A Microsoft DevSecOps Static Application Security Testing (SAST) Exercise

The post introduces a formula for evaluating the value of static analysis, emphasizing that value is derived from actual fixes. It categorizes SAST findings into 'hot' (early, low-noise, blocking PRs), 'cold' (deep analysis, scheduled as issues), and 'lukewarm' (discarded). A case study details how MSRC used Semmle QL to analyze a sensitive, externally authored code base, tripling security findings and enabling analysis across multiple code variants and versions. The analysis was used to validate fixes and provided an automatable process for future servicing.