Notifications
Clear all
Topic starter
19/08/2026 4:04 pm
TL;DR: A benchmark review found 42 of 47 source-confirmed issues in a deliberately vulnerable repository and outperformed Snyk on precision, recall, and F1, according to Corgea. The result reinforces a familiar SAST lesson: coverage across authentication, configuration, and code-path context matters as much as recognizable taint-flow patterns.
NHIMG editorial — based on content published by Corgea: Corgea vs Snyk benchmark on a deliberately vulnerable repository
By the numbers:
- Corgea found 42 of 47 source-confirmed issues and Snyk found 26 in the same benchmark set.
- Corgea reached 89.36% recall and 85.71% F1, while Snyk reached 55.32% recall and 65.00% F1.
- Corgea reported 82.35% precision versus Snyk's 78.79% precision on the same scoring set.
Questions worth separating out
Q: How should teams evaluate SAST tools in mixed application and configuration repositories?
A: Use a fixed benchmark that includes application code, infrastructure templates, and identity-related control failures.
Q: Why do false negatives matter more than high alert volume in SAST?
A: False negatives leave exploitable issues outside the backlog, so nothing gets triaged or remediated.
Q: What do security teams get wrong when comparing pentesting tools?
A: They often compare output volume, interface polish, or feature lists instead of asking how the platform validates findings and limits unsafe access.
Practitioner guidance
- Benchmark scanners against your own repository mix Use a fixed issue set that includes application logic, deployment templates, parser configuration, and identity-related control failures.
- Measure reviewer-accepted precision Track the percentage of findings that survive engineer review without reclassification or dismissal.
- Test for multi-file authorization and config issues Include unauthorised write paths, credential exposure in manifests, and unsafe parser settings in your evaluation rubric.
What's in the full report
Corgea's full benchmark analysis covers the operational detail this post intentionally leaves for the source:
- The full issue-by-issue classification table showing true positives, false positives, and false negatives for both tools.
- Repository-specific examples of the findings Corgea missed and the findings Snyk missed, useful for control tuning.
- The reviewer methodology used to classify findings against source-confirmed issues in the benchmark set.
- The supplemental observations on Snyk-only rows that were discussed separately from the fixed benchmark denominator.
👉 Read Corgea's benchmark analysis of Corgea vs Snyk on vulnerable code →
Corgea vs Snyk on vulnerable code scanning: what changed?
Explore further
19/08/2026 4:38 pm
Coverage, not just signal quality, is the real SAST differentiator. A scanner that finds only the most obvious injection paths leaves authentication, configuration, and authorization weaknesses outside the security backlog. In mixed repositories, that is a governance failure because the organisation cannot remediate what it never sees. Practitioners should treat recall as a control objective, not a reporting metric.
A question worth separating out:
Q: Should organisations prioritise recall or precision when choosing a SAST platform?
A: They need both, but the balance depends on programme maturity. Early on, enough recall is essential to expose the real defect population, while precision determines whether developers will keep using the tool. The right choice is the scanner that best fits your review capacity and the kinds of issues your repositories actually contain.
👉 Read our full editorial: Corgea vs Snyk on a vulnerable repo: what the benchmark shows
