Run an AI Native SAST scan
Start an AI Native SAST scan, choose what it covers, and read its report.
AI Native SAST does not match patterns. A model reads each file in scope and reports logic and data-flow flaws, such as broken authorization and unsafe data handling, even where no rule exists for them. Optionally, each finding is checked for a path from user input before it is reported.
Before you start
| Prerequisite | How to check |
|---|---|
| The team has AI | Teams → AI tab → AI provider: Use is the system AI or the team's own models, not No AI. Test connection answers. See AI providers and cost. |
| AI budget is left | Teams → AI tab → Monthly token budget: the meter is below the limit. AI features pause when it is reached. |
| You may start scans | Your role in the team is operator or team admin: the Start Analysis button is shown on the Static Code Analysis page. |
| A product exists | Products in the sidebar lists at least one product. See Products. |
| A private repository is reachable | For an SSH address, you or your team has an SSH key. See Git repository authentication. |
Without AI, the AI Native SAST part of a scan does not start: the scan log says AI SAST cannot start because an AI provider is not configured.
Run the scan
- 01Open Static Code Analysis in the sidebar
- 02Give it the code
On the Git Repository tab, enter the repository in Repositories; or, on the Upload ZIP tab, drop a .zip of the source.
- 03Choose the Product Assignment
The product the findings are filed under.
- 04Check that AI Native SAST is on
It is on by default under AI Featured Code Analysis. Open its row to set the options in the table below.
- 05Click Start Analysis
A single scan opens its scan page.
Check it worked: the scan page shows the AI analysis card with its stages, and the token count grows as the scan runs. If an error message appears instead, see Static Code Analysis for the messages the form can show.
Options
The options sit in the AI Native SAST row; each has a one-line description on the form.
| Option | What it does | Default | When to change it |
|---|---|---|---|
| Analyze Git history | Also looks at recent commits for secrets and vulnerable code introduced in the past. | On | Switch off for an upload without Git history, or to save time and tokens. |
| Verify findings reachability | Reports a finding only when a path from untrusted input to the dangerous operation can be traced, and shows that path. | On | Switch off to see every candidate finding, at the cost of more noise. |
| Analyze security architecture | Maps frameworks, authentication and trust boundaries so severities reflect how the application is built. Its summary appears in the report and on the product page. | On | Switch off for a quick scan of a small change. |
| Cross-file hunt: auth, data isolation, LLM, CI/CD | Looks for authentication, tenant-isolation, LLM and CI/CD flaws that span several files. | Off | Switch on for a periodic deep scan. Turning it on turns on Analyze security architecture, which it needs; turning the architecture off turns it off. |
The defaults apply until your first scan; after that the form preselects what you chose last time in this team. Turning AI Native SAST off clears its options.
What is analysed
- The files of the Main Language you chose, or of every supported language with All supported languages (the default).
- Narrowed to the patterns you list with Custom Scope, or to what changed with Incremental Scan and Monitor Changes.
- Tests, mocks, vendored code, documentation, minified bundles and very large files are skipped.
What reachability changes
With Verify findings reachability on, a finding that cannot be traced from untrusted input is not saved to Vulnerabilities; the HTML report lists it in a separate, collapsed section. Each reachable finding shows its path as a diagram, with the files and lines that prove it, so a reviewer can check the reasoning instead of trusting it.
Findings you already have
A finding the product already has is updated rather than reported again, and a finding that matches a suppression rule or a suppressed name is not reported. See Vulnerability Management.
Verify Fixes
AI Native SAST is the engine that reassesses findings in the Verify Fixes mode. Whether it may close a finding it finds fixed is decided by Close findings that are verified as fixed on the Teams page, AI tab (How AI handles findings card, On by default). See Rescans and fix verification.
Where the model runs
A cloud model needs internet access and receives the code it analyses; a locally hosted model keeps the source on your own infrastructure. Which AI a team uses, and which model does which task, is set as described in AI providers and cost.
Submitting code to a cloud-based service may raise privacy or contractual concerns. For sensitive or proprietary codebases, use a locally hosted model.
Cost and duration
- AI analysis takes longer than a classic scan and is priced per token. Scope is the main cost control: point Custom Scope at the code that carries the application logic, and use Incremental Scan or Monitor Changes for re-scans.
- The Git history, security architecture and cross-file options each add time and tokens.
- When you enter a single repository, the form shows what its last finished scan spent: the nearest thing to a price for the next one.
- Results can vary slightly between runs, because each analysis is generated afresh.
Read the results
The scan page follows the analysis stage by stage (Git history, Architecture, Source analysis, Cross-file hunt, Validation, Advisory, Report) with the tokens and cost so far. When it finishes, it counts the findings that are new, confirmed, reopened and auto-closed. See The scan page.
The findings are stored in Vulnerabilities under the product. Download report on the scan page, or the Report button of its row in Scan History, downloads a ZIP with the HTML, XLSX and JSON reports. The HTML report carries the risk summary, the application architecture and the path diagrams.
AI Native SAST results are not exported to DefectDojo. They stay in ScanSuite, on the Vulnerabilities page and in the downloadable reports.
Last reviewed 2026-10-19