Why developers avoid SAST security tools—and what needs to change

Software vulnerabilities remain a critical business risk, yet many development teams are reluctant to adopt Static Application Security Testing (SAST) tools despite their potential to identify and remediate security flaws. A new literature review from arXiv examines why adoption lags and what practical obstacles developers face when attempting to integrate these security solutions into their workflows.

The adoption gap#

Code vulnerabilities drive many high-profile breaches that damage both organizations and users. SAST tools promise to strengthen applications by catching security issues early in the development process. Yet widespread integration remains elusive—many teams continue to skip these tools even as the business case for their use grows stronger.

Barriers identified#

Researchers catalogued a range of usability challenges that developers encounter with SAST tools:

• Tool-inherent limitations that require developers to invest time and effort to work around or accommodate
• Tool shortcomings that represent genuine gaps in functionality or design—problems that SAST vendors themselves must solve
• Integration friction that makes it harder to embed these tools into everyday development routines

What it takes to drive adoption#

The review draws two key conclusions. First, developers must accept that using SAST effectively requires some degree of investment and learning curve—there is no zero-friction path to mature security practices. Second, tool vendors have a responsibility to reduce unnecessary friction by simplifying setup, configuration, and interpretation of results.

Real progress on adoption hinges on addressing both dimensions: human factors and technical design. Neither side alone will suffice.