A fixed-price gap analysis, remediation through to your audit, and upkeep after it. All in a workspace you keep.
All compliance →Led by a published security researcher with five CVEs. One standard report, letters for your buyers, and retests of your fixes.
All security →To the people you sell to, raise from or answer to.
All industries →Original research, free tools, and plain-language guides on security and compliance, from a published security researcher.
Read the blog →DAST, or Dynamic Application Security Testing, tests a running application from the outside by sending crafted inputs and observing responses, without access to source code. It is a black-box technique that finds vulnerabilities visible at runtime, such as authentication and injection flaws. DAST mimics how an external attacker probes a live system.
DAST validates the application as deployed, configuration and all, so its findings tend to be real and exploitable rather than theoretical. It does not depend on the language the app is written in.
The trade-off is that DAST runs later in the lifecycle and cannot point to the offending line of code the way SAST can. The two are complementary, which is why mature pipelines run both.
traztech delivers a vulnerability management programme for startups and growth-stage companies, led by a published security researcher.
Book a callFor a broader look at getting audit-ready, see our SOC 2 readiness work, or talk to a fractional CISO about building a program around it.
Free PDFs, no card
SOC 2 readiness, ISO 27001 gaps, incident response and vendor security, as PDFs you can print or forward. Free, no card.
From Jacob Masse, principal of traztech: the files by email, then a few short notes over the next month. No spam, unsubscribe in one click.
DAST is the running-application counterpart to SAST, and it is what catches the issues that only exist once things are deployed and talking to each other: authentication behaviour, session handling, exposed endpoints nobody meant to publish.
In an audit it usually supports the same secure development or vulnerability management control as SAST, and the same rule applies: the evidence is the remediation record, not the tool licence.
No. DAST is automated and looks for known classes of issue against a running application. A penetration test is human-led and chains findings into demonstrated impact.
Once you have a stable staging environment that resembles production. Running it against an environment that differs materially from production produces findings nobody can act on.