Cognium Labs
Home/Research/OWASP Java results
Reproducible benchmark

OWASP Benchmark Java SAST results, reproduced.

A full-suite test of cognium-dev on 2,740 Java cases, with one open scoring rule, public raw output, and the misses included.

By Cognium LabsPublished September 13, 20268 min read

Result: cognium-dev 4.9.13 reached 91.0% true-positive rate and 17.4% false-positive rate on the full OWASP Benchmark Java v1.2 suite. Its Youden score was 73.5%. This is a dated, reproducible result—not a claim about every future build.

The OWASP Benchmark for Java contains 2,740 test cases: 1,415 are intentionally vulnerable and 1,325 are safe. A useful SAST evaluation must measure both groups. Finding vulnerable cases shows recall; leaving safe cases alone shows selectivity.

2,740Total Java cases
1,415Vulnerable cases
1,325Safe cases
11OWASP categories

Overall cognium-dev result

The September 11, 2026 run used cognium-dev 4.9.13, BenchmarkJava commit 20cbf3d, default scanner configuration, and no LLM. A finding received credit only when it landed in the expected file with the expected CWE after documented normalization.

ToolTPFPFNTNTPRFPRPrecisionYouden
cognium-dev 4.9.131,2872311281,09491.0%17.4%84.8%73.5%

That means 1,287 vulnerable cases were detected and 1,094 safe cases were left unflagged. The scanner missed 128 vulnerable cases and flagged 231 safe cases. Publishing all four counts matters because a headline score alone cannot show where a tool succeeds or fails.

How the test was scored

  1. The complete OWASP Benchmark Java v1.2 suite was scanned—no category or case subset.
  2. The scan used the engine only. No LLM detection or verification layer was involved.
  3. Every result was evaluated by the same public scorer and expected-CWE rule.
  4. Raw scans, normalized findings, scorecards, configurations, and false-positive and false-negative case lists were retained.
Inspect the evidence: Open the dated result directory and the shared scoring script. Exact versions belong in this evidence record so another team can reproduce the same run.
Scan command recorded by the benchmark
cognium-dev scan <testcode> -l java -f json

Where the result is strong

Nine of the eleven OWASP categories produced zero false positives in this run. SQL injection reached 93.8% TPR with 0% FPR, while LDAP injection reached 88.9% TPR with 0% FPR. Weak randomness and weak cryptography each reached 100% TPR with 0% FPR.

Where it needs work

XSS is the main weakness in this snapshot. The scanner flagged 192 of 209 safe XSS cases, producing a 91.9% XSS false-positive rate. Those 192 cases account for most of the run's 231 false positives. Command injection also recorded a 31.2% false-positive rate.

Important limitation: This benchmark measures a controlled suite, not production defect-removal performance. It also represents one dated engine build and configuration. Use it to inspect behavior and methodology—not as a universal ranking of SAST products.

Why these numbers differ from the older scorecard

An April snapshot on the main benchmark page contains a historical 1,415-case row. Its case selection and original harness cannot be reconstructed, so it is not used for comparison. The September full-suite result covers all 2,740 cases with a public scorer and is the figure to use when discussing OWASP Benchmark performance.

What to check before trusting any SAST benchmark

Inspect the full benchmark.

See the tool comparison, category breakdown, other languages, and links to every public artifact.

Open benchmark tables Run your first scan

Source note: Results were copied from the public September 11, 2026 full-suite evidence currently linked by cognium.dev. If that evidence is superseded, update the article's modified date and results together.