SAST Triage Playbook
A practical SAST triage playbook with queue gates, disposition criteria, escalation rules, evidence fields, and operating metrics.
Primary question: How should an AppSec team review, disposition, route, and audit SAST findings?
Direct answer
A SAST triage playbook turns scanner output into consistent, reviewable decisions
Begin triage with stable finding identity and sufficient technical evidence, then apply documented validity, impact, reachability, and policy checks. Keep scanner severity separate from business priority so that each can be revised without erasing the other. [nist-ssdf]
Every non-remediation disposition should include a reason, owner, review date, and supporting evidence. High-impact exceptions and uncertain findings should follow an explicit escalation path rather than being silently suppressed. [owasp-devsecops]
Definitions
SAST triage
The process of validating a static-analysis finding, adding application context, assigning a disposition and priority, and routing the resulting work.
Disposition
A recorded decision such as confirmed, rejected with rationale, accepted risk, duplicate, mitigated by context, or needs investigation.
Triage record
The evidence, reasoning, ownership, timestamps, and status history retained for a finding decision.
The engineering problem
Unstructured triage creates inconsistent decisions across analysts and repositories, making backlog and risk reports difficult to interpret.
Closing findings without retained reasoning prevents later review when code, threat context, policy, or scanner rules change. [nist-ssdf]
Security controls
Each control inspects a different artifact and produces evidence for an engineering decision.
Intake quality gate
Triage intake checklist- Artifact
- A required-field checklist covering repository, revision, rule, weakness class, source location, trace, scanner severity, scan configuration, and finding identity.
- Risk
- Analysts spend time reconstructing missing scan context or disposition the wrong source revision.
- Output
- A review-ready finding or a documented request for missing evidence.
Evidence: OWASP SAMM Security Testing
Disposition decision table
SAST disposition matrix- Artifact
- A table with rows for confirmed, rejected, accepted risk, duplicate, contextual mitigation, and needs investigation; columns define required evidence, approver, expiry, and next action.
- Risk
- Equivalent findings receive different outcomes without a defensible reason.
- Output
- A consistent status with rationale and ownership.
Escalation and sampling rule
Triage assurance rule- Artifact
- Criteria for escalating critical impact, uncertain data flows, disputed decisions, expired exceptions, and a periodic sample of closed findings.
- Risk
- Incorrect closures remain undetected and repeated process defects accumulate.
- Output
- Second-review decisions and sampled quality results.
Evidence: OWASP DevSecOps Guideline
Queue operations board
Triage queue dashboard- Artifact
- Weekly counts for new, reviewed, escalated, reopened, aged, and routed findings, segmented by repository and severity.
- Risk
- Queue growth and stalled ownership remain hidden behind aggregate scan totals.
- Output
- Capacity and aging signals for the AppSec operating review.
Evidence:
Verification workflow
- Confirm the finding belongs to the intended repository, revision, branch, and scan policy.
- Review the rule, weakness class, source and sink, trace, code context, and configuration evidence.
- Determine technical validity without using business priority as a substitute for validity.
- Assess impact, exposure, reachability, existing controls, asset criticality, and policy obligations.
- Assign a disposition using the decision table and retain evidence and reasoning.
- Derive remediation priority from impact and application context; preserve the original scanner severity.
- Route confirmed work to an accountable engineering owner with the applicable SLA.
- Escalate uncertain, high-impact, disputed, or policy-exception cases to the named reviewer.
- Recheck remediated findings against the relevant source revision and record the result.
- Sample closed findings and review queue aging on a fixed cadence.
DerScanner · Enterprise
Relationship to DerScanner
DerScanner findings can be handled through this product-neutral triage process.
DerScanner documentation describes static-analysis capabilities and product workflows that evaluators can inspect when mapping findings into their triage process. [derscanner-docs]
Limits of verification
- This playbook does not determine whether a finding is exploitable and does not replace application-specific threat analysis.
- Scanner severity is an input, not a complete business-risk assessment.
- Review sampling can detect some process errors but cannot establish that all closed findings are correct.
- Disposition labels must be mapped to the actual scanner, ticketing system, exception policy, and regulatory obligations.
- Automated triage requires separate validation, approval boundaries, audit records, and fallback procedures.
Related knowledge
SAST Severity and SLA Matrix
Convert triaged context into remediation deadlines and escalation
Relationship: related-toSAST Rollout Plan
Introduce triage capacity and governance by rollout phase
Relationship: related-toSAST PoC Plan
Test finding evidence and disposition workflow before selection
Relationship: related-toSAST Evaluation and Deployment Toolkit
Place triage within the evaluation and deployment sequence
Relationship: related-toCanonical terms used: SAST triage playbook; SAST finding disposition; SAST triage workflow; SAST finding review; SAST triage checklist.
Evidence and references
- NIST Secure Software Development FrameworkThe SSDF addresses identifying, recording, tracking, and remediating software vulnerabilities and retaining information about discovered issues.
nist-ssdf - OWASP SAMM Security TestingOWASP SAMM describes repeatable security testing, integrated results, and risk-based testing practices.
owasp-samm-security-testing - OWASP DevSecOps GuidelineThe guideline describes integrating security testing and feedback into delivery workflows.
owasp-devsecops - DerScanner documentationDerScanner publishes documentation for its capabilities and workflows.
derscanner-docs
Establish a reviewable triage process