What your vulnerability scanner won’t find: Limitations of automated testing

Modern application security relies on a broad ecosystem of tools to identify and address risks. From dynamic and interactive security testing to static testing and software composition analysis (and more), each tool serves a distinct purpose within a broader security strategy.

Vulnerability scanners—whether dynamic or static—are built to detect specific types of weaknesses, automate security assessments, and provide insight into exposure. Like any tool, they are optimized for specific use cases and have limitations in what they can detect and report. Knowing these limitations is critical for selecting the right combination of tools, correctly interpreting scan results, and ensuring you’re minimizing overall security risk regardless of the limits of individual tools.

Limitations of vulnerability scanners vs. false positives and false negatives

It’s so common to talk about a scanner not finding something or being unable to find a vulnerability that it’s easy to forget the many different reasons a security issue might not show up. Informally, we can say there are four main types of undesirable outcomes in automated vulnerability scanning:

• False positive findings: The scanner reports a vulnerability that does not exist due to incorrect detection logic, incomplete context, or low tool maturity.
• Non-actionable false alarms: The scanner reports a valid issue that requires no action or poses no real-world risk within the application’s usage or environment. Confusingly, these are also commonly called false positives.
• False negatives: A real and detectable vulnerability is present but not reported. This can occur due to misconfiguration, limited coverage, flawed assumptions built into detection logic, or low tool maturity.
• Undetectable vulnerabilities: Some security issues, such as flaws in business logic or vulnerabilities that require specific user interaction, are usually beyond the technical capabilities of automated vulnerability scanning. These represent the “true” limitations of scanners and are discussed in detail below.

What types of vulnerabilities cannot be detected by vulnerability scanning tools?

While vulnerability scanners can detect a wide range of security issues, both known and previously unknown, several categories of flaws typically fall outside their capabilities. These often involve application behavior, user context, or environment-specific configurations that automated scans are not built to interpret.

Business logic flaws

These stem from functional pathways that enable unintended or malicious use of application features. Since they depend heavily on context and are usually technically no different from valid application behavior, identifying them often requires human expertise and reasoning beyond what automated tools can provide.

Chained vulnerabilities

Some flaws may seem minor or not directly exploitable in isolation but can be combined into a high-impact attack chain. Most real-world attacks involve chaining at least a few and sometimes a dozen or more vulnerabilities and escalation steps. While individual vulnerabilities may be detectable for scanners, building attack chains is the domain of human testers and requires correlation and interaction analysis that standard scanning logic typically doesn’t support.

Authentication issues

Similarly to business logic flaws, access control and role-based permission errors may not appear as typical vulnerabilities. For instance, if restricted pages are accessible from an unprivileged user account due to misconfigured roles, a scanner might miss them unless it supports testing with multiple sets of credentials and is set up to do so.

User-driven vulnerabilities

Issues triggered only through specific user actions or interface behavior—such as client-side logic flaws—can be difficult for scanners to replicate. These require real-time simulation of user interactions to be discovered and while advanced DAST scanners can and do interact with page Document Object Models like a real user, vulnerabilities that need a specific sequence of user actions may be hard to find automatically.

Zero-day vulnerabilities

Security flaws in newly created or modified first-party code usually won’t be previously known and reported, so they won’t be picked up by signature-based scanners that look for known patterns and components. However, advanced heuristic vulnerability scanners that run active security checks may be able to identify these potential zero-days by provoking and observing vulnerable behaviors in the application (see below for a detailed discussion of zero-day detection with DAST).

Out-of-band vulnerabilities

Most vulnerability scanners run their security checks by sending a request and analyzing the direct application response to that request (in-band detection). However, some real-life vulnerabilities either don’t manifest themselves in the immediate response or cannot be detected in-band due to intervening restrictions or firewalls. Only the most advanced DAST tools, notably Invicti and Acunetix, are able to also test for and identify out-of-band vulnerabilities, where the confirmation of vulnerable application behavior is received via a different channel.

