DAST attacks the running app like a real attacker would.

It doesn't care what language you wrote the app in, or whether you have the source at all — it only cares how the app behaves under attack.

owasp-zap

# passive, safe for CI
docker run -t zaproxy/zap-stable zap-baseline.py \
  -t https://staging.example.com -r zap-report.html

# active — actually attacks the target
docker run -t zaproxy/zap-stable zap-full-scan.py \
  -t https://staging.example.com

Active scans genuinely attack the target — submitting forms, injecting payloads. Staging only, never production.

Looks atSource codeRunning app

Runs how earlyEvery commitNeeds staging

False positivesCan be highGenerally lower

MissesRuntime/config issuesUncrawled paths

SAST and DAST are complementary, not competing — SAST is early and cheap but blind to runtime behavior; DAST is late but catches what SAST structurally can't.