What are SAST and DAST?

SAST (Static Application Security Testing) analyses code without running it to find defects during the development phase. DAST (Dynamic Application Security Testing) tests the running application to detect flaws that only appear at runtime. They are complementary techniques.

How are SAST and DAST applied in practice?

They are integrated as automated stages in the CI/CD pipeline: SAST runs on every code change before the build, and DAST on the application deployed in a test environment. Their findings feed into the review flow like any other quality control.

What does DORA require here?

DORA requires financial institutions to test the resilience and security of their ICT systems periodically and throughout the software lifecycle. SAST and DAST are common means of documenting that application security testing in a systematic and traceable way.

Glossary · Cybersecurity · Secure development

SAST and DAST: static and dynamic security testing

SAST (static analysis) inspects source code or the binary without executing it, while DAST (dynamic analysis) tests the application once deployed and running. They do not compete: they cover different phases and types of defect, and their value emerges when both are integrated into the CI/CD pipeline.

Differences and complementarity

SAST — examines code without execution. It detects injection patterns, insecure credential handling or vulnerable dependencies early, with access to the exact line of the defect.
DAST — tests the running application without access to the code. It finds configuration flaws, header exposure or authentication errors that only surface at runtime.
Combined coverage — SAST provides internal visibility and DAST external validation; together they reduce false negatives compared with using a single technique.
CI/CD integration — running both analyses automatically on every change prevents security testing from being pushed to the end of the cycle.

Why it matters in regulated banking

DORA requires EU financial institutions to manage ICT risk across the entire software lifecycle, including security testing. Embedding SAST and DAST in the delivery pipeline provides traceable evidence that code is verified systematically before reaching production, a control that both DORA and NIS2 expect in critical sectors. Automation turns that verification into an auditable record rather than a one-off review.

How Vermont Solutions helps

Verifiable secure development

We integrate static and dynamic security testing into the delivery pipeline so that compliance under DORA is backed by automated evidence.

See governance and compliance →

Fuentes

OWASP — application security testing

Last updated: 2026-06-21. Editorial content by Vermont Solutions, citable with attribution.