverage
What detection coverage means and how to assess it
Relationship: related-toSAST Accuracy
How accuracy encompasses both false positives and false negatives
Relationship: related-toWhy SAST Tools Find Different Vulnerabilities
Why different tools have different false-negative profiles
Relationship: related-toSAST Second Opinion
Using a second SAST tool to identify detection gaps
Relationship: related-toCanonical terms used: SAST false negative; Detection gap; Missed vulnerability; SAST recall.
Evidence and references
- DerScanner SAST documentationDerScanner performs static analysis of supported source and binary formats, provides configuration-file analysis, and reports and compares analysis results. DerTriage and DerCodeFix are available within static analysis.
derscanner-sast
Detection coverage