Hidden or internal assets

Assets not listed in scan configurations, from exposed test environments and undocumented API endpoints to forgotten websites or unlinked files that cannot be crawled, often go untested. Proactive discovery is required to detect and assess these components, with possible methods including domain-based discovery, API traffic analysis, and additional server-side tools such as an IAST agent.

Regulatory or compliance violations

As any CISO will tell you, not all application security risks are rooted in application code. Failing to meet compliance standards, such as secure data handling, policy enforcement, or security management processes, might not show up in any findings but still represent significant risk.

Understanding zero-day detection with DAST

Zero-day vulnerabilities are flaws that have not yet been disclosed or patched. In web applications, many zero-days originate in custom code rather than commercial software. DAST is uniquely suited for detecting such issues by observing how an application responds to unexpected inputs or workflows. Unlike static tools that look for known code patterns or purely signature-based dynamic scanners that check for known vulnerable components, DAST can also actively identify new vulnerabilities based on actual runtime behavior.

What sets advanced DAST tools apart

All vulnerability scanning methods have their inherent limitations, but dynamic application security testing (DAST) stands out as by far the most flexible and comprehensive approach to finding and closing realistic security gaps. DAST interacts with live applications to evaluate behavior from an external perspective—similar to how an attacker would operate. This enables the scanner not only to uncover runtime vulnerabilities that don’t show up in source code or dependency analysis but also to show which issues are exploitable and need priority action.

Invicti specifically takes this a step further by making DAST the foundational tester and fact-checker of an entire AppSec platform. With proof-based scanning at the heart of its scan engine, Invicti minimizes unnecessary follow-up and streamlines remediation with actionable, confirmed findings.

Unlike a standalone vulnerability scanner that only handles the DAST scanning part, the Invicti platform takes a far more comprehensive approach to maximize coverage and minimize realistic security risk exposure. Platform features include:

• Robust discovery, crawling, and authentication to maximize coverage
• Support for testing APIs, single-page applications, and modern frameworks
• Sensor-based IAST for runtime-level visibility and insight without code instrumentation
• Dynamic SCA and outdated technology detection
• Integration with SAST, static SCA, and other AST tools to unify and correlate findings across the application security toolchain

Scenarios where a DAST-first approach makes all the difference

A DAST-first mindset is not about running DAST and nothing else—it’s about viewing all of AppSec through the lens of real-world risk and exploitability. Any mature cybersecurity program should incorporate many different tools for different purposes, but Invicti’s DAST-first platform approach brings a host of unique benefits:

• Prioritization with Predictive Risk Scoring: Invicti’s proprietary machine learning model shows you which sites and applications are most likely to have critical vulnerabilities before you even start scanning.
• Validation of findings with proof-based scanning: Many of the most common vulnerabilities such as cross-site scripting (XSS) and SQL injection are safely exploited and confirmed to give your teams proof that an issue is actionable.
• Dynamic and static testing combined: Combining dynamic vulnerability scanning and SCA with Invicti’s own IAST and additional static SAST and SCA maximizes test coverage and lets you use DAST as a fact-checker for other tools.
• Discovery and testing for apps and APIs: Invicti is the only AppSec vendor to offer discovery and vulnerability scanning for both applications and APIs, all on a centralized platform.

Why DAST-first is the future of AppSec

Security programs are increasingly shifting from tool-centric to risk-centric approaches. Rather than addressing every finding equally, which is often impractical at scale, teams now aim to first mitigate the vulnerabilities that are most likely to be accessed and exploited. A DAST-first approach supports this direction by letting your development and security teams:

• Focus on exploitable issues that could open the door to attackers
• Reduce false positives and unnecessary manual verification and triage
• Prioritize testing and remediation based on risk and potential impact
• Provide tech-agnostic test coverage across complex, heterogenous application architectures

Making DAST the foundation of AppSec enables more informed risk management and improves operational efficiency.

Conclusion: Better security starts with real visibility

No single tool can detect every vulnerability. A modern application security program should be built on layering the right tools for the right risks—but not haphazardly. Invicti stands apart by taking proven DAST capabilities and using them to enable validation, integration, and automation across an entire AppSec platform. Adopting a DAST-first strategy lets your teams move from reacting to alerts to confidently managing real-world security risk.