Beyond SAST: Overcoming the Gaps in Static Security Testing