How to select between SAST, DAST, IAST, RASP, and AST
summary
Static analysis scans all reachable code paths but produces high false positives and needs rules for niche frameworks; binary SAST finds third‑party binaries but may not map results back to source. DAST exercises the server pipeline and needs good crawling; IAST/RASP requires an agent and gives higher‑fidelity findings, with RASP able to block attacks at runtime. Software composition analysis flags vulnerable dependencies but reports irrelevant hits unless it verifies API usage. Choose by language/framework support, mobile needs, and whether runtime blocking is required.
AI-written summary · about
chapters (6)
- 0:00Start
- 3:06Learning about the strengths and weaknesses of each of the tools
- 6:58SAST - Static Application Security Testing
- 9:43BSAST - Binary Static Application Security Testing
- 19:02SCA-Software Composition Analysis
- 20:41Decision Process For Selecting Between Options
related talks
22mSecurity for Developers
21mAdding DAST to CI/CD, Without Any Losing Friends
50mSAST'madness and Courage
43mJumpstarting Your DevSecOps Pipeline with IAST and RASP
51mThe great SAST dissonance: how to please every... (Claudio Merloni, Romain Gaucher)
39mPractical Static Analysis for Continuous Application Security
33mUsing IAST to Unlock the Benefits of DevSecOps
43mDevSecOps on steroids - Powered by your Selenium tests