Part 1 of 4 in the "Security Testing Landscape" series
If you've ever sat in a security review meeting and heard SAST, DAST, IAST, and SCA thrown around in the same sentence, you know the feeling: everyone nods, half the room is quietly Googling. This post fixes that permanently, using one analogy — your application is a car you're building and driving.
The Core Four
SAST — Static Application Security Testing
SAST is reading the car's blueprint before it's ever built. You spot that the brakes are drawn wrong without starting an engine.
In IT terms: SAST scans your source code for insecure patterns — SQL injection, hardcoded credentials, weak crypto — without running the application. It lives in your CI pipeline and fires on every commit or pull request.
Tools: SonarQube, Checkmarx, Fortify, Semgrep, GitHub CodeQL
Box: White box — it has full access to your code.
DAST — Dynamic Application Security Testing
DAST is test-driving the finished car and deliberately trying to crash it. It never looks at the blueprint.
In IT terms: DAST attacks your running, deployed application over HTTP exactly like an external hacker would — malicious payloads into URLs, forms, and headers. It has zero knowledge of your code.
Tools: OWASP ZAP, Burp Suite, Acunetix, Invicti
Box: Black box — it only sees what an attacker sees.
IAST — Interactive Application Security Testing
IAST is a sensor inside the car during the test drive. When the brakes get slammed, it feels exactly which part shook.
In IT terms: an agent sits inside the running app (in the JVM or .NET runtime) and watches code execute while your QA or DAST tests run. Result: it pinpoints the exact vulnerable line, combining the strengths of SAST and DAST.
Tools: Contrast Security, Synopsys Seeker, HCL AppScan
Box: Grey box — the app is running, but the agent sees internals.
SCA — Software Composition Analysis
Your build might be flawless, but the tires you bought from another shop have a recall notice. SCA checks the parts you didn't make.
In IT terms: SCA scans your dependency manifests — package.json, pom.xml, .csproj — against CVE databases for vulnerable open-source libraries (think Log4j) and license risks. Given that most modern codebases are 70–90% third-party code, this one is not optional.
Tools: Snyk, Mend, OWASP Dependency-Check, GitHub Dependabot
Box: White box.
The Supporting Cast
RASP (Runtime Application Self-Protection) is the odd one out — it's not a test at all. It's the airbag: an agent embedded in your production app that blocks real attacks as they happen, like killing a SQL injection mid-execution. Tools: Contrast Protect, Imperva RASP.
MAST (Mobile AST) is the same testing story for a motorbike — SAST and DAST applied to APK/IPA binaries, hunting mobile-specific issues like insecure local storage and reverse-engineering exposure. Tools: MobSF, NowSecure, Appknox.
API Security Testing ignores the car body and inspects the fuel pipe connections. Doors can be locked while a leaky pipe sinks you: it tests APIs directly for auth bypass, BOLA/IDOR, and mass assignment, usually driven by the OpenAPI spec. Tools: Postman, Burp Suite, 42Crunch, Salt Security. Typically grey box.
Fuzzing pours random junk into the fuel tank — sand, juice, bolts — until the engine chokes. Massive volumes of malformed input fired at an app or API until it crashes or misbehaves. Tools: AFL++, libFuzzer, Burp Intruder, RESTler. Typically black box.
Secret Scanning checks whether someone left the car keys taped to the windshield — leaked API keys, tokens, and connection strings in repos and git history. Tools: GitLeaks, TruffleHog, GitHub Secret Scanning. White box.
Container Scanning inspects the shipping crate the car arrives in — Docker images scanned layer by layer for OS-level CVEs before deployment. Tools: Trivy, Grype, Aqua. White box.
IaC Scanning audits the factory setup instructions. If the manual says "leave the door open," every car built there is unsafe: Terraform, Bicep, ARM, and Kubernetes YAML scanned for misconfigurations before anything is provisioned. Tools: Checkov, tfsec, Terrascan, KICS. White box.
The Timeline That Makes It Stick
- Before the app runs (paperwork and parts): SAST, SCA, Secret Scanning, Container Scanning, IaC Scanning
- While it runs in testing (test drives): DAST, IAST, Fuzzing, API Testing
- While it runs in production (the airbag): RASP
And the box rule: anything that reads your files is white box; anything that attacks the running app from outside is black box; the agent that does both is grey.
Next in the series: the offensive world — VA, PT, VAPT, red teams and bug bounties.
Top comments (0)