How to benchmark security tools: a case study using WebGoat

What this post added

This post details the challenges and considerations when using WebGoat as a benchmarking target for SAST and DAST tools, highlighting that WebGoat's synthetic flaws and simplified architecture may not fully exercise the capabilities of advanced security analysis tools. It emphasizes the importance of using real-world applications and considering factors like tool applicability, consistency, and actionability of results when benchmarking.