--- title: "SAST and DAST, Definition | MedTech Terms" description: "Automated security testing - SAST analyzes source code at rest, DAST exercises a running application. Plain-English Cybersecurity definition for MedTech teams," lang: en json-ld: | { "@context": "https://schema.org", "@graph": [ { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/sast-dast#term", "name": "SAST and DAST", "alternateName": "Static and Dynamic Application Security Testing", "description": "Static Application Security Testing (SAST) analyzes source code, bytecode, or binaries without executing them, looking for known vulnerable patterns (SQL injection, buffer overflows, hardcoded secrets, insecure crypto). Dynamic Application Security Testing (DAST) probes a running application from the outside, exercising authenticated and unauthenticated paths to find runtime issues (auth bypass, injection, misconfiguration). Together they cover complementary parts of the OWASP testing surface and are baseline tooling for any modern CI/CD pipeline.", "url": "https://medtechterms.com/terms/sast-dast", "termCode": "sast-dast", "inDefinedTermSet": { "@type": "DefinedTermSet", "name": "MedTech Terms", "url": "https://medtechterms.com/terms" } }, { "@type": "Article", "@id": "https://medtechterms.com/terms/sast-dast#article", "headline": "SAST and DAST", "description": "Automated security testing - SAST analyzes source code at rest, DAST exercises a running application.", "url": "https://medtechterms.com/terms/sast-dast", "mainEntityOfPage": { "@type": "WebPage", "@id": "https://medtechterms.com/terms/sast-dast" }, "about": { "@id": "https://medtechterms.com/terms/sast-dast#term" }, "articleSection": "Cybersecurity", "inLanguage": "en", "keywords": "SAST and DAST, Static and Dynamic Application Security Testing, Cybersecurity, medical device, MedTech", "author": { "@type": "Person", "name": "Christian Espinosa", "jobTitle": "Founder, Blue Goat Cyber", "url": "https://bluegoatcyber.com" }, "publisher": { "@type": "Organization", "name": "MedTech Terms", "url": "https://medtechterms.com" }, "isPartOf": { "@type": "WebSite", "name": "MedTech Terms", "url": "https://medtechterms.com" }, "datePublished": "2026-05-05", "dateModified": "2026-05-05", "citation": [ { "@type": "CreativeWork", "name": "FDA Cybersecurity Guidance (Sept 2023)", "url": "https://www.fda.gov/regulatory-information/search-fda-guidance-documents/cybersecurity-medical-devices-quality-system-considerations-and-content-premarket-submissions", "publisher": { "@type": "Organization", "name": "FDA" } }, { "@type": "CreativeWork", "name": "NIST SP 800-218 (SSDF)", "url": "https://csrc.nist.gov/publications/detail/sp/800-218/final", "publisher": { "@type": "Organization", "name": "NIST" } }, { "@type": "CreativeWork", "name": "OWASP ASVS", "url": "https://owasp.org/www-project-application-security-verification-standard/", "publisher": { "@type": "Organization", "name": "OWASP" } } ], "mentions": [ { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/pen-test#term", "name": "Penetration Testing", "url": "https://medtechterms.com/terms/pen-test" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/premarket-cybersecurity#term", "name": "Premarket Cybersecurity Submission", "url": "https://medtechterms.com/terms/premarket-cybersecurity" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/spdf#term", "name": "Secure Product Development Framework", "alternateName": "SPDF", "url": "https://medtechterms.com/terms/spdf" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/section-524b#term", "name": "Section 524B of the FD&C Act", "alternateName": "524B", "url": "https://medtechterms.com/terms/section-524b" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/iec-81001-5-1#term", "name": "IEC 81001-5-1", "url": "https://medtechterms.com/terms/iec-81001-5-1" } ] }, { "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://medtechterms.com/" }, { "@type": "ListItem", "position": 2, "name": "Terms", "item": "https://medtechterms.com/terms" }, { "@type": "ListItem", "position": 3, "name": "Cybersecurity", "item": "https://medtechterms.com/terms?cat=Cybersecurity" }, { "@type": "ListItem", "position": 4, "name": "SAST and DAST", "item": "https://medtechterms.com/terms/sast-dast" } ] }, { "@type": "FAQPage", "@id": "https://medtechterms.com/terms/sast-dast#faq", "mainEntity": [ { "@type": "Question", "name": "Do we need both SAST and DAST?", "acceptedAnswer": { "@type": "Answer", "text": "Yes - they find different classes of issues. SAST sees