The Hybrid SAST Intelligence Stack — Veracode
The Case for a Hybrid SAST Engine

One Scanner Was Never
Going to Be Enough.

44% of AI-generated code ships with a known vulnerability. Up to 78% of that risk is invisible to traditional deterministic scanners. Not to mention code volume has expanded 200% in the last 12 months. No single-method approach covers this expanded attack surface. Here’s why hybrid SAST is the only architecture that closes the gap.

Explore the Data
Scroll
The Problem

The Velocity Gap Is Real — and Growing

AI coding tools make developers faster. That part works exactly as advertised. What hasn’t kept up is security. Volume is up. Velocity is up. And the vulnerability classes doing the most damage right now are precisely the ones traditional scanning was never designed to catch.

44%
of all AI code generation tasks produced code with a known vulnerability in 2026 testing — nearly identical to where this research series began
Veracode 2026 GenAI Code Security Report
78%
of AI-generated risk is missed by traditional deterministic scanners alone — because business logic flaws don’t show up in rule sets
DryRun Security
200%
expansion in code volume and coding velocity over the last 12 months as AI-assisted development becomes the default workflow
DryRun Security
AI coding tools accelerate volume, not safety
AI assistants are writing real production code now, not just autocompleting boilerplate. Syntax is nearly perfect — 99.9% pass rate across the dataset. Security is a different problem entirely. The tools generating the code weren’t built to secure it.
99.9% syntax pass rate vs. 56% security pass rate
The worst flaws are the hardest to scan for
Cross-site scripting: 15% pass rate. Log injection: 12%. These aren’t edge cases — they’re active attack vectors sitting in production code right now. The same models score 83–87% on SQL injection and crypto. The gap isn’t random. It maps exactly to where rule-based scanning breaks down.
XSS: 15% pass rate · Log injection: 12%
Language choice compounds the exposure
Java is the outlier no one’s talking about — 30% mean security pass rate, roughly half what Python, C#, and JavaScript score. If the stack is Java-heavy, the actual risk profile is significantly worse than any aggregate benchmark suggests.
Java: 30% mean security pass rate
Traditional scanners weren’t built for this era
Deterministic SAST does exactly what it was built for: reproducible findings, dataflow analysis, audit evidence. It wasn’t built to catch authorization logic flaws, IDORs, or broken authentication. Those happen to be the exact vulnerability classes that dominate AI-generated risk.
Up to 78% of AI-generated risk missed by traditional scanners
The AI Ceiling

Confident Output Isn’t the Same as Correct Output

DryRun’s contextual engine catches what deterministic scanners miss: authorization flaws, business logic gaps, context-dependent vulnerabilities. That’s real. That’s why the hybrid model exists. But AI analysis on its own hits hard ceilings — and no amount of prompting fixes them. Non-deterministic output breaks baselines. Fabricated findings — confident, detailed, and wrong — do more damage to developer trust than a missed vulnerability ever would. The deterministic layer is what makes the AI layer safe to rely on.

01
Non-Deterministic Output
Flip to see team impact
The Problem
Run the same code twice and get different findings. That breaks baselines, kills regression gates, and makes diff-based triage useless. Veracode’s deterministic engine fixes this: same code, same findings, every single scan. Without that anchor, the contextual findings DryRun surfaces have nowhere stable to land.
Team impact: “No new criticals” gates stop working. Security trend data becomes meaningless.
02
Fabricated Findings
Flip to see team impact
The Problem
AI scanners generate vulnerabilities with confident descriptions, specific line numbers, realistic data flows — that don’t exist. Developers chase them, find nothing, and stop trusting the scanner. That erosion is harder to reverse than a missed finding. Veracode’s deterministic engine validates AI output before it reaches anyone’s PR.
Team impact: Developer trust in scanner output erodes. Triage effort spikes across the board.
03
Shallow Code Flow Analysis
Flip to see team impact
The Problem
LLMs don’t compute data flow — they approximate it. Long call chains, reflection, dynamic dispatch, framework wiring: all guessed at, none traced. Veracode’s engine computes actual source-to-sink paths across millions of lines. That’s not an improvement over AI analysis. It’s a different capability entirely.
Team impact: Complex injection flaws across service boundaries go undetected in large codebases.
04
Scale Constraints
Flip to see team impact
The Problem
Enterprise codebases don’t fit in an LLM context window. They get chunked — which severs cross-file and cross-service data flows right where the interesting vulnerabilities live. Veracode’s engine doesn’t have that constraint. It was built for this scale from the start. That’s the foundation DryRun’s AI layer needs to work at full depth.
Team impact: Enterprise-scale applications can’t be fully analyzed. Critical paths stay invisible.

