Semgrep and SonarQube found zero of 232 access-control bugs

According to the RealVuln v3.1 benchmark, the static analysis tools Semgrep and SonarQube detected zero out of 232 broken-access-control vulnerabilities and zero out of 173 missing authentication and authorisation flaws. The author argues that vulnerability backlogs measure what a scanner can detect rather than actual exposure, making total open findings a poor indicator of security posture. To survive audits, teams should replace simple volume metrics with measures such as detection completeness by family, verified closure rates, and residual reachable critical outcomes. Open article →