I'm confused a bit between the terms. What I know is that there is SAST and DAST. SAST is scanning code statically for possible vulnerabilities, equivalent to static code analysis. This is usually done with automated tools. And there is DAST (dynamic application security testing). Mainly this is pen testing.

However the term "dynamic code analysis" is new to me, and I find it misleading. Is it the same as DAST? Can we consider pen testing as a "dynamic code analysis"? Also, there is a term "dynamic source code review", it is the same as "dynamic code analysis"?


2 Answers 2


SAST is more than just scanning code. I'd consider scanning dependency lists/files or inspecting containers and hosts to be a form of static analysis. Anything that doesn't require executing and interacting with the system would be a form of static analysis.

Similarly, I'd consider DAST to be more than just penetration testing. Web application vulnerability scanning using automated tools is also a form of DAST. Anything that requires the system to be deployed and running so it can be interacted with would be a form of DAST.

Penetration testing often utilizes both tools and human knowledge/experience to test a running application. Often, it's DAST, but depending on the terms of engagement, it may also include SAST.

"Dynamic source code review" doesn't make much sense to me. Reading and reviewing source code is inherently a static activity, since it doesn't involve running the system.

  • what about the term dynamic code analysis? and dynamic/static secure code review? May 10, 2022 at 15:10
  • @ethicalhacker What about them? Dynamic code analysis doesn't make sense to me, since analyzing code is a static activity while dynamic analysis involves applications or systems. Adding "secure" to a qualify code review is just something that is looked for - dynamic code reviews don't make sense and I don't see a need to call out "secure code review" since any code review could include security aspects. May 10, 2022 at 15:12
  • checkpoint.com/cyber-hub/cloud-security/… I found this article that defines dynamic code analysis as DAST May 10, 2022 at 15:26
  • @ethicalhacker Anyone can make up words. "Dynamic code analysis" makes no sense to me, since you're not explicitly looking at the code when you run an application. But if someone wants to use it, whatever. I wouldn't. May 10, 2022 at 15:27
  • and static code analysis is it the same as source code review ? May 10, 2022 at 16:28

Yes. Dynamic Code Analysis is same with DAST. Check the following checkpoint web page:

What is Dynamic Code Analysis?

Dynamic code analysis – also called Dynamic Application Security Testing (DAST) – is designed to test a running application for potentially exploitable vulnerabilities. DAST tools to identify both compile time and runtime vulnerabilities, such as configuration errors that only appear within a realistic execution environment.

Reference: https://www.checkpoint.com/cyber-hub/cloud-security/what-is-dynamic-code-analysis/#

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .