97% on the OWASP Benchmark, and seven languages above 80%

Every security team knows the standard test apps: the OWASP Benchmark, OWASP Juice Shop, PyGoat, RailsGoat, WebGoat.NET, DVWA and TerraGoat. Each one ships with a known list of vulnerabilities. We ran Vybscan on all of them and scored it against each project's own answer key.

The OWASP Benchmark: 97.1%

The OWASP Benchmark is the industry's yardstick for code scanners. Version 1.2 for Java has 2,740 small test programs: half contain a real vulnerability, half look the same but are safe. A scanner scores well only if it finds the first kind and leaves the second alone.

• Vybscan finds 97.2% of the vulnerable programs.
• It flags one of the 1,325 safe programs. 99.9% of what it reports is a real vulnerability.
• Nine of the eleven categories score a perfect 100%: SQL injection, command injection, path traversal, LDAP and XPath injection, weak cryptography, weak randomness, insecure cookies and trust-boundary violations. Cross-site scripting misses nothing, with the single false positive.
• OWASP's own score, true-positive rate minus false-positive rate, is 97.1%.

This result comes from Vybscan's rule engine alone, with no AI involved, so it is the same on every run.

Seven languages, seven test apps

Each app below was built to teach security and documents its own vulnerabilities. Recall is the share of those vulnerabilities Vybscan finds. Precision is the share of Vybscan's confirmed findings that are real.

For the six apps after the OWASP Benchmark, we count only what the Vybscan dashboard shows as confirmed, after Vybscan's own AI review. Raw scanner noise is never counted as a find.

Dependencies: 96–100%

Vybscan also checks every open-source package a project depends on. We took seven real projects, looked up every exact package version in their lockfiles directly in the OSV vulnerability database, and compared that list with what Vybscan reports.

How we scored it

• Answer keys from the projects. OWASP's expected results for the OWASP Benchmark. Checkov's failed checks for TerraGoat, in the classes Vybscan covers. OWASP's challenge list for Juice Shop, plus scan findings we confirmed in the code. Each app's own documentation of its vulnerabilities for PyGoat, RailsGoat, WebGoat.NET and DVWA. OSV for dependencies.
• Dashboard view. A vulnerability counts as found only if the Vybscan dashboard shows it as confirmed. The OWASP Benchmark is scored on Vybscan's rule engine.
• One run each, on 22 October 2026. The AI-reviewed scores can move a few points from run to run.

Frequently asked questions

What is the OWASP Benchmark score?

OWASP scores a tool by its true-positive rate minus its false-positive rate. A tool that flags everything scores zero, and so does one that flags nothing. Vybscan scores 97.1%.

Why does precision matter as much as recall?

Because developers stop reading a tool that cries wolf. A finding that is not real costs an engineer time and trust. Vybscan's AI review reads each candidate against the code before it is shown as confirmed.

Does Vybscan do more than code scanning?

Yes. It scans code, dependencies, secrets and infrastructure settings on every pull request, for GitHub and GitLab.

We continue to test Vybscan on many repositories with different characteristics, to hone it for real-life code. Our goal is to reach 100% soon.

Sources: OWASP Benchmark for Java, OWASP Juice Shop, OWASP PyGoat, OWASP RailsGoat, WebGoat.NET, DVWA, TerraGoat, OSV.