What is the difference between SAST and DAST?

Answer

SAST (Static Application Security Testing) analyzes source code, bytecode, or binaries without running the application, finding flaws like injection or hardcoded secrets early in development. DAST (Dynamic Application Security Testing) tests a running application from the outside, simulating attacks against the live endpoints to find runtime issues such as authentication or configuration weaknesses. They are complementary: SAST has broad code coverage but more false positives, while DAST finds real exploitable behavior but only on code paths it actually exercises.