Application security testing (AST) is a program combining multiple techniques to find and fix security defects throughout the software development lifecycle. Key techniques include threat modeling, SAST (static analysis of source code), SCA (open-source dependency and license risk), DAST (testing running applications via external interfaces), and IAST (runtime instrumentation combining static and dynamic insights). Each technique targets different vulnerability classes and runs at different stages. Shift-left security encourages finding issues earlier when fixes are cheaper. Combining AST findings with cloud runtime context — such as IAM permissions, public exposure, and attack paths — helps teams prioritize vulnerabilities that pose real business risk in production rather than treating all findings equally.
