Static Application Security Testing
Static Application Security Testing (SAST) is a security testing technique that analyzes application source code, bytecode, or binaries without executing the software to identify security vulnerabilities.
“A type of static analysis that focuses on detecting vulnerabilities.”
(Definition reproduced from the ISTQB Glossary. Copyright belongs to ISTQB.)
View the complete ISTQB GlossaryWhat is Static Application Security Testing?
SAST helps developers detect security weaknesses early in the development lifecycle, making remediation faster and less expensive.
Early security analysis: Vulnerabilities are found before execution.
Source code focus: Examines code for insecure patterns.
Automation: Frequently integrated into build pipelines.
Real World Example
An online banking login flow is being reviewed after fraud analysts report repeated attempts to discover valid customer accounts.
The concern is not whether ordinary login works; it is how the system behaves when someone intentionally misuses it. Static application security testing points testing toward that hostile or risky behavior.
The tester probes rate limits, error messages, audit events, lockout behavior, and monitoring signals to see whether the system gives attackers useful feedback.
The team strengthens the controls because Static application security testing helps them test the product from the perspective of misuse, not only normal customer journeys.
Practice Questions
Question 1
Which statement BEST describes Static application security testing in the context of ISTQB terminology?
Question 2
A tester needs to explain Static application security testing to a non‑technical stakeholder. Which approach is MOST appropriate?
Test your knowledge with real ISTQB-style questions
You’ve learned Static Application Security Testing. Test your understanding with topic-specific questions in our Mock Exams.