The Future of Security Testing: Can AI Solve the Inadequacies of SAST and DAST?

As software becomes more complex and the threat landscape evolves, the need for robust application security has never been more critical. Traditional approaches to identifying vulnerabilities, such as Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST), have served as vital components of secure software development. However, despite their widespread use, these tools have limitations. With the rise of AI, we are beginning to see a new wave of innovation aimed at addressing the gaps in SAST and DAST, potentially revolutionising how we secure applications.

The Current Limitations of SAST and DAST Tools

SAST tools analyse code without executing it, seeking to identify vulnerabilities by examining its structure, logic, and syntax. DAST tools, on the other hand, test running applications, simulating real-world attacks to uncover flaws that appear during execution. Despite their different approaches, both have significant limitations that reduce their effectiveness.

SAST: High False Positives and Contextual Blindness

SAST tools are excellent for catching a broad range of well-known vulnerabilities like SQL injections, cross-site scripting (XSS), and hardcoded credentials. However, they suffer from several well-documented shortcomings:

- High False Positive Rates: Rule-based SAST tools often flag benign code patterns as vulnerabilities. This leads to unnecessary noise and increases the workload of security teams, who must manually sift through the results to separate true risks from false alarms.

- Lack of Context: SAST tools don’t understand the broader business logic or execution context of an application. They may flag code that appears risky in isolation but is perfectly secure when considered within the context of its environment, such as input validation or sandboxing.

- Limited Adaptability: Traditional SAST tools are rule-based and thus rely heavily on predefined vulnerability patterns. As new coding languages and frameworks emerge, these tools often struggle to keep up, especially in highly customised environments or with less common programming languages.

DAST: Surface-Level and Reactive Testing

DAST tools attempt to exploit vulnerabilities in a running application, providing real-world insights. However, they too have limitations:

- Inability to Analyse Code Directly: DAST tools focus on runtime behaviour, meaning they cannot access source code. This limits their ability to detect certain types of vulnerabilities, especially those embedded deep within the application’s logic.

- Reactive, Not Proactive: DAST is often employed late in the development cycle, after an application is running. Issues found at this stage can be costly to fix, and the late discovery of vulnerabilities can cause significant delays.

- Limited Insight into Business Logic Flaws: Similar to SAST, DAST tools struggle to detect more complex vulnerabilities that depend on understanding business logic or multi-step interactions, such as race conditions or authorisation flaws.

How AI Can Fill These Gaps

AI offers a promising solution to many of these limitations by introducing greater accuracy, adaptability, and contextual understanding in vulnerability detection. Here’s how AI could address some of the fundamental inadequacies of both SAST and DAST:

Contextual Understanding and Reduction of False Positives

Unlike traditional tools that rely on static rules, AI models can “understand” code. Modern AI systems, such as those based on large language models (LLMs) or graph neural networks (GNNs), can analyse code as text, identifying vulnerabilities not just by pattern recognition but by grasping the intent behind the code. For instance, AI can be trained to recognise the correct use of authentication flows, detect insecure logic, or flag when critical checks (such as permission verifications) are missing.

This deeper comprehension reduces false positives, as AI can filter out benign patterns more effectively than traditional SAST tools. AI systems can also learn from feedback loops, continuously improving their accuracy based on real-world results.

Adaptability to New Technologies and Frameworks

AI models trained on vast datasets of code can generalise across different programming languages, libraries, and frameworks. This is crucial in today’s rapidly evolving development landscape, where tools need to keep pace with modern technologies like microservices, serverless architectures, and custom APIs. AI-powered systems can quickly adapt to new coding styles and practices, providing a level of flexibility that traditional rule-based tools lack.

Detecting Complex Vulnerabilities

Many security vulnerabilities arise not from simple coding errors but from more complex, context-dependent flaws in business logic or application flow. AI can help here by following data flows across the entire application, identifying multi-step vulnerabilities that static or dynamic tools alone might miss. For example, an AI-powered tool could trace a user’s actions across multiple services and detect improper authorisation checks or escalation of privileges that would otherwise go unnoticed.

Continuous Learning and Improvement

One of the key advantages of AI is its ability to learn continuously from both new codebases and emerging vulnerabilities. By integrating real-time threat intelligence, such as newly disclosed Common Vulnerabilities and Exposures (CVEs), AI systems can stay updated and improve their detection capabilities over time. Traditional SAST and DAST tools, by contrast, often require manual updates to their rule sets and can lag behind new threats.

Noteworthy AI-Powered Developments in Security Testing

Several companies and research groups are already leveraging AI to improve application security testing. Here are some notable examples:

GitHub Copilot with Copilot Labs

GitHub Copilot, built on OpenAI’s Codex, is primarily a code completion tool, but its offshoot project, Copilot Labs, aims to incorporate security features that can identify risky coding patterns as developers write code. By suggesting alternatives to insecure functions, like eval() or unsafe input handling, Copilot helps prevent vulnerabilities before they are introduced. As this technology evolves, it could provide real-time feedback on potential vulnerabilities while the developer is still working.

DeepCode by Snyk

Snyk’s acquisition of DeepCode brought AI-driven code analysis to its DevSecOps platform. DeepCode uses machine learning models trained on large, diverse codebases to identify vulnerabilities and code quality issues. Unlike traditional tools, which rely on predefined signatures, DeepCode can learn from open-source projects and improve its understanding of both secure and insecure patterns, making it more adaptable to different development environments.

ShiftLeft CORE

ShiftLeft’s security tool, CORE, uses a combination of AI and code property graphs (CPGs) to analyse applications at the code level. This approach allows ShiftLeft to trace data flows and detect vulnerabilities that static tools may miss, especially those involving the interaction of multiple components in a complex system. By combining traditional static analysis with AI-driven insights, ShiftLeft reduces the number of false positives while catching more subtle, context-specific security issues.

AI Research on Graph Neural Networks (GNNs)

Academia is also pushing the boundaries of AI-driven security testing. Research into Graph Neural Networks (GNNs), which treat source code as graphs, has shown promise in detecting sophisticated security vulnerabilities that rely on the relationships between code elements. GNNs are particularly adept at identifying flaws that involve complex interactions between different functions or variables, a task that traditional static analysis tools struggle with.

Contrast Security’s AI-Driven IAST

Although Contrast hasn't explicitly marketed their IAST as AI-driven yet, I believe the groundwork is being laid through initiatives like their Responsible AI Policy Project. This is designed to mitigate the risks of AI integration, such as data breaches and code vulnerabilities introduced through AI-generated code, making sure AI is applied responsibly in software security contexts. As AI models become more integrated into application monitoring and vulnerability detection, it’s likely that platforms like Contrast’s will adopt more sophisticated AI-driven features.

The Future of Security Testing

While AI is not yet a silver bullet for vulnerability detection, the advances in AI-powered security tools offer a glimpse of what’s possible. AI has the potential to address many of the limitations of traditional SAST and DAST tools, from reducing false positives to understanding complex application logic. Hybrid approaches, combining AI’s adaptability and learning capabilities with the reliability of static and dynamic analysis, are likely the next evolutionary step in secure software development.

As AI continues to mature, we can expect future security testing tools to become more accurate, more adaptive, and better able to protect applications from increasingly sophisticated attacks. For developers and security teams alike, this will mean faster, more effective vulnerability detection — and ultimately, more secure software.