DAST
Also known as: Dynamic Application Security Testing
DAST (Dynamic Application Security Testing) finds vulnerabilities by attacking a running application from the outside — sending malicious requests and observing the responses — the same way a real attacker would, without any access to or knowledge of the underlying source code.
Because DAST tests the running application black-box style, it catches issues that only exist at runtime — misconfigurations, authentication flaws, issues in how the deployed environment is actually set up — that static code analysis alone can't see, since those problems don't necessarily exist as a flaw in the source code itself.
It's typically run later in the pipeline than SAST, against a deployed staging or test environment rather than the raw codebase, which makes it slower to run and to get feedback from — but also means its findings are closer to what a real external attacker would actually be able to exploit.
