Uploaded December 2025 | Updated September 2026, 2 weeks ago
Security and development teams rely on tools like SAST, DAST, and IAST to catch vulnerabilities early in the software development lifecycle. But anyone who’s used these tools knows they often come with a cost: false positives.
One of the biggest reasons for the false positives problem in vulnerability scanners is their lack of runtime context. Many vulnerabilities don’t exist in isolation—they only manifest when code actually runs. Without visibility into how an application behaves at runtime, traditional static and dynamic tools either miss actual vulnerabilities or flag vulnerabilities that aren’t exploitable.
To dig into this problem, we turned to the OWASP Benchmark to uncover gaps in vulnerability scanners and identify the root cause of false positives. We will also talk about benchmarking gaps and the need for new test cases for attack vectors that involve runtime features in Java like Reflection, Class Loading and Deserialization, where context determines exploitability.
In this talk, we’ll walk through what we found. We’ll show which patterns and behaviors tend to confuse traditional tools, and how runtime-aware approaches, like instrumentation, RASP, and IAST, improve false positives and negative rates in vulnerability detection and attack prevention.
Builders of security tools will see how runtime visibility improves accuracy. Breakers will get a better sense of what type of vulnerabilities static and dynamic scanners may miss. And defenders will learn how runtime security can help scale accurate detection across development, testing, and production—without slowing teams down.
Attendees will gain valuable insights into the types of application behavior that frequently lead to false positives in vulnerability detection tools. You will better understand why having visibility into runtime application behavior is required to significantly reduce or eliminate these false positives and how runtime security provides this level of visibility. Finally, we will also look at how runtime security can help scale vulnerability and attack detection across the entire SDLC.
Apostolos Giannakidis
Microsoft
Principal Product Security Engineer
Dublin, Ireland
Apostolos Giannakidis is currently leading the Threat Modeling program at Microsoft Identity. Before joining Microsoft, he served as VP of Application Security at JP Morgan Chase and led the security strategy at Waratek. He has been acknowledged by Oracle, he is featured on Google's Vulnerability Hall of Fame, and he holds two MSc degrees in Computer Science and Cloud Computing.
@cyberApostle
linkedin.com/in/giannakidisapostolos
Managed by the OWASP® Foundation
owasp.org
Security and development teams rely on tools like SAST, DAST, and IAST to catch vulnerabilities early in the software development lifecycle. But anyone who’s used these tools knows they often come with a cost: false positives.
One of the biggest reasons for the false positives problem in vulnerability scanners is their lack of runtime context. Many vulnerabilities don’t exist in isolation—they only manifest when code actually runs. Without visibility into how an application behaves at runtime, traditional static and dynamic tools either miss actual vulnerabilities or flag vulnerabilities that aren’t exploitable.
To dig into this problem, we turned to the OWASP Benchmark to uncover gaps in vulnerability scanners and identify the root cause of false positives. We will also talk about benchmarking gaps and the need for new test cases for attack vectors that involve runtime features in Java like Reflection, Class Loading and Deserialization, where context determines exploitability.
In this talk, we’ll walk through what we found. We’ll show which patterns and behaviors tend to confuse traditional tools, and how runtime-aware approaches, like instrumentation, RASP, and IAST, improve false positives and negative rates in vulnerability detection and attack prevention.
Builders of security tools will see how runtime visibility improves accuracy. Breakers will get a better sense of what type of vulnerabilities static and dynamic scanners may miss. And defenders will learn how runtime security can help scale accurate detection across development, testing, and production—without slowing teams down.
Attendees will gain valuable insights into the types of application behavior that frequently lead to false positives in vulnerability detection tools. You will better understand why having visibility into runtime application behavior is required to significantly reduce or eliminate these false positives and how runtime security provides this level of visibility. Finally, we will also look at how runtime security can help scale vulnerability and attack detection across the entire SDLC.
Apostolos Giannakidis
Microsoft
Principal Product Security Engineer
Dublin, Ireland
Apostolos Giannakidis is currently leading the Threat Modeling program at Microsoft Identity. Before joining Microsoft, he served as VP of Application Security at JP Morgan Chase and led the security strategy at Waratek. He has been acknowledged by Oracle, he is featured on Google's Vulnerability Hall of Fame, and he holds two MSc degrees in Computer Science and Cloud Computing.
@cyberApostle
linkedin.com/in/giannakidisapostolos
Managed by the OWASP® Foundation
owasp.org
