Even with SAST, SCA, secrets, container, IaC and CSPM scanners all running, some problems remain unseen: business logic flaws, broken access control, unknown vulnerabilities, abused legitimate access, and mistakes in process. Scanners find patterns and known issues, so anything novel or contextual needs humans, testing or other controls.
Logic and access control
OWASP notes that automated static tools struggle with authentication problems, access control issues and insecure cryptography use. A scanner cannot know that user A should not read user B's invoice, because that rule lives in your product design, not in a syntax pattern. Code review, threat modelling and dynamic or manual testing fill this gap.
Vulnerabilities nobody has published
SCA and container scanning work from known, publicly disclosed vulnerabilities. A flaw that has no record yet will not match anything. Between disclosure and database entry there is also a lag. This is why defence in depth matters: least privilege, network limits and monitoring reduce the damage of a flaw you could not detect.
Components that are hard to identify
Matching depends on identifying what a component is. The OWASP Dependency-Check documentation says that if no CPE is identified, no CVE entries are reported for that dependency. Vendored code, copied source files and software compiled by hand can fall outside what a scanner recognises. Trivy likewise limits OS package coverage to official vendor packages.
Skipped paths and configuration
Scanners often have default exclusions to reduce noise, and Trivy notes secrets in built in allowed paths can go undetected. Review exclusions rather than trusting them forever.
People and process
No scanner detects:
- A phished developer account pushing malicious code.
- A maintainer who adds a harmful update to a package you trust.
- An approval step that everyone clicks through.
- Offboarding that leaves old access in place.
Controls here are identity hygiene, review requirements, change approval and monitoring of behaviour.
What to do with this list
Write down, for each gap, which control covers it and who owns it. Where the answer is nobody, you have found your next investment. A clean scan report means the tools found nothing in what they looked at. It does not mean the system is secure.
Quick check
Does a clean report from all six classes mean we are safe?
No. It means those tools found nothing in the inputs they read. Logic flaws and unknown vulnerabilities remain possible.
What covers broken access control?
Design review, authorisation tests and dynamic testing, since static patterns rarely express who may see what.
Sources
- OWASP: Source Code Analysis Tools
- OWASP Dependency-Check
- Trivy: vulnerability scanning
- Trivy: secret scanning
Last reviewed: 19 October 2026.
