SAST PoC Plan
A practical SAST PoC plan with roles, representative repositories, test scenarios, evidence capture, acceptance gates, schedule, and decision record.
Primary question: How can a team turn SAST evaluation requirements into an executable proof-of-concept plan with measurable acceptance criteria?
Direct answer
A SAST PoC plan defines what will be tested, how evidence will be collected, and which results determine acceptance
The plan should freeze the evaluated product version, scanner configuration, source revision, repository set, test scenarios, scoring method, and decision owners before execution begins. [owasp-samm-security-testing]
Detection evaluation should use documented ground truth where available, but the PoC should also test deployment, integration, finding evidence, triage, rescan behavior, governance, and operating effort. [nist-ssdf]
Definitions
SAST PoC plan
An executable evaluation document that assigns scope, environments, roles, test scenarios, evidence, schedule, scoring rules, and exit criteria for a candidate SAST product.
PoC acceptance gate
A pre-agreed condition that determines whether a candidate passes, fails, or requires an explicitly approved exception.
Test scenario
A repeatable action and expected evidence used to evaluate one or more requirements, such as scanning a representative repository or enforcing a pull-request policy.
The engineering problem
A vendor demonstration can show a successful path without testing representative scale, difficult frameworks, existing pipeline constraints, or routine analyst work.
Changing scanner configuration, code revisions, or scoring rules during the PoC makes candidate results difficult to compare.
Security controls
Each control inspects a different artifact and produces evidence for an engineering decision.
PoC charter
Evaluation boundary- Artifact
- A one-page charter identifying the decision, candidates, in-scope requirements, repositories, environments, timeline, owners, exclusions, and permitted vendor assistance.
- Risk
- Allowing the evaluation scope to expand or change differently for each candidate.
- Output
- Approved and versioned PoC boundary.
Evidence:
Representative repository set
Evaluation corpus- Artifact
- Version-pinned repositories covering important languages, frameworks, architectures, sizes, build patterns, and known operational difficulties, with handling rules for proprietary source.
- Risk
- Producing results that do not represent the organization's application portfolio.
- Output
- A documented repository set and source revision for every test.
Evidence: OWASP SAMM Security Testing
Scenario and evidence matrix
PoC test matrix- Artifact
- A table with scenario ID, requirement, setup, action, expected evidence, actual evidence, owner, score, exception, and retest status.
- Risk
- Scoring impressions instead of repeatable observations.
- Output
- Comparable scenario records for each candidate.
Acceptance and exit criteria
PoC decision gates- Artifact
- Mandatory pass conditions, weighted score thresholds, permitted exceptions, stop conditions, unresolved-risk treatment, and final approvers.
- Risk
- Moving the decision threshold after results are known.
- Output
- A reviewable pass, conditional pass, or fail decision.
Evidence:
Verification workflow
- Approve the PoC charter and assign security, development, DevOps, infrastructure, procurement, and decision owners.
- Freeze candidate versions, configurations, repository commits, and infrastructure assumptions.
- Prepare test scenarios for installation, access control, representative scans, findings, CI/CD, exports, triage, suppression, rescans, upgrades, and recovery.
- Record expected evidence and acceptance rules before running each scenario.
- Execute the same scenario set for every candidate and log deviations.
- Validate known findings where ground truth exists and separately record newly discovered candidates for review.
- Measure scan operation and finding-review effort without presenting short PoC observations as long-term production cost.
- Review mandatory failures, weighted scores, exceptions, and unresolved risks.
- Archive the evidence package and signed decision record.
DerScanner · Enterprise
Relationship to DerScanner
DerScanner can be installed and evaluated through the same controlled PoC plan used for other candidates.
DerScanner documentation describes static-analysis capabilities, supported technologies, deployment, and CI/CD integrations that can be mapped to PoC scenarios. [derscanner-docs]
Limits of verification
- A short PoC cannot establish long-term maintenance effort, support quality, rule evolution, or production-scale reliability.
- Ground-truth quality limits the conclusions that can be drawn about detection accuracy.
- Results are specific to the pinned repositories, versions, configuration, infrastructure, and test period.
- This executable plan complements the broader SAST Proof of Concept methodology; it does not replace the organization's procurement process.
Related knowledge
SAST Proof of Concept
Understand the broader evaluation methodology and ground-truth approach
Relationship: related-toSAST RFP Template
Carry shortlisted requirements and vendor claims into the test plan
Relationship: related-toSAST Tool Requirements Checklist
Define the requirements from which PoC scenarios are derived
Relationship: related-toHow to Validate SAST Results
Validate detection results against documented ground truth
Relationship: related-toSAST Pricing and Total Cost of Ownership
Carry observed operating inputs into a bounded cost model
Relationship: related-toCanonical terms used: SAST PoC plan; SAST proof of concept plan; SAST PoC acceptance criteria; static analysis evaluation plan; SAST PoC test cases.
Evidence and references
- NIST Secure Software Development FrameworkThe SSDF describes code analysis, issue triage, remediation, evidence retention, and secure software practices suitable for evaluation scenarios.
nist-ssdf - OWASP SAMM Security TestingOWASP SAMM describes security testing maturity from baseline automated testing through integration into development and deployment.
owasp-samm-security-testing - DerScanner documentationDerScanner publishes documentation for static analysis, supported technologies, deployment, and integrations.
derscanner-docs
Make the PoC reproducible