performing-web-application-vulnerability-triage

Triage DAST and SAST results by classifying each finding as true positive, false positive, or needs review based on evidence and confidence, then scoring risk with the OWASP methodology. Feed scanner output such as ZAP JSON into the triage pipeline to generate a prioritized report.

The OWASP Risk Rating Methodology computes Risk as Likelihood multiplied by Impact, each averaged from eight factors scored 0-9. Scores map to levels from Note through Critical, with scores of 42 or above rated Critical.

False positives often include informational header findings like missing CSP or X-Content-Type-Options at low severity. Verify true positives by manually reproducing the issue with SQL injection or XSS payloads before assigning a risk rating.

Yes, the triage process accepts DAST results from OWASP ZAP, Burp Suite, and Acunetix, plus SAST results from Semgrep, SonarQube, Checkmarx, and Snyk Code. Findings are deduplicated across both sources so the same flaw is not counted twice.

SAST injection findings like CWE-89 or CWE-78 require manual code review to confirm data flow reaches a real sink. Closing them without review risks dismissing exploitable vulnerabilities that scanners flagged correctly.