Static and Dynamic Analysis

Security testing tools automate the detection of vulnerabilities in your code and running applications.

Static Application Security Testing (SAST)

Analyzes source code without executing it. Catches issues early in development.

• SonarQube, Semgrep, Checkmarx, CodeQL

Dynamic Application Security Testing (DAST)

Tests running applications by sending crafted inputs and observing responses.

• OWASP ZAP, Burp Suite, Nuclei

Interactive Application Security Testing (IAST)

Combines elements of SAST and DAST by instrumenting the application from within.

Software Composition Analysis (SCA)

Identifies known vulnerabilities in third-party libraries and dependencies.