thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Commonly confused · Application & OT Security

SAST vs DAST vs IAST: Application Security Testing Compared

SAST analyzes source code or binaries without running the application (white box), DAST attacks the running application from the outside (black box), and IAST uses agents inside the running application to observe code behavior during testing.

SASTDASTIAST
Testing approachStatic, code not runningDynamic, external attacksDynamic, instrumented from inside
VisibilityWhite boxBlack boxGray box
SDLC stageEarly, during development and CILater, staging or productionQA/testing with functional tests
StrengthsPinpoints exact line of code, early fixesFinds runtime and configuration issues, language agnosticLow false positives, code-level context
WeaknessesFalse positives, misses runtime issuesNo code location, needs running appLanguage/agent support, performance overhead
ExamplesSonarQube, Checkmarx, SemgrepOWASP ZAP, Burp Suite scannerContrast Assess
Remember it

SAST reads the code, DAST attacks the app, IAST watches from inside.

Exam tip

Shift-left scenarios favor SAST. Questions about testing a running app without source code access point to DAST. Fuzzing is a form of dynamic testing.

Tested on

More Application & OT Security look-alikes