Static application security testing (SAST) searches the source code, binary, or byte code to identify vulnerabilities, and DAST involves attacking code to see if it breaks. By using both, a security team is testing an application from both the inside (with SAST) and the outside (with DAST).