When SAST and DAST Disagree
How to interpret and resolve differences between SAST and DAST findings — different techniques observe different properties, and legitimate disagreements are expected.
Primary question: What should security teams do when SAST and DAST produce different results?
Direct answer
SAST and DAST observe an application from fundamentally different perspectives, so disagreements between their results are expected and should be resolved through additional analysis rather than treating one result as definitive
SAST and DAST observe an application from fundamentally different perspectives — SAST analyzes code structure and logic, while DAST observes runtime behavior. Disagreements between their results are expected and usually reflect methodological differences rather than one tool being wrong. A SAST finding without DAST observation may still be a genuine weakness in code paths not exercised during the scan. A DAST finding without SAST correlation may indicate runtime behavior that has a code-level root cause not identified by static analysis.
When SAST and DAST disagree, security teams should investigate the reason for the disagreement. For a SAST finding not observed by DAST, consider whether the code path was exercised during the dynamic scan, whether the deployment configuration differs from the test environment, or whether the weakness requires specific conditions not present during testing. For a DAST finding not identified by SAST, consider whether the issue relates to runtime configuration, authentication behavior, or exposed interfaces that static analysis cannot observe.
Neither SAST absence nor DAST absence proves that a weakness does not exist. Both techniques have inherent limitations, and a comprehensive assessment considers findings from both analyses along with additional context such as exposure, asset criticality, and organizational policy.
Definitions
SAST/DAST disagreement
A situation where SAST and DAST produce different results — for example, SAST identifies a weakness that DAST does not observe, or DAST observes exploitable behavior that SAST does not report.
Methodological difference
A legitimate reason why SAST and DAST produce different results because they observe different properties of the application — code structure versus runtime behavior.
Coverage gap
A portion of the application that one technique observes but the other does not, due to limitations in code-path exercise (DAST) or deployment/exercise assumptions (SAST).
The engineering problem
Security teams may treat a SAST finding that DAST does not observe as a false positive, when it may simply be a weakness in code paths not exercised during the dynamic scan.
Security teams may treat a DAST finding that SAST does not identify as an environmental artifact, when it may indicate a runtime configuration issue or exposed interface with a code-level root cause.
Disagreements between SAST and DAST create uncertainty for triage teams, who must determine which findings to prioritize and which may require additional investigation.
Security controls
Each control inspects a different artifact and produces evidence for an engineering decision.
SAST finding investigation
SAST follow-up- Artifact
- SAST findings not observed by DAST.
- Risk
- Dismissing a genuine weakness because it was not observed during dynamic testing.
- Output
- Determination of whether the SAST finding represents a genuine weakness in unexercised code paths or requires additional investigation.
Evidence:
DAST finding investigation
DAST follow-up- Artifact
- DAST findings not identified by SAST.
- Risk
- Dismissing a genuine runtime issue because static analysis did not identify it.
- Output
- Determination of whether the DAST finding relates to runtime configuration, authentication behavior, or an exposed interface.
Evidence:
Disagreement resolution
SAST/DAST reconciliation- Artifact
- Conflicting or non-overlapping SAST and DAST findings.
- Risk
- Inconsistent handling of findings based on which technique observed them.
- Output
- Documented resolution based on code-path coverage, environment comparison, and contextual assessment.
Evidence:
Verification workflow
- SAST produces findings about code-level weaknesses.
- DAST produces findings about runtime weaknesses.
- Security teams identify findings that appear in one analysis but not the other.
- For SAST-only findings, review whether the code path was exercised during the dynamic scan and whether the test environment matches production.
- For DAST-only findings, investigate whether the issue relates to runtime configuration, authentication, or exposed interfaces.
- Document the resolution of each disagreement and update prioritization accordingly.
- If a supported correlation mechanism is available, use it to link related findings from both analyses.
DerScanner · Enterprise
Relationship to DerScanner
DerScanner provides SAST and DAST analysis with results-correlation functionality that helps identify related findings and resolve disagreements between the two techniques.
DerScanner provides SAST and DAST analysis with results-correlation functionality that can help identify related findings between the two analyses. [derscanner-sast-dast-confirmation]
Limits of verification
- Disagreement resolution requires additional analysis and context. Teams must review code-path coverage, environment configuration, and application behavior to understand the reason for each disagreement.
- Not all SAST findings will have corresponding DAST findings, and not all DAST findings will have corresponding SAST findings. This is expected due to the different perspectives each technique provides.
- Correlation requires a supported mechanism; not all SAST and DAST tools provide correlation functionality.
Related knowledge
SAST/DAST Results Correlation
How findings from static and dynamic analysis are linked
Relationship: related-toSAST Finding Not Found by DAST
Why SAST may identify vulnerabilities that DAST does not detect
Relationship: related-toDAST Finding Not Found by SAST
Why DAST may identify vulnerabilities that SAST does not report
Relationship: related-toCombining SAST and DAST
Why organizations use both SAST and DAST together
Relationship: related-toCanonical terms used: SAST DAST disagreement; SAST DAST reconciliation; Conflicting security findings; Methodological differences.
Evidence and references
- DerScanner static analysis documentationDerScanner performs static analysis and reports source-code security findings.
derscanner-sast - DerScanner dynamic analysis documentationDerScanner DAST is a web-application scanner that detects vulnerabilities and backdoors by providing malformed or random inputs, using the black-box method without requiring source code. When source code is available, dynamic-analysis results can be correlated with static-analysis results for better accuracy and easier prioritization.
derscanner-dast
SAST/DAST disagreement