Dynamic Application Security Testing (DAST)

Dynamic Application Security Testing (DAST) means testing an app while it runs. Instead of reading the code, it watches what the app actually does: the network traffic it opens, the data it writes to storage and the defences it enforces at runtime.

For mobile, DAST runs the build on a real or instrumented device. It catches problems that only appear in motion, such as cleartext traffic, broken certificate checks and sensitive data written to the phone in clear.

Static analysis shows what an app can do; dynamic analysis shows what it does. A complete review uses both.