SAST (Static Application Security Testing) and DAST (Dynamic Application Security Testing) are the two main families of automated application security testing: the first analyzes code without running it, the second attacks the application while it runs.
SAST reads the source code to spot known flaws (SQL injection, XSS, hard-coded secrets, weak cryptography). It fits into CI and flags problems before release. Tools: Semgrep, SonarQube, GitHub CodeQL, Snyk Code, Checkmarx.
DAST tests the deployed application from the outside, like an attacker: it sends crafted requests and observes the responses. It finds problems invisible in the code (configuration, authentication). Tools: OWASP ZAP, Burp Suite, Acunetix.
The two complement each other, along with dependency analysis (SCA), container scanning and infrastructure as code scanning.
Why it matters when hiring
Installing a scanner is easy; making it useful is much harder. A good AppSec Engineer knows how to reduce false positives, prioritize alerts and get developers to fix flaws without blocking releases. Ask the candidate how they got teams to adopt these tools, and what false positive rate they considered acceptable.