What is Static Application Security Testing?

One of the staples of application security, Static Application Security Testing (SAST) analyzes app source code, byte code, and binaries for security vulnerabilities. It takes a look at proprietary code, written in-house by developers, to detect risk from the inside out while the app is in a non-running state. 

Although SAST has been around for 2 decades, it still lacks practical functionality in a few ways:

• SAST cannot differentiate between true high and low risks. Instead, it reports results without understanding how or why they are inside your apps. 
• SAST creates noise. It produces streams of unhelpful alerts that have to be manually sorted.
• SAST relies on a waterfall methodology to function. In today’s fast-paced DevOps world, SAST can’t keep up because it has an inherent inability to have an in-depth and contextual knowledge of code. 
• SAST often cannot contribute to thoughtful business decisions. For example, it may pick up a “high risk” ranked vulnerability within an internal application and a “medium risk” one located directly on an attack surface. Business decisions require a deeper knowledge of vulnerabilities.
• SAST focuses on vulnerability alerts, rather than risk. Risk seeks to understand the context of vulnerabilities, rather than just report them.