Quiz Entry - updated: 2026.10.13
What do SAST, DAST and SCA tools each check, and what are examples of each?
SAST reads the source code without running it, to check coding guidelines. DAST attacks the running system. SCA finds vulnerable third-party components.
* SAST reads your code, SCA checks the components you pulled in, DAST attacks the running system. *
| SAST (static) | DAST (dynamic) | SCA (software composition analysis) | |
|---|---|---|---|
| Looks at | Source code, not executed | The running system, from outside | The list of components and versions |
| Finds | Violations of secure coding guidelines, insecure patterns, committed secrets | Exploitable behaviour: injection, weak TLS, open services | Components with known CVEs (and licence issues) |
| Examples | Linters, SonarQube, Bandit, git-secrets | OpenVAS, OWASP ZAP, Burp, SSLScan | debsecan, OWASP Dependency-Check, Snyk, Black Duck |
They complement each other. SAST sees every code path but not the configuration. DAST sees the real deployment but only the paths it reaches. SCA covers the code you didn't write. That code usually makes up most of a product, which is why the system decomposition feeds it.
Go deeper:
OWASP — Source code analysis tools — a list of SAST tools by language- OWASP Dependency-Check — a free SCA tool to try on any project
Static application security testing (Wikipedia) — strengths and false-positive limits of SAST