Flags every testSCORE 0
It catches every real flaw, but flags every safe test too.
Real flaws
Safe code
- Caught
- 100%
- Flagged
- 100%
- Score
- 0
Deep ScanJava Benchmark
See how Goosy holds up on the industry's standard test. We ran Deep Scan against OWASP Benchmark v1.2, measuring what it catches, what it misses, and what it flags by mistake.
- Test cases run
- 2,740
- Real flaws found (true positives)
- 1,412
- Safe code correctly passed (true negatives)
- 1,282
- Real flaws missed (false negatives)
- 3
- False alarms (false positives)
- 43
Overview
Leading the way in real world performance.
Built for accuracy. Goosy scored 97.95 out of 100 on OWASP Benchmark Java v1.2. 7 categories scored a perfect 100, 3 more scored above 98, and cross-site scripting is the one to improve.
- 100.0%LDAP Injection
- 100.0%Trust Boundary
- 100.0%Weak Encryption Algorithm
- 100.0%Weak Hashing Algorithm
- 100.0%Weak Randomness
- 100.0%XPath Injection
- 99.3%Path Traversal
- 98.7%SQL Injection
- 98.4%Command Injection
- 81.1% Priority area81.1%XSS (Cross-Site Scripting)
- 100.0%Insecure Cookie
Score card
Straight from the benchmark.
Every category, plotted by how many real flaws Goosy caught against how much safe code it flagged by mistake. The chart is generated by the OWASP Benchmark scorecard tooling and shown exactly as produced.
How to read it
- 01Top-left is best.A tool there catches every real flaw and raises no false alarms.
- 02The shaded triangle is guessing.On or below the red dashed line is no better than a coin flip.
- 03Each letter is a category.A to K are the categories. The magenta dot, L, is Goosy's average across all of them.
| A | Command Injection | 98.4% | (100-1.6) |
| B | Insecure Cookie | 100.0% | (100-0) |
| C | LDAP Injection | 100.0% | (100-0) |
| D | Path Traversal | 99.3% | (100-0.7) |
| E | SQL Injection | 98.7% | (100-1.3) |
| F | Trust Boundary | 100.0% | (100-0) |
| G | Weak Encryption Algorithm | 100.0% | (100-0) |
| H | Weak Hashing Algorithm | 100.0% | (100-0) |
| I | Weak Randomness | 100.0% | (100-0) |
| J | XPath Injection | 100.0% | (100-0) |
| K | XSS (Cross-Site Scripting) | 81.1% | (98.8-17.7) |
| L | Average score for this tool | 97.95% | (99.9-1.9) |
Category breakdown
Where the score actually comes from.
The official score is an average across vulnerability categories. Select one to see how Goosy performed and what that class of flaw is.
CWE-89
SQL Injection
Untrusted input is concatenated into a database query.
98.71Score
Real flaws272 of 272 caught
True positive rate 100.00%
Safe code229 of 232 left alone
False positive rate 1.29% · 3 flagged by mistake
- Caught
- 272
- Missed
- 0
- Left alone
- 229
- Flagged
- 3
owasp-benchmark / sql-injection3 false alarms
Real flaws caught272 / 272100.00%
Safe code flagged3 / 232− 1.29%
Score98.71
Methodology
OWASP Benchmark for Java:Scoring methodology
The OWASP Benchmark Accuracy Score measures how accurately an application security testing (AST) tool detects real vulnerabilities while avoiding false alarms.
The key idea
Detecting every vulnerability is not enough.
A tool that flags every test case might catch all the real vulnerabilities, but it would also generate many false positives. OWASP Benchmark therefore evaluates both detection capability and false-alarm rate.
Its scoring method is based on Youden's Index, a statistical measure used to evaluate diagnostic tests.
Flags nothingSCORE 0
It never raises a false alarm, but misses every real flaw.
Real flaws
Safe code
- Caught
- 0%
- Flagged
- 0%
- Score
- 0
An ideal toolSCORE 100
It catches every real flaw and stays quiet on safe code.
Real flaws
Safe code
- Caught
- 100%
- Flagged
- 0%
- Score
- 100
- Real flaw, caught
- Safe code, left alone
- Mistake
Illustrative: each card shows 20 example tests, 10 real flaws and 10 safe ones.
01 · Outcomes
The four outcomes measured.
Every test case in the benchmark has an expected result. The tool's output is compared against that expected result to classify its performance.
Tool reports a vulnerabilityTool reports nothingTest contains a real vulnerability
TPTrue Positive
1,412In this run
The test contains a real vulnerability, and the tool reports it.
Example
Detects a genuinely exploitable SQL injection.
FNFalse Negative
3In this run
The test contains a real vulnerability, but the tool misses it.
Example
Fails to report an exploitable SQL injection.
FPFalse Positive
43In this run
The test is not vulnerable, but the tool reports a vulnerability.
Example
Flags a safe input-handling pattern as exploitable.
TNTrue Negative
1,282In this run
The test is not vulnerable, and the tool correctly does not report a vulnerability.
Example
Correctly ignores a safe SQL query.
- Correct call
- Mistake
These outcomes form the confusion matrix used to calculate the Benchmark score.
02 · Formulas
The formulas used to calculate the score.
The scoring process first calculates two rates: the True Positive Rate and the False Positive Rate.
A
True Positive Rate (TPR)
Also known as recall or sensitivityTPR measures how many genuine vulnerabilities the tool successfully detects.
TPR = TPTP + FN
Example
Suppose a benchmark category contains 100 genuinely vulnerable test cases. The scanner detects 90 and misses 10.
TPR = 9090 + 10 = 0.90 = 90%
A higher TPR means fewer missed vulnerabilities.
B
False Positive Rate (FPR)
The false-alarm rateFPR measures the proportion of non-vulnerable test cases that the scanner incorrectly flags.
FPR = FPFP + TN
Example
Suppose there are 100 non-vulnerable test cases, of which the scanner incorrectly flags 15 and correctly ignores 85.
FPR = 1515 + 85 = 0.15 = 15%
A lower FPR means fewer false alarms.
Both formulas are explicitly specified in the OWASP Benchmark scoring documentation.OWASP Benchmark project ↗
C · Benchmark accuracy score
Score = 100 (TPR − FPR)
Using the two examples above: 100 × (0.90 − 0.15) = 75
Equivalently, the score in the range −100 to 100 is the normalized difference between the two rates, where 100 is ideal, 0 is equivalent to the random-guessing baseline, and a negative result indicates performance below that baseline. The OWASP documentation commonly describes the 0–100 range for scores at or above the baseline.
97.95Goosy
Below the baselineRandom guessingIdeal
- Suite
- OWASP Benchmark v1.2
- Language
- Java
- Tool
- Goosy Deep Scan · SAST
- Version
- v071dee30 · run 2
- Analysis time
- Not specified
Goosy 071dee30 (in the shipping product), scored with OWASP's own scorecard tool on 2026-09-21. This is run 2 of two identical runs (97.73 and 97.95; mean 97.84). Detector tuning was chosen by studying this benchmark's own false positives, so the score likely overstates performance on code Deep Scan has not seen.