These are three complementary application security testing approaches:
SAST (Static Application Security Testing):
- Analyzes source code without executing it
- Finds vulnerabilities in custom-written code
- Examples: SQL injection, XSS, hardcoded secrets
- Runs on source code, bytecode, or binaries
DAST (Dynamic Application Security Testing):
- Tests running applications from the outside
- Simulates attacks on deployed applications
- Examples: Authentication bypass, runtime vulnerabilities
- Requires a deployed, running application
Dependency Scanning:
- Analyzes third-party components and libraries
- Focuses on known vulnerabilities in dependencies
- Uses vulnerability databases (NVD, vendor advisories)
- Can run on manifest files or installed packages
Together, they provide comprehensive coverage: SAST for custom code vulnerabilities, DAST for runtime issues, and dependency scanning for third-party component risks.
Rewriting in plainer words…
This answer doesn't lend itself to a diagram - it reads best . No credits were charged.
Why there's no diagram: “”
The interactive diagram is below the answer - jump to diagram ↓ · Below it, the related concept . Jump to it ↓
The diagram below the answer is the concept . Jump to it ↓
Tailored explanation · switch back to · ·
What should the new diagram focus on?