Run the scanner against a practice application that is insecure on purpose, keep it isolated from real data and networks, and compare what the scanner reports with the flaws the app is known to contain. Count what it found, what it missed and what it invented.
Practice targets from OWASP
Juice Shop is a deliberately insecure web application built with Node.js, Express and Angular. OWASP describes uses including training, capture the flag events and as a test subject for security scanners, especially for JavaScript heavy front ends and REST APIs.
WebGoat is a deliberately insecure application for learning about vulnerabilities common in Java apps. Its page warns that running it makes your machine highly vulnerable, recommends disconnecting from the internet while using it, and notes the default configuration binds to localhost.
OWASP Benchmark is a free, open source test suite in Java and Python, designed to verify the speed and accuracy of vulnerability detection tools. It is a runnable web application that static, dynamic and interactive tools can scan, and a companion project generates scorecards.
Safety rules
- Run the app on a laptop or an isolated virtual machine, bound to localhost.
- Never expose it to the internet or a shared network.
- Do not put real credentials or customer data near it.
- Scan only systems you own or have permission to test.
How to score
| Result | Meaning |
|---|---|
| Reported and real | True positive |
| Real and not reported | False negative, a miss |
| Reported and not real | False positive |
| Not reported and not real | True negative |
Compute two simple ratios: of the real flaws, how many did the tool find, and of the tool's findings, how many were real. Do this per vulnerability class so you can see strengths and gaps.
Limits of this test
A practice app is not your app. It lacks your frameworks, your authentication and your odd legacy code. Use it to compare tools on equal ground, then run a trial on a copy of one real service before you decide anything.
Common mistakes
Another trap is comparing tools with different settings. Use default settings for a first pass, then tuned settings, and record both so the comparison is fair. Note scan time and any setup effort too, since a tool that needs a week of configuration costs more than its report suggests. Finally, keep the raw output from each run. If you later repeat the test after an update, you can see whether results improved or regressed.
Quick check
Is a perfect score on a practice app enough?
No. Tools can be tuned to known benchmarks. Always confirm on your own code.
Can I scan a practice app hosted by someone else?
Only if the owner explicitly allows it. Running your own copy is simpler and safer.
Where Safeguard fits
Safeguard provides SBOM and dependency scanning and a free scan you can point at a real project to compare against your current results.
Sources
Last reviewed: 19 October 2026.
