Dynamic Application Security Testing
Dynamic Application Security Testing (DAST) evaluates the security of a running application by identifying vulnerabilities from an external attacker's perspective.
“A test approach in which attacks are simulated and reactions are analyzed to determine the vulnerabilities of a component or system.”
(Definition reproduced from the ISTQB Glossary. Copyright belongs to ISTQB.)
View the complete ISTQB GlossaryWhat is Dynamic Application Security Testing?
DAST tools interact with deployed applications without requiring source code access, searching for security weaknesses such as injection flaws, authentication issues, and configuration errors.
Black-box approach: Tests the application from the outside without examining source code.
Security focus: Simulates real-world attacks against the running application.
Automation: Many DAST tools automatically scan web applications for vulnerabilities.
Real World Example
An online banking login flow is being reviewed after fraud analysts report repeated attempts to discover valid customer accounts.
The concern is not whether ordinary login works; it is how the system behaves when someone intentionally misuses it. Dynamic application security testing points testing toward that hostile or risky behavior.
The tester probes rate limits, error messages, audit events, lockout behavior, and monitoring signals to see whether the system gives attackers useful feedback.
The team strengthens the controls because Dynamic application security testing helps them test the product from the perspective of misuse, not only normal customer journeys.
Practice Questions
Question 1
Which statement BEST describes Dynamic application security testing in the context of ISTQB terminology?
Question 2
A tester needs to explain Dynamic application security testing to a non‑technical stakeholder. Which approach is MOST appropriate?
Test your knowledge with real ISTQB-style questions
You’ve learned Dynamic Application Security Testing. Test your understanding with topic-specific questions in our Mock Exams.