Definition
Rule- and pattern-based static analysis that scans source code for known vulnerability classes without executing the program.
Key Points
- Strong on known CWEs; weaker on novel logic/auth flaws that need architectural reasoning
- 2026 AI AppSec tools (claude-security-plugin, Copilot
/security-review) position as complementary, not replacements - Often paired with SCA (dependencies), DAST, and code review in CI