AI scanning genuinely excels at the vulnerability classes rule-based systems miss :

Authorization & logic flaws — BOLA, IDOR, missing access controls that deterministic rules can’t surface
Business logic vulnerabilities — complex reasoning about workflow and state that requires semantic understanding
False-positive suppression — contextual reasoning about real exploitability reduces deterministic scanner noise
Developer-friendly remediation — plain-language guidance in the PR workflow, not just rule IDs and CWE numbers
The Determinism Advantage

Same Code. Same Findings. Every Time.

Determinism isn’t a legacy artifact. It’s an engineering guarantee — and it’s what makes AI-layer findings operationally usable. DryRun surfaces the logic flaws and authorization gaps that rule-based engines miss. But those findings need somewhere to land. The scan today has to match the scan next quarter, line by line. Without that, there’s no baseline to compare against, no regression gate to enforce, no evidence to hand an auditor. AI brings the reasoning. Veracode’s deterministic engine brings the proof. Neither is complete without the other.

01
Reproducibility
Same code. Same findings. Every time. That’s not a nice-to-have — it’s the only way baselines work, regression gates hold, and risk trends mean anything. AI analysis can’t guarantee this. And without a reproducible foundation, even the best contextual findings become noise.
Engineering Guarantee
02
Audit-Grade Evidence
A data flow trace — source, propagation, sink — isn’t a confidence score. It’s a computation. Independently verifiable. That’s what auditors ask for, and it’s the one thing AI analysis can’t produce on its own. When DryRun’s contextual findings are anchored to that deterministic evidence chain, they become defensible. That’s the difference between insight and proof.
Compliance Ready
03
Compliance Currency
PCI-DSS, FedRAMP, ISO 27001 — all built around deterministic SAST. That floor doesn’t lower as AI-generated code accelerates. It gets higher. More code means more surface area, more audit exposure, more pressure to show consistent evidence. The hybrid model handles both sides: DryRun’s contextual analysis on top of Veracode’s compliance-grade deterministic foundation. Coverage and auditability. Not a trade-off.
PCI · FedRAMP · ISO 27001
Data Flow Analysis — source to sink verification
Source
user input
Service
propagation
Handler
data flow
Sink
SQL query

Veracode’s deterministic traces are independently verifiable as compliance evidence. DryRun’s contextual findings tell you what matters most. Together: coverage without guesswork.

The Intelligence Stack

Each Approach Covers Exactly What the Other Can’t

Veracode’s deterministic engine and DryRun’s contextual analysis were built to cover each other’s blind spots. Deterministic SAST computes data flows at scale but can’t reason about authorization logic or business context. AI analysis understands intent and logic but can’t reproduce findings or produce verifiable evidence. Put them together and the coverage gap closes — noise cancellation runs in both directions. This isn’t a go-to-market positioning claim. It’s how the technology actually works.

Capability Deterministic SAST AI / LLM Analysis Hybrid Stack
Data flow tracking across millions of LoC ✓ Strong ✗ Approximated ✓✓ Complete
Authorization & logic flaw detection ✗ Blind spot ✓ Strong ✓✓ Complete
Reproducible findings / regression gating ✓ Guaranteed ✗ Non-deterministic ✓✓ Guaranteed
Audit-grade evidence for compliance ✓ Accepted standard ✗ No verifiable trace ✓✓ Full coverage
False-positive suppression ✗ High noise ✓ Contextual reasoning ✓✓ Noise-cancelled
PR-workflow inline guidance ✗ Post-merge only ✓ Native ✓✓ Native
Scale to enterprise codebases ✓ Purpose-built ✗ Context-window limited ✓✓ Unlimited
Millions of Lines of Code. Thousands of Security Rules.
One Reproducible Result — Every Time.
What Makes the Difference

Five Reasons the Hybrid Approach Holds

These aren’t marketing claims. Each one maps to a specific gap in either AI-only or SAST-only approaches — gaps that are real, measurable, and documented. Together they form a coverage architecture neither method reaches on its own.