the whole codebase including unreachable paths; DAST sees what an attacker actually sees but only on exercised paths." } }, { "@type": "Question", "name": "What about IAST and SCA?", "acceptedAnswer": { "@type": "Answer", "text": "IAST (Interactive AST) instruments the running app for deeper insight than DAST. SCA (Software Composition Analysis) checks dependencies against vulnerability databases - essential for SBOM-driven vulnerability management." } }, { "@type": "Question", "name": "Is fuzz testing the same as DAST?", "acceptedAnswer": { "@type": "Answer", "text": "Related but distinct. Fuzzing throws malformed inputs at parsers and protocol handlers; DAST exercises business logic with realistic-but-malicious requests. FDA's 2023 guidance recommends both for high-risk interfaces." } } ] } ] } --- [ MedTech Terms The authoritative reference ](/) Browse Learn [Latest](/latest) About 1. [Home](/) 2. / 3. [Terms](/terms) 4. / 5. [Cybersecurity](/terms?cat=Cybersecurity) 6. / 7. SAST and DAST [All terms](/terms) Cybersecurity [Connected & Cyber-Physical Devices](/ecosystems/connected-devices) # SAST and DAST Automated security testing - SAST analyzes source code at rest, DAST exercises a running application. Reviewed by [Christian Espinosa, Founder, Blue Goat Cyber](/authors/christian-espinosa) Last reviewed May 5, 2026 ## Definition Static Application Security Testing (SAST) analyzes source code, bytecode, or binaries without executing them, looking for known vulnerable patterns (SQL injection, buffer overflows, hardcoded secrets, insecure crypto). Dynamic Application Security Testing (DAST) probes a running application from the outside, exercising authenticated and unauthenticated paths to find runtime issues (auth bypass, injection, misconfiguration). Together they cover complementary parts of the OWASP testing surface and are baseline tooling for any modern CI/CD pipeline. What the regulation says FDA's 2023 guidance expects security testing throughout development, with both static and dynamic analysis as standard components. [NIST SP 800-218](/terms/ssdf) (SSDF) and [IEC 81001-5-1](/terms/iec-81001-5-1) both include SAST/DAST in their lifecycle activity sets. The submission should describe which tools were used, what they covered, and how findings were dispositioned. ## What this means in practice SAST belongs in the developer's PR check (Semgrep, CodeQL, SonarQube, Checkmarx). DAST belongs in nightly or release-gate CI (OWASP ZAP, Burp Suite, Invicti). Both produce noise; mature teams tune rule sets, baseline known issues, and route real findings into the [CAPA](/terms/capa) and security-fix workflow rather than dumping the raw tool output into the submission. Common pitfalls - • Submitting raw tool output without triage - reviewers cannot tell signal from noise. - • Running SAST/DAST only at submission rather than continuously through the build pipeline. - • Skipping SCA (Software Composition Analysis) - SAST finds your code's bugs, SCA finds your dependencies' bugs. ## Frequently asked questions Do we need both SAST and DAST? Yes - they find different classes of issues. SAST sees the whole codebase including unreachable paths; DAST sees what an attacker actually sees but only on exercised paths. What about IAST and SCA? Is fuzz testing the same as DAST? ## Related terms Grouped by theme ### Editor's picks · Hand-selected related concepts [ Cybersecurity IEC 81001-5-1 International standard defining secure-product-lifecycle activities for health software, including medical devices. ](/terms/iec-81001-5-1)[ Cybersecurity Penetration Testing Hands-on adversarial testing in which qualified independent testers attempt to exploit a device's security controls. ](/terms/pen-test)[ Cybersecurity Premarket Cybersecurity Submission The bundle of cybersecurity artifacts a sponsor includes in a 510(k), De Novo, PMA, or HDE submission for a cyber device. ](/terms/premarket-cybersecurity)[ Cybersecurity Section 524B of the FD&C Act(524B) The federal statute that gives FDA explicit premarket authority over cybersecurity for cyber devices. ](/terms/section-524b) ### More in Cybersecurity · Same category [ Cybersecurity Secure Product Development Framework(SPDF) A documented, risk-based set of processes that build cybersecurity into a medical device across its full lifecycle. ](/terms/spdf)[ Cybersecurity AAMI SW96 AAMI/ANSI standard establishing requirements for medical-device cybersecurity activities throughout the lifecycle. ](/terms/aami-sw96)[ Cybersecurity