A useful benchmark should expose misses. In an isolated ten-image ARM64 crAPI lab, the current QFinch comparison detected the selected SQL injection case but missed candidate unauthenticated order access and broken function-level authorization cases.
Next step: Use this gap to define the next authorization-specific benchmark and negative control.
Why the difference matters
Injection scanners can often identify payload-to-response behaviour within one session. Authorization weaknesses require identity and expectation: which user owns an object, which role may call a function, and how responses differ when identity changes.
Product implication
Improving this class of recall requires test identities, an authorization matrix, state setup and differential replay—not simply increasing crawler depth or active-scan strength. The scanner must also avoid destructive operations and protect session evidence.
Reporting implication
The two misses remain in the QA report. They are not removed from the candidate set or converted into unsupported exclusions. Formal recall remains unscored until independent truth review.
Transparent gaps provide a concrete engineering target and a more trustworthy customer boundary: automated DAST is valuable, but complex authorization remains an area where configuration and expert testing matter.