Broader Coverage Across Both Vulnerability Classes
Dataflow vulnerabilities and business logic risks covered in a single pass. Deterministic rules find the flaws with clear paths. AI reasoning finds the ones that only make sense in context. Neither engine gets to both. The combination does.
Reproducible Findings for Regulatory Programs
Findings mapped to PCI-DSS, FedRAMP, ISO 27001 — consistently, scan after scan. The deterministic engine produces the repeatable evidence base compliance programs actually require. Not estimates. Evidence.
Higher-Confidence Findings with Fewer False Positives
AI contextual reasoning filters SAST noise by evaluating real-world exploitability. Deterministic analysis validates AI output and prevents fabrication. The result is a shorter, higher-confidence finding list — the kind developers actually work through.
Inline PR Guidance Where Developers Already Work
Security findings land in GitHub and GitLab PRs — before merge, in the tools developers are already in. No portal to log into. No context switch. Issues get fixed at the point where fixing them is cheapest.
Reduced AppSec Overhead Across the Board
Less triage. Less tuning. Less rule maintenance. The hybrid model scales coverage with the pace of AI-assisted development — without adding headcount to keep up with it.
LLM Efficiency at Real Enterprise Scale
Analyzing millions of lines across thousands of security rules simultaneously — that’s not something an LLM does. It’s what the deterministic engine was built for. It’s the infrastructure that lets the AI layer operate at enterprise scale without cutting corners.

How Veracode’s Hybrid SAST + AI Solution Helps

By combining DryRun’s Contextual Security Analysis engine with Veracode’s industry-leading deterministic static analysis engine, enterprise teams uncover more risk before release, keep pace with AI-assisted development, and produce clear, repeatable evidence for auditors and regulators.


The solution automatically reviews code changes and merge candidates — pull requests in GitHub and GitLab — and delivers actionable guidance directly in the developer workflow. Security issues are addressed before code is merged, not discovered weeks later in a separate portal.


For developers, that means security feedback in the tools they already use. For AppSec teams, broader visibility into harder-to-find issues. For leadership, repeatable reporting that supports audit and compliance needs — without adding headcount or manual overhead.

Broader coverage across well-defined vulnerability classes and context-dependent business logic risks
Reproducible findings required for PCI-DSS, FedRAMP, and ISO 27001 compliance programs
Higher-confidence findings with fewer false positives — less noise, faster remediation
Inline PR guidance in GitHub, GitLab, Cursor, Claude, Windsurf, and VS Code
Reduced AppSec overhead from manual triage, rule maintenance, and tuning
AI-native remediation through MCP integration in supported AI coding environments
Who It’s Built For

The Answer Depends on Who’s Asking

The same platform tells a different story depending on where you sit. Select a role to see what matters most.

For Security Leaders

Veracode’s deterministic engine finds the data-flow vulnerabilities that need computational analysis at scale — the ones AI scanners miss entirely. DryRun’s contextual engine handles authorization logic, IDORs, and business logic flaws. The coverage overlap is minimal and intentional. When an auditor asks for evidence, the deterministic trace is there. When a pen tester asks about logic flaws, so are the contextual findings.

For Engineering Teams

The deterministic engine gives the AI layer something to stand on — stable, scalable, consistent. Together, findings show up in the PR, in GitHub or GitLab or VS Code, before anything is merged. The hybrid model doesn’t get in the way of development. It catches what would have gotten in the way later.

For Compliance & Risk Teams

Deterministic SAST is still the accepted standard for PCI-DSS, FedRAMP, and ISO 27001. That doesn’t change as AI-generated code accelerates — if anything, the compliance exposure grows with the volume. Veracode’s engine produces the independently verifiable data flow traces auditors ask for. DryRun’s layer adds logic-flaw detection for the risk AI-era development creates. One contract. One governance model. Nothing left uncovered.