# Run an AI Native SAST scan

> Start an AI Native SAST scan, choose what it covers, and read its report.

Source: https://scansuite.eu/documentation/usage/static-code-analysis/executing-the-ai-powered-scan
Last reviewed: 2026-10-19

**AI Native SAST** does not match patterns. A model reads each file in scope and reports logic and data-flow flaws, such as broken authorization and unsafe data handling, even where no rule exists for them. Optionally, each finding is checked for a path from user input before it is reported.

## Before you start

| Prerequisite | How to check |
|---|---|
| The team has AI | Teams → AI tab → AI provider: Use is the system AI or the team's own models, not No AI. Test connection answers. See [AI providers and cost](https://scansuite.eu/documentation/usage/ai-providers). |
| AI budget is left | Teams → AI tab → Monthly token budget: the meter is below the limit. AI features pause when it is reached. |
| You may start scans | Your role in the team is operator or team admin: the Start Analysis button is shown on the Static Code Analysis page. |
| A product exists | Products in the sidebar lists at least one product. See [Products](https://scansuite.eu/documentation/usage/products). |
| A private repository is reachable | For an SSH address, you or your team has an SSH key. See [Git repository authentication](https://scansuite.eu/documentation/usage/static-code-analysis/git-repository-authentication). |

Without AI, the AI Native SAST part of a scan does not start: the scan log says *AI SAST cannot start because an AI provider is not configured.*

## Run the scan

1. **Open Static Code Analysis in the sidebar**
2. **Give it the code**

   On the Git Repository tab, enter the repository in Repositories; or, on the Upload ZIP tab, drop a .zip of the source.
3. **Choose the Product Assignment**

   The product the findings are filed under.
4. **Check that AI Native SAST is on**

   It is on by default under AI Featured Code Analysis. Open its row to set the options in the table below.
5. **Click Start Analysis**

   A single scan opens its scan page.

**Check it worked:** the scan page shows the **AI analysis** card with its stages, and the token count grows as the scan runs. If an error message appears instead, see [Static Code Analysis](https://scansuite.eu/documentation/usage/static-code-analysis) for the messages the form can show.

## Options

The options sit in the AI Native SAST row; each has a one-line description on the form.

| Option | What it does | Default | When to change it |
|---|---|---|---|
| Analyze Git history | Also looks at recent commits for secrets and vulnerable code introduced in the past. | On | Switch off for an upload without Git history, or to save time and tokens. |
| Verify findings reachability | Reports a finding only when a path from untrusted input to the dangerous operation can be traced, and shows that path. | On | Switch off to see every candidate finding, at the cost of more noise. |
| Analyze security architecture | Maps frameworks, authentication and trust boundaries so severities reflect how the application is built. Its summary appears in the report and on the product page. | On | Switch off for a quick scan of a small change. |
| Cross-file hunt: auth, data isolation, LLM, CI/CD | Looks for authentication, tenant-isolation, LLM and CI/CD flaws that span several files. | Off | Switch on for a periodic deep scan. Turning it on turns on Analyze security architecture, which it needs; turning the architecture off turns it off. |

The defaults apply until your first scan; after that the form preselects what you chose last time in this team. Turning AI Native SAST off clears its options.

### What is analysed

- The files of the **Main Language** you chose, or of every supported language with *All supported languages* (the default).
- Narrowed to the patterns you list with **Custom Scope**, or to what changed with **Incremental Scan** and **Monitor Changes**.
- Tests, mocks, vendored code, documentation, minified bundles and very large files are skipped.

### What reachability changes

With *Verify findings reachability* on, a finding that cannot be traced from untrusted input is not saved to Vulnerabilities; the HTML report lists it in a separate, collapsed section. Each reachable finding shows its path as a diagram, with the files and lines that prove it, so a reviewer can check the reasoning instead of trusting it.

### Findings you already have

A finding the product already has is updated rather than reported again, and a finding that matches a suppression rule or a suppressed name is not reported. See [Vulnerability Management](https://scansuite.eu/documentation/usage/vulnerability-management).

## Verify Fixes

AI Native SAST is the engine that reassesses findings in the **Verify Fixes** mode. Whether it may close a finding it finds fixed is decided by **Close findings that are verified as fixed** on the Teams page, AI tab (*How AI handles findings* card, On by default). See [Rescans and fix verification](https://scansuite.eu/documentation/usage/vulnerability-management/rescans-and-fix-verification).

## Where the model runs

A cloud model needs internet access and receives the code it analyses; a locally hosted model keeps the source on your own infrastructure. Which AI a team uses, and which model does which task, is set as described in [AI providers and cost](https://scansuite.eu/documentation/usage/ai-providers).

> **Confidentiality:** Submitting code to a cloud-based service may raise privacy or contractual concerns. For sensitive or proprietary codebases, use a locally hosted model.

## Cost and duration

- AI analysis takes longer than a classic scan and is priced per token. Scope is the main cost control: point **Custom Scope** at the code that carries the application logic, and use **Incremental Scan** or **Monitor Changes** for re-scans.
- The Git history, security architecture and cross-file options each add time and tokens.
- When you enter a single repository, the form shows what its last finished scan spent: the nearest thing to a price for the next one.
- Results can vary slightly between runs, because each analysis is generated afresh.

## Read the results

The scan page follows the analysis stage by stage (Git history, Architecture, Source analysis, Cross-file hunt, Validation, Advisory, Report) with the tokens and cost so far. When it finishes, it counts the findings that are new, confirmed, reopened and auto-closed. See [The scan page](https://scansuite.eu/documentation/usage/managing-scan-execution/scan-page).

![AI scan page](https://scansuite.eu/static/assets/img/docs/usage/static-code-analysis/executing-the-ai-powered-scan/02.png)

*A finished AI scan on its page: every stage done, and what it changed*

The findings are stored in [Vulnerabilities](https://scansuite.eu/documentation/usage/vulnerability-management) under the product. **Download report** on the scan page, or the **Report** button of its row in Scan History, downloads a ZIP with the HTML, XLSX and JSON reports. The HTML report carries the risk summary, the application architecture and the path diagrams.

![AI SAST HTML report](https://scansuite.eu/static/assets/img/docs/usage/static-code-analysis/executing-the-ai-powered-scan/03.png)

*The generated HTML report*

> **Note:** AI Native SAST results are not exported to DefectDojo. They stay in ScanSuite, on the Vulnerabilities page and in the downloadable reports.