SATE, the Static Analysis Tool Exposition, is a recurring NIST SAMATE study in which tool makers run analyzers on common programs and researchers analyze the output. NIST says it is not meant to find the best tool, so treat it as a method to borrow, not a ranking.
What SATE is
According to NIST, SATE is a non-competitive study of static analysis tool effectiveness. Participating tool makers run their tools on a set of test programs. Researchers then analyze the outputs. Everyone shares results and experiences at a workshop, and a public analysis report follows later.
NIST lists six expositions: 2008, 2009, 2010, SATE IV (March 2012), SATE V (March 2014) and SATE VI (September 2019).
What SATE VI examined
NIST's SATE VI page describes three tracks. A Classic Track used large test cases with realistic vulnerabilities injected. An Ockham Sound Analysis Criteria Track used Juliet 1.3 test cases to assess the soundness of tools. A Mobile Track used Android test cases. The page also says the three characteristics to explore were whether warnings are relevant to security, whether they are correct, and how they are prioritized.
Why it does not produce a ranking
The NIST pages say SATE does not aim to find the best tool and that tools have different strengths. Because the study is non-competitive, results should not be read as a ranking. Its main contribution is a methodology that others can apply to decide which tools fit their own requirements.
That is useful for buyers. If a vendor or a reviewer cites SATE as a source for a score, be careful. Ask which parts of the study the claim comes from, and whether the study even reports the number being cited.
How to use it as a buyer
- Borrow the shape of the test: common inputs, known injected issues, a review of whether each warning is correct and relevant.
- Borrow the questions: Is the warning security relevant? Is it correct? Is it prioritized sensibly?
- Do not borrow the data as a verdict on any product today. The most recent study listed ran in 2019, and tools change faster than that.
Build your own version
You can do a small SATE-style test in a week. Pick one realistic repository, plant a handful of known issues, and run every candidate tool on the same commit. Then label each warning for relevance and correctness. Our guide to running your own bake-off has the steps.
Where Safeguard fits
Safeguard offers SBOM and dependency scanning, reachability analysis and policy gates. A free scan at gold.safeguard.sh/scan can be one input to a test you run yourself.
Quick check
Is SATE a certification?
No. NIST describes it as a non-competitive exposition aimed at research and methodology. It does not certify or rank tools.
Can I cite SATE for a current tool comparison?
Be cautious. The latest exposition listed on the NIST page is from 2019, and it does not rank tools.
Sources
Last reviewed: 19 October 2026.
