The great SAST dissonance: how to please every... (Claudio Merloni, Romain Gaucher)
summary
SAST coverage misses the long tail: analysis of ~80,000 repositories surfaces ~7,000 unique dependencies and shows the top 1,000 libraries fully cover only ~16% of repos. A pipeline combines static parsing, multi-agent LLM classification, a triage UI and a rule compiler to auto-generate annotated stubs and static-analysis rules — moving from ~700 to ~7,000 Python rules in weeks. The system finds real new vulnerabilities and reduces rule authoring from days to minutes, delivering prioritized long‑tail modeling and automated rule synthesis.
AI-written summary · about
chapters (14)
- 0:00Introduction
- 1:26Why static analysis is hard
- 3:54What is static analysis
- 6:01Fundamental challenges of SAS
- 7:27Problems with benchmarks
- 10:36What is coverage
- 13:28Longtail libraries matter
- 17:39Dependency analysis across repos
- 23:52Scaling coverage with AI
- 28:49AI-driven rule generation
- 33:26Rule synthesis and automation
- 37:40Benefits of AI and static analysis
- 40:31Key takeaways and limitations
- 43:24Q&A session
related talks
35mKnow Your Tools: Quirks And Flaws, Integrating SAST Into Your Pipeline
25mHow to select between SAST, DAST, IAST, RASP, and AST
39mPractical Static Analysis for Continuous Application Security
16mAdvanced SAST: How to Secure AI-Generated Code
32mSAST and Sensibility: A Rubyist’s Guide to Static...
26mSecurity Automation For GraphQL
33mBattle Tested Application Security
54mA Shock to the System Static Analysis for Real AppSec