Testing and defence led by a published security researcher with five CVEs, including a CVSS 9.1 Mirai botnet kill-switch.
All security →SOC 2, ISO, and the Canadian privacy stack, run end to end with an independent auditor.
All frameworks →Original research, free tools, and plain-language guides on security and compliance, from a published security researcher.
Read the blog →DAST, or Dynamic Application Security Testing, tests a running application from the outside by sending crafted inputs and observing responses, without access to source code. It is a black-box technique that finds vulnerabilities visible at runtime, such as authentication and injection flaws. DAST mimics how an external attacker probes a live system.
DAST validates the application as deployed, configuration and all, so its findings tend to be real and exploitable rather than theoretical. It does not depend on the language the app is written in.
The trade-off is that DAST runs later in the lifecycle and cannot point to the offending line of code the way SAST can. The two are complementary, which is why mature pipelines run both.
traztech delivers a vulnerability management programme for startups and growth-stage companies, led by a published security researcher.
Book a callFor a broader look at getting audit-ready, see our SOC 2 readiness work, or talk to a fractional CISO about building a program around it.
DAST is the running-application counterpart to SAST, and it is what catches the issues that only exist once things are deployed and talking to each other: authentication behaviour, session handling, exposed endpoints nobody meant to publish.
In an audit it usually supports the same secure development or vulnerability management control as SAST, and the same rule applies: the evidence is the remediation record, not the tool licence.
No. DAST is automated and looks for known classes of issue against a running application. A penetration test is human-led and chains findings into demonstrated impact.
Once you have a stable staging environment that resembles production. Running it against an environment that differs materially from production produces findings nobody can act on.
Track record
Five published CVEs. CVE-2024-45163 (CVSS 9.1) is a flaw in the Mirai botnet itself, which gave defenders a way to shut down attacker infrastructure. CVE-2026-42626 takes HP ENVY 5000 printers offline from any unauthenticated device on the same network.
At Humera, a venture-backed US security company, Jacob built the compliance programme in-house from nothing: no report, no policies, no documented controls. It ended in a Type II attestation across 76 controls with zero exceptions, on a team of 15.
Before you go
Definitions only get you so far. I send a few short notes on how this plays out in practice. Unsubscribe in one click, and replies reach me directly.
From Jacob Masse, principal of traztech. No spam, unsubscribe in one click.