What does SAST stand for?
SAST stands for Static Application Security Testing. Static application security testing: analysing source code or binaries without running them to find flaws such as injection or hard-coded secrets. It runs early in development.
SAST reads an application's source code, bytecode or binaries without running it and flags patterns that lead to vulnerabilities: unsanitised input reaching a database query, hard-coded credentials, unsafe functions. Because it needs no running system, it fits early in development, in the editor or as a stage of the build pipeline. Its known cost is false positives, and it cannot see problems that only exist at run time, such as a misconfigured server.
SAST in practice: an example
A developer opens a pull request. The pipeline's SAST stage reports that a new function builds an SQL statement by joining strings with a request parameter, and blocks the merge. The fix, a parameterised query, lands before the code has ever been deployed.
What SAST is confused with
SAST vs DAST: what is the difference?
SAST examines the code from the inside without running it. DAST attacks the running application from the outside without seeing the code. SAST points to the faulty line; DAST proves a flaw is reachable. What DAST stands for
SAST vs SCA: what is the difference?
SCA, software composition analysis, inventories third-party libraries and checks them against known vulnerabilities. SAST analyses the code your own team wrote.
Which exams cover SAST?
SAST is on the official CompTIA acronym list for one of the four exams covered here.
- CySA+ CS0-004: 2.4 (Vulnerability Management).
Each number is a CompTIA exam objective and the name in brackets is its domain. The exam puts the term in a scenario; it does not ask you to recite the expansion.
Check yourself: two practice questions
Written by CertSprint for this page. They are not taken from any exam.
1. A team wants to catch injection flaws while code is still in a pull request, before any test environment exists. Which technique fits?
- Dynamic application security testing
- Static application security testing
- A penetration test
- A web application firewall
Show the answer
B. Static application security testing. Static testing needs only the code, so it can run on every commit. Dynamic testing and penetration tests need a running application, and a WAF protects production instead of finding the flaw.
2. A SAST report lists 400 findings and the developers say most are not exploitable. What is the most useful next step?
- Disable the scanner
- Tune the rule set and triage findings by severity and reachability
- Release without reviewing any finding
- Replace the scan with a port scan
Show the answer
B. Tune the rule set and triage findings by severity and reachability. False positives are the known cost of static analysis. Tuning and triage keep the signal; switching the tool off removes the control, and a port scan tests something else.
Sources: NIST glossary: SAST; NIST SP 800-218, Secure Software Development Framework (SSDF); OWASP: Source Code Analysis Tools. The acronym and its expansion come from CompTIA's official acronym lists, linked from each exam glossary above. The explanation, example and questions are CertSprint's own, checked against these sources on 11 November 2026.