AAMI TIR57 AAMI Technical Information Report providing MedTech-specific guidance on cybersecurity risk management. ](/terms/aami-tir57)[ Cybersecurity AAMI TIR97(TIR97) AAMI Technical Information Report on post-market security risk management for medical device manufacturers, the operational companion to TIR57. ](/terms/aami-tir97) Cited by Where this term appears across MedTech Terms. Ecosystems (1) - [Connected & Cyber-Physical Devices](/ecosystems/connected-devices) ## Primary references 3 sources Link health: 3 verified · last checked 2026-06-20 FDA· 1 NIST· 1 OWASP· 1 1. [1 FDA Cybersecurity Guidance (Sept 2023) Verified FDA · fda.gov ](https://www.fda.gov/regulatory-information/search-fda-guidance-documents/cybersecurity-medical-devices-quality-system-considerations-and-content-premarket-submissions) 2. [2 NIST SP 800-218 (SSDF) Verified NIST · csrc.nist.gov ](https://csrc.nist.gov/publications/detail/sp/800-218/final) 3. [3 OWASP ASVS Verified OWASP · owasp.org ](https://owasp.org/www-project-application-security-verification-standard/) Inline markers like \[1\] jump to the matching reference above. Sponsor note ### Working on medical device cybersecurity? Blue Goat Cyber specializes in MedTech cybersecurity - threat modeling, SBOMs, penetration testing, and FDA premarket submissions. [Book a 30-minute discovery session](https://go.bluegoatcyber.com/meetings/blue-goat-cyber/discovery-session) - No obligation - Expert-led from minute one - NDA available on request MedTech Terms is a community resource sponsored by [Blue Goat Cyber](https://bluegoatcyber.com). Definitions are independent of any vendor. On this term Category Cybersecurity Sources 3 Updated 5/5/2026 [Compare with another term](/compare?a=sast-dast) Learn in 60 seconds Card Lesson Quiz Automated security testing - SAST analyzes source code at rest, DAST exercises a running application. - · SAST belongs in the developer's PR check (Semgrep, CodeQL, SonarQube, Checkmarx). - · DAST belongs in nightly or release-gate CI (OWASP ZAP, Burp Suite, Invicti). - · Both produce noise; mature teams tune rule sets, baseline known issues, and route real findings into the CAPA and security-fix workflow rather than dumping the raw tool output into the submission. Remember this Watch out: Submitting raw tool output without triage - reviewers cannot tell signal from noise. Related terms - [Penetration Testing ](/terms/pen-test) - [Premarket Cybersecurity Submission ](/terms/premarket-cybersecurity) - [Secure Product Development Framework(SPDF) ](/terms/spdf) - [Section 524B of the FD&C Act(524B) ](/terms/section-524b) - [IEC 81001-5-1 ](/terms/iec-81001-5-1) You may also need Auto-suggested from Cybersecurity and shared keywords. - [Hardcoded Credentials ](/terms/hardcoded-credentials) - [OWASP IoT and Embedded Application Security ](/terms/owasp-iot) - [Hardware Root of Trust(HRoT) ](/terms/hardware-root-of-trust) - [Secure Boot ](/terms/secure-boot) - [Brainjacking ](/terms/brainjacking) - [CISA Known Exploited Vulnerabilities Catalog(KEV) ](/terms/kev) [All Cybersecurity terms](/terms?cat=Cybersecurity) From the Blue Goat network Related resources and services on this topic. - [ MedTech Cybersecurity Standards Authoritative reference for the standards and guidances behind medical device cybersecurity. ](https://medtechcyberstandards.com) - [ MedTech Cyber Tips Practical, organized tips for medical device cybersecurity teams. ](https://medtechcybertips.com) - [ MedTech Cybersecurity Crosswalk International crosswalk of medical device cybersecurity requirements across regulators. ](https://mdccrosswalk.com) - [ Code Blue Real medical device cybersecurity incidents and their lessons. ](https://codebluechart.com) MedTech Terms An authoritative, plain-language reference for the regulatory, quality, cybersecurity, and software terms that shape modern medical devices. Browse - [All terms](/terms) - [A–Z index](/a-z) - [Categories](/categories) - [Ecosystems](/ecosystems) - [Learning paths](/paths) - [Compare terms](/compare) - [Quiz](/quiz) Resources - [FDA Medical Devices](https://www.fda.gov/medical-devices) - [EU MDR](https://eur-lex.europa.eu/eli/reg/2017/745/oj) - [IMDRF](https://www.imdrf.org/) - [Methodology](/methodology) - [Changelog](/changelog) - [Editor: Christian Espinosa](/authors/christian-espinosa) - [About this site](/about) © 2026 MedTech Terms. Reference content for educational purposes - not regulatory advice. A community resource sponsored by [Blue Goat Cyber](https://bluegoatcyber.com)