If it could have, why didn't it?

This article examines the common internet comment that static analysis could have found a vulnerability discovered by a new research technique. It breaks down the varying strengths of this claim, from off-the-shelf tools to theoretical possibilities, and argues that such claims often ignore practical issues like false positives and sensitivity. The author contends that new vulnerability research techniques and memory-safe languages remain necessary despite static analysis's potential, as real-world constraints (e.g., alert fatigue) limit effectiveness. The piece is a technical discussion on software security, static analysis, and vulnerability research methodologies, directly relevant to IT/technology topics like programming, cybersecurity, and best practices.