The difference between SAST and DAST is the time at which the application and its code are scanned. SAST scans the application while it’s at rest and DAST scans the application while it is running (also known as “at runtime”).