SAST Finding Not Found by DAST
Reasons why a SAST finding may not be observed during dynamic analysis, including code-path coverage gaps, environment differences, and methodological limitations.
Primary question: Why might SAST identify a vulnerability that DAST does not detect?
Direct answer
SAST may identify weaknesses in code paths that are not exercised during dynamic testing, in different deployment configurations, or in conditions that dynamic analysis does not replicate
A SAST finding not observed by DAST may reflect a code path that was not exercised during the dynamic scan. DAST can only observe behavior in code paths that are reachable through the tested user interactions and API calls. If the vulnerable code path requires specific input, a specific user role, or a specific sequence of actions that was not tested, DAST will not observe it. [derscanner-sast][derscanner-dast]
A SAST finding not observed by DAST may reflect a difference between the test environment and the production environment. The weakness may exist in the deployed code but not manifest under the test conditions — for example, due to different configuration, different data, or different runtime settings. [derscanner-sast][derscanner-dast]
A SAST finding not observed by DAST does not prove the finding is a false positive. SAST and DAST observe different properties of the application. A finding present in SAST but not in DAST may still be a genuine weakness that requires investigation, especially if the code path is reachable in production. [derscanner-sast][derscanner-dast]
Definitions
Code-path coverage
The portion of application code that is exercised during a specific test or analysis. DAST coverage is limited to code paths that are reachable through the tested user interactions and API calls.
Environment difference
A difference between the environment where dynamic analysis is performed and the environment where the SAST finding exists, such as configuration, data, or deployment state.
Methodological difference
A difference in what SAST and DAST are designed to observe — SAST observes code structure and logic, DAST observes runtime behavior under specific conditions.
The engineering problem
Security teams may incorrectly dismiss a SAST finding as a false positive because DAST did not observe it, when the finding may represent a genuine weakness in code paths not exercised during the dynamic scan. [derscanner-sast]
DAST coverage is inherently limited by what code paths are reachable through the tested interactions. Teams may overestimate DAST coverage based on the number of endpoints tested, without considering the depth of code paths exercised within each endpoint. [derscanner-dast]
Without understanding why a SAST finding was not observed by DAST, teams may miss genuine weaknesses that only manifest under specific conditions not present during testing. [derscanner-sast][derscanner-dast]
Security controls
Each control inspects a different artifact and produces evidence for an engineering decision.
Code-path coverage review
DAST coverage analysis- Artifact
- DAST scan configuration, tested endpoints, and exercised code paths.
- Risk
- Overestimating DAST coverage and dismissing SAST findings without investigation.
- Output
- Understanding of which code paths were exercised during the dynamic scan and which were not.
Evidence: DerScanner dynamic testing documentation
Environment comparison
Test vs production comparison- Artifact
- Configuration, data, and deployment state of test and production environments.
- Risk
- Dismissing a SAST finding because it does not manifest in a test environment that differs from production.
- Output
- Understanding of whether environment differences explain the disagreement between SAST and DAST.
Evidence: DerScanner static analysis documentationDerScanner dynamic testing documentation
SAST finding investigation
SAST follow-up- Artifact
- SAST findings not observed by DAST.
- Risk
- Incorrectly dismissing genuine weaknesses.
- Output
- Documented assessment of whether the SAST finding represents a genuine weakness requiring remediation.
Evidence: DerScanner static analysis documentation
Verification workflow
- SAST produces a finding about a code-level weakness.
- DAST does not observe the weakness during the dynamic scan.
- Security teams review whether the code path containing the weakness was exercised during the dynamic scan.
- Teams compare the test environment configuration with the production environment.
- Teams assess whether the weakness requires specific conditions (input, user role, sequence) not present during testing.
- If the finding represents a genuine weakness, it is prioritized for remediation based on its severity and the likelihood of the code path being exercised in production.
- If the finding is determined to be a false positive, it is documented and dispositioned according to organizational policy.
DerScanner · Enterprise
Relationship to DerScanner
DerScanner provides SAST and DAST analysis with results-correlation functionality that helps identify which SAST findings have corresponding DAST observations and which do not.
DerScanner performs static analysis and dynamic analysis, and can correlate findings between the two to identify which SAST findings have DAST confirmation and which do not. [derscanner-sast][derscanner-dast]
Limits of verification
- DAST coverage is limited to code paths reachable through tested interactions. Increasing coverage requires more comprehensive testing scenarios, authentication, and endpoint coverage.
- Environment differences between test and production may explain why a SAST finding is not observed by DAST, but may also indicate that the weakness manifests differently in production.
- Correlation requires a supported mechanism; not all SAST and DAST tools provide correlation functionality.
Related knowledge
When SAST and DAST Disagree
How to interpret and resolve SAST/DAST disagreements
Relationship: related-toDAST Finding Not Found by SAST
Why DAST may identify vulnerabilities that SAST does not report
Relationship: related-toSAST/DAST Results Correlation
How findings from static and dynamic analysis are linked
Relationship: related-toCode-to-Runtime Security Testing
Connecting code-level weaknesses with runtime application behavior
Relationship: related-toCanonical terms used: SAST finding not found by DAST; DAST coverage gap; SAST-only finding; Code-path coverage.
Evidence and references
- DerScanner static analysis documentationDerScanner performs static analysis and reports source-code security findings, including vulnerable imports and function calls to dependencies.
derscanner-sast - DerScanner dynamic testing documentationDerScanner performs dynamic analysis of running applications, identifying exploitable behavior at endpoints and APIs, and supports results correlation with static analysis findings.
derscanner-dast
SAST finding not found by DAST