Static and Dynamic Security Testing Workflow
A practical workflow for combining SAST and DAST analysis, from source code through correlation, prioritization, remediation, and reverification.
Primary question: What does a practical combined SAST and DAST workflow look like?
Direct answer
A practical combined SAST and DAST workflow runs SAST on source code during development, DAST on the running application in a test environment, correlates findings from both analyses, prioritizes based on combined evidence, remediates findings, and verifies fixes through rescan
A practical combined SAST and DAST workflow runs SAST on source code during development or build, runs DAST on the running application in a test or staging environment, correlates findings from both analyses, prioritizes based on combined evidence, remediates findings, and verifies fixes through rescan. This workflow provides visibility into both code-level weaknesses and runtime behavior throughout the development lifecycle. [derscanner-sast][derscanner-dast]
SAST can run early and frequently because it analyzes source code without requiring a running application. DAST requires a running target, so it typically runs after deployment to a test or staging environment. This timing difference means SAST and DAST provide complementary visibility at different stages of the development lifecycle. [derscanner-sast][derscanner-dast]
After remediation, findings should be verified through rescan. Static re-analysis confirms the code-level fix. Dynamic re-testing confirms the runtime behavior has been corrected. Correlation between the rescan results provides evidence that the combined issue has been addressed. [derscanner-sast][derscanner-dast]
Definitions
Combined SAST/DAST workflow
A structured process that uses both static and dynamic analysis at appropriate stages of the development lifecycle, correlates findings from both analyses, and uses the combined evidence for prioritization and remediation.
Rescan
Re-running security analysis after remediation to verify that the fix addresses the finding. Rescan may include both static re-analysis and dynamic re-testing.
Verification
Confirming that a remediation addresses the original finding and does not introduce new weaknesses. Verification may include scanner re-analysis, functional testing, and security regression testing.
The engineering problem
Organizations that run SAST and DAST independently without a structured workflow miss the opportunity to correlate findings and use combined evidence for prioritization and remediation. [derscanner-sast][derscanner-dast]
Without a combined workflow, SAST and DAST findings may be triaged separately, leading to duplicated effort, inconsistent prioritization, and incomplete remediation. [derscanner-sast][derscanner-dast]
Without rescan and verification after remediation, organizations cannot confirm that fixes address the original findings or that new weaknesses were not introduced. [derscanner-sast][derscanner-dast]
Security controls
Each control inspects a different artifact and produces evidence for an engineering decision.
Static analysis during development
SAST in CI/CD- Artifact
- Application source code during build or development.
- Risk
- Code-level weaknesses not identified before deployment.
- Output
- SAST findings with code location and severity.
Evidence: DerScanner static analysis documentation
Dynamic analysis in test environment
DAST in staging- Artifact
- Running application in test or staging environment.
- Risk
- Runtime weaknesses not identified before production deployment.
- Output
- DAST findings with endpoint and runtime evidence.
Evidence: DerScanner dynamic testing documentation
Correlation and prioritization
SAST/DAST correlation- Artifact
- SAST and DAST findings linked through correlation.
- Risk
- Treating SAST and DAST findings independently without combined context.
- Output
- Prioritized findings based on combined code-level and runtime evidence.
Evidence: DerScanner static analysis documentationDerScanner dynamic testing documentation
Rescan and verification
Post-remediation rescan- Artifact
- Fixed source code and running application after remediation.
- Risk
- Incomplete remediation or introduction of new weaknesses.
- Output
- Verification that the fix addresses the original finding and no new weaknesses were introduced.
Evidence: DerScanner static analysis documentationDerScanner dynamic testing documentation
Verification workflow
- Source code is analyzed by SAST during development or build.
- Application is deployed to a test or staging environment.
- DAST analyzes the running application in the test environment.
- Findings from SAST and DAST are correlated to identify relationships between them.
- Correlated findings are prioritized based on combined evidence.
- Security teams triage findings, assign remediation ownership, and track progress.
- Development teams apply fixes to source code and configuration.
- Rescan verifies fixes through static re-analysis and dynamic re-testing.
- Correlation between pre-remediation and post-remediation results confirms the combined issue has been addressed.
DerScanner · Enterprise
Relationship to DerScanner
DerScanner provides SAST, DAST, and results-correlation capabilities that can be integrated into a combined security testing workflow across the development lifecycle.
DerScanner performs static analysis and dynamic analysis, and can correlate findings between the two to provide combined code-to-runtime evidence throughout the development lifecycle. [derscanner-sast][derscanner-dast]
Limits of verification
- DAST requires a running target in a test or staging environment, which must be maintained and kept representative of production.
- Correlation requires a supported mechanism; not all SAST and DAST tools provide correlation functionality.
- Rescan after remediation requires re-deployment of the application to the test environment for dynamic re-testing.
Related knowledge
Combining SAST and DAST
Why organizations use both SAST and DAST together
Relationship: related-toSAST/DAST Results Correlation
How findings from static and dynamic analysis are linked
Relationship: related-toCode-to-Runtime Security Testing
Connecting code-level weaknesses with runtime application behavior
Relationship: related-toSAST and DAST in CI/CD
How SAST and DAST fit into a CI/CD security workflow
Relationship: related-toCanonical terms used: Combined SAST DAST workflow; Static and dynamic testing workflow; SAST in development; DAST in staging; Post-remediation rescan.
Evidence and references
- DerScanner static analysis documentationDerScanner performs static analysis and reports source-code security findings, including vulnerable imports and function calls to dependencies.
derscanner-sast - DerScanner dynamic testing documentationDerScanner performs dynamic analysis of running applications, identifying exploitable behavior at endpoints and APIs, and supports results correlation with static analysis findings.
derscanner-dast
SAST/DAST workflow