A method for finding security weaknesses in a software program, the method comprising: reading the software program into memory of a processing device; parsing software code of the software program to create parsed code, the parsed code including code information needed to perform a static analysis; determining a set of target common weakness enumerations, CWEs, to discover; identifying each CWE in the set of target CWEs to be either a code-only CWE, CO CWE, that can be detected directly by a static analysis of the parsed code, a root-cause CWE,, RC CWE, that cannot be found through a static analysis of the parsed code and that starts a chain of events in the software code, or a leads-to CWE, LT CWE, that cannot be found through a static analysis of the parsed code, wherein each LT CWE comprises a final CWE in a chain of events that also includes at least one CO CWE or RC CWE, wherein the set of target CWEs include at least a first RC CWE and a first LT CWE; identifying a first blocking set of CWEs for the first RC CWE, wherein the first blocking set of CWEs for the first RC CWE comprises at least one CO CWE; identifying a second blocking set of CWEs for the first LT CWE, wherein the second blocking set of CWEs for the first LT CWE comprises at least one CO CWE; performing a static analysis of the parsed code to find each CO CWE in the software code, thereby creating a list of CO CWEs in the software code; reporting the list of CO CWEs to a user on a user interface; determining whether at least one CO CWE in the list of CO CWEs is within the first blocking set of CWEs for the first RC CWE; determining whether at least one CO CWE in the list of CO CWEs is within the second blocking set of CWEs for the first LT CWE; reporting the first RC CWE or the first LT CWE as not present responsive to a determination that no CO CWE in the list of CO CWEs is within the first blocking set of CWEs or the second blocking set of CWEs; and reporting the first RC CWE or the first LT CWE as potentially present responsive to a determination that at least one CO CWE in the list of CO CWEs is within the first blocking set of CWEs or the second blocking set of CWEs. reading the software program into memory of a processing device; parsing software code of the software program to create parsed code, the parsed code including code information needed to perform a static analysis; determining a set of target common weakness enumerations, CWEs, to discover; identifying each CWE in the set of target CWEs to be either a code-only CWE, CO CWE, that can be detected directly by a static analysis of the parsed code, a root-cause CWE,, RC CWE, that cannot be found through a static analysis of the parsed code and that starts a chain of events in the software code, or a leads-to CWE, LT CWE, that cannot be found through a static analysis of the parsed code, wherein each LT CWE comprises a final CWE in a chain of events that also includes at least one CO CWE or RC CWE, wherein the set of target CWEs include at least a first RC CWE and a first LT CWE; identifying a first blocking set of CWEs for the first RC CWE, wherein the first blocking set of CWEs for the first RC CWE comprises at least one CO CWE; identifying a second blocking set of CWEs for the first LT CWE, wherein the second blocking set of CWEs for the first LT CWE comprises at least one CO CWE; performing a static analysis of the parsed code to find each CO CWE in the software code, thereby creating a list of CO CWEs in the software code; reporting the list of CO CWEs to a user on a user interface; determining whether at least one CO CWE in the list of CO CWEs is within the first blocking set of CWEs for the first RC CWE; determining whether at least one CO CWE in the list of CO CWEs is within the second blocking set of CWEs for the first LT CWE; reporting the first RC CWE or the first LT CWE as not present responsive to a determination that no CO CWE in the list of CO CWEs is within the first blocking set of CWEs or the second blocking set of CWEs; and reporting the first RC CWE or the first LT CWE as potentially present responsive to a determination that at least one CO CWE in the list of CO CWEs is within the first blocking set of CWEs or the second blocking set of CWEs.