SAST should be deployed early in the implementation phase of the SDLC. because they don’t need a running application to perform an analysis. Security teams therefore use SAST tools to scan applications during the coding process and before production.