That sort of division assumes you can be completely sure about how a system will be used in the future. I've definitely seen internal systems deployed in a publ

That sort of division assumes you can be completely sure about how a system will be used in the future. I've definitely seen internal systems deployed in a public-facing capacity because someone found a useful reason to do it. How are you going to do that, if the internal tool is written in something that is not supported by SAST tooling?