What is SAST/DAST?

SAST (Static Application Security Testing) is a white-box testing methodology that analyzes source code, bytecode, or application binaries for potential security vulnerabilities. It's typically performed early in the software development lifecycle (SDLC) to identify flaws before the application is deployed. SAST tools analyze the code without executing it. DAST (Dynamic Application Security Testing) is a black-box testing methodology that analyzes an application in its running state to identify security vulnerabilities. DAST tools simulate real-world attacks against a deployed application to find vulnerabilities that might be exploitable.