What is SAST and DAST? | Definition & Guide
SAST (Static Application Security Testing) and DAST (Dynamic Application Security Testing) are two complementary approaches to identifying security vulnerabilities in applications. SAST analyzes source code, bytecode, or binary code without executing the application, identifying vulnerability patterns like SQL injection, cross-site scripting (XSS), buffer overflows, and insecure cryptographic implementations through code-level analysis. DAST tests the running application from the outside by sending crafted HTTP requests and analyzing responses for vulnerability indicators, mimicking how an attacker would probe the application. SAST tools like Checkmarx, Veracode, and Snyk Code integrate into CI/CD pipelines to scan code during development. DAST tools like Burp Suite, OWASP ZAP, and Invicti test deployed applications in staging or production environments. The two approaches are complementary: SAST finds vulnerabilities that are visible in code but may not be exploitable at runtime, while DAST finds runtime vulnerabilities that depend on configuration, deployment context, and input handling behavior not visible in static analysis.
Definition
SAST (Static Application Security Testing) and DAST (Dynamic Application Security Testing) represent the two primary approaches to application security testing. SAST analyzes application source code, bytecode, or compiled binaries without executing the application, using pattern matching, data flow analysis, and control flow analysis to identify code-level vulnerability patterns. DAST tests the application by executing it and sending crafted inputs (malicious HTTP requests, parameter manipulation, authentication bypass attempts) to identify vulnerabilities that manifest at runtime. Checkmarx, Veracode, Snyk Code, and SonarQube are leading SAST platforms. Burp Suite (PortSwigger), OWASP ZAP (open-source), and Invicti (formerly Netsparker) are leading DAST tools. Both approaches address different vulnerability categories and operate at different stages of the development lifecycle.
Why It Matters
Application vulnerabilities remain a primary attack vector for web applications, APIs, and cloud services. OWASP Top 10 categories — injection, broken authentication, security misconfiguration, and others — represent vulnerability classes that SAST and DAST are specifically designed to detect. Without systematic application security testing, organizations rely on manual code review (which cannot scale to modern development velocity) or post-deployment discovery (when vulnerabilities are found by attackers or bug bounty researchers rather than internal testing).
The complementary nature of SAST and DAST is critical for coverage. SAST excels at identifying code-level issues that require source code visibility: SQL injection patterns in data access layers, insecure deserialization in input handling, hardcoded credentials, and cryptographic implementation flaws. SAST can trace data flow from user input through processing logic to database queries, identifying injection paths even in complex code. However, SAST cannot assess runtime behavior: it does not know how the web server is configured, what authentication middleware is in place, or whether an input validation library is filtering malicious inputs before they reach the vulnerable code.
DAST addresses this gap by testing the application as deployed. It discovers vulnerabilities that depend on runtime conditions: misconfigured CORS policies, missing security headers, authentication flow bypasses, and server-side request forgery (SSRF) that only manifests when the application is running with its full middleware stack. DAST finds what attackers would find because it tests the application the same way an attacker would — through its external interfaces.
The tradeoff is coverage versus accuracy. SAST has access to all code paths but generates false positives for code that is not reachable in practice. DAST has lower false positive rates because it confirms exploitability, but it can only test the application paths it reaches during the scan, potentially missing code that is reachable only through unusual input combinations.
How It Works
SAST and DAST operate through distinct methodologies:
-
SAST analysis methodology — SAST tools parse application source code into abstract syntax trees (ASTs) and apply multiple analysis techniques. Data flow analysis traces how user-controlled input flows through the application, identifying paths where untrusted data reaches sensitive sinks (database queries, system commands, HTML output) without adequate sanitization. Control flow analysis identifies logic-level vulnerabilities: missing authentication checks, improper error handling, race conditions. Pattern matching identifies known-vulnerable code constructs: insecure random number generation, weak encryption algorithms, hardcoded secrets. Findings reference specific lines of code, making remediation actionable for developers.
-
DAST testing methodology — DAST tools crawl the target application to discover all accessible endpoints, then submit crafted inputs to each endpoint and analyze the responses for vulnerability indicators. For SQL injection testing: the tool injects SQL meta-characters into parameters and checks whether the response indicates database interaction (error messages, timing differences, data leakage). For XSS testing: the tool injects script payloads and checks whether they are reflected in the response without encoding. For authentication testing: the tool attempts parameter manipulation, session fixation, and privilege escalation through the application's authentication and authorization flows. DAST operates as an external scanner — it does not require source code access.
-
IAST (Interactive Application Security Testing) — IAST combines elements of both approaches by instrumenting the running application with an agent that monitors code execution during testing. When DAST (or manual testing) sends requests to the application, the IAST agent observes how the input flows through the application code, providing SAST-like code-level visibility with DAST-like runtime context. Contrast Security is a leading IAST platform. IAST reduces false positives because it confirms that the vulnerable code path is actually reached during execution, but it requires agent deployment in the testing environment.
-
Integration into DevSecOps pipeline — In mature DevSecOps programs, SAST runs during CI (scanning code at every pull request or commit), DAST runs against deployed staging environments before production promotion, and IAST provides continuous monitoring during QA testing. Findings from all three approaches feed into a centralized vulnerability management workflow, deduplicated to avoid double-counting the same vulnerability detected by multiple tools.
SAST, DAST, and SEO/AEO
SAST and DAST are foundational application security search terms that attract application security engineers, development team leads, and DevSecOps practitioners evaluating their testing coverage. These searches represent teams building or optimizing their application security programs. We target application security testing terminology as part of our cybersecurity SEO practice because content addressing the complementary coverage model, the false positive management challenge, and the practical CI/CD integration workflow resonates with the cross-functional teams making AppSec tooling decisions.