Application security testing splits into three categories based on when and how tests execute. Choosing the right combination depends on your pipeline, threat model, and engineering capacity.
SAST (Static Application Security Testing) analyzes source code without executing it. Semgrep is the current leader for developer-friendly SAST — it uses a pattern-matching syntax that lets teams write custom rules, runs in milliseconds per file, and integrates natively with GitHub Actions, GitLab CI, and pre-commit hooks. SonarQube covers a broader quality and security surface and is common in enterprise environments. Snyk Code uses ML-based analysis that catches vulnerability patterns Semgrep rules might miss. SAST runs fast, catches known patterns early, and integrates into the IDE. The gap: it can't see runtime behavior, third-party library interactions at runtime, or logic-level authorization bugs.
DAST (Dynamic Application Security Testing) attacks a running application. OWASP ZAP is the open-source standard — it proxies HTTP traffic, crawls the app, and fires payloads for SQLi, XSS, path traversal, and other injection classes. Burp Suite Professional is the commercial leader, with a richer scanner and manual testing tools that security engineers use for penetration testing. DAST finds what SAST misses (runtime configuration issues, framework-level vulnerabilities, actual exploitability) but requires a deployed environment and can generate false positives in dynamic UIs. A DAST scan against a staging environment as part of the deploy pipeline is the standard practice.
IAST (Interactive Application Security Testing) instruments the application itself — an agent runs inside the JVM, CLR, or Node.js process and monitors actual execution. Contrast Security is the dominant IAST vendor. Because it sees actual code paths executed during real test traffic (including automated test suite runs), IAST has very low false positive rates compared to SAST and DAST. The tradeoff: language support is narrower (Java, .NET, Node.js, Python, Go), and the agent adds 5-15% runtime overhead.
The practical DevSecOps pipeline: SAST in pre-commit and CI (fast, cheap, developer feedback loop), dependency scanning (Snyk OSS, Dependabot) in CI, DAST against staging on every deploy, IAST in the QA environment if your stack supports it.