SAST (Static Application Security Testing) is a method of finding security vulnerabilities by analysing source code, bytecode or binary *without executing* the application. SAST tools scan for common flaws — SQL injection, cross-site scripting (XSS), hardcoded secrets, insecure cryptographic functions, missing input validation — by understanding code patterns and data flow. SAST is the foundation of 'shift-left security' or DevSecOps: catch issues during development when fixes are cheap (~$80 per vulnerability), instead of in production where fixes cost 100x more. SAST integrates into IDEs (real-time scanning while developers type), pull request reviews, and CI/CD pipelines.

Three application security testing approaches: (1) **SAST (Static)** — analyses source code without running it; finds bugs early in development; high coverage of code paths but generates false positives, (2) **DAST (Dynamic)** — tests running application from outside (like an attacker would), (3) **IAST (Interactive)** — runs inside the application during testing, combining code visibility with runtime context; lower false positives than SAST but harder to deploy, (4) **SCA (Software Composition Analysis)** — checks third-party libraries and dependencies for known vulnerabilities (Log4Shell, OpenSSL CVEs); separate but commonly bundled. Mature programmes use SAST + SCA in CI/CD plus DAST for staging plus penetration testing for production. IAST is rarer but powerful for high-risk apps.

Five enterprise leaders: (1) **Snyk Code** — modern AI-powered, fast, developer-friendly UX, strong language coverage, (2) **Checkmarx One** — long-standing enterprise leader, comprehensive language support, deep customisation, (3) **SonarQube / SonarCloud** — strong code quality + security overlap, popular open-source heritage, (4) **Veracode** — broad enterprise adoption, particularly in regulated industries, (5) **GitHub Advanced Security (CodeQL)** — included with GitHub Enterprise, native to GitHub workflows, increasingly capable. Other notable: Synopsys Coverity, Fortify (OpenText), JFrog Xray, Black Duck. Open-source: Semgrep (very popular), Bandit (Python), Brakeman (Rails), gosec (Go). Selection criteria: language coverage, IDE integration, false positive rate, CI/CD ergonomics, governance and reporting.

SAST is good at: (1) injection flaws (SQL, command, LDAP, XML), (2) XSS, (3) hardcoded secrets and API keys, (4) insecure cryptographic functions (MD5, SHA-1, ECB mode), (5) buffer overflow patterns in C/C++, (6) deserialisation issues, (7) insecure file operations, (8) common OWASP Top 10 patterns. SAST misses: (1) authentication/authorisation logic flaws (business context required), (2) infrastructure misconfigurations, (3) runtime issues (race conditions, memory corruption requiring specific inputs), (4) issues in third-party dependencies (use SCA instead), (5) vulnerabilities requiring multi-system context. False positive rate: 20-40% is common; modern AI-assisted tools (Snyk Code, GitHub CodeQL) have reduced this significantly.

Three integration points: (1) **IDE plug-in** — scan as developer types, immediate feedback (Snyk, Checkmarx, SonarLint, GitHub Copilot), (2) **Pull request scan** — scan on PR creation, comment findings, gate merge for high-severity issues, (3) **Pipeline scan** — full scan in CI build, fail build on policy violations. Best practices: (1) **Differential scanning** — scan only changed code in PRs (full scan only on main branch) to reduce build time, (2) **Severity-based gating** — block merges for CRITICAL/HIGH, warn for MEDIUM, log LOW, (3) **Suppression workflow** — formal exception process with expiry dates, (4) **Developer training** — fixing what's found requires understanding security concepts; SAST tools alone don't fix code, (5) **Avoid scan-and-shame** — high false positive rate erodes trust; tune aggressively in first 30 days.

Direct regulatory requirements are rare, but SAST is implicitly required by: (1) **PCI-DSS** v4.0 — Requirement 6.3 mandates secure development practices including static analysis, (2) **SOC 2** Trust Services Criteria — secure development controls, (3) **ISO 27001:2022** Annex A.8.28 — secure coding controls, (4) **NIS2** Article 21 — security in development and acquisition of network and information systems, (5) **DORA** — secure development for financial sector ICT, (6) **US Executive Order 14028** — federal contractors must produce SBOM and prove secure development practices, (7) **NIST SSDF (SP 800-218)** — Secure Software Development Framework. Cyber insurance carriers and enterprise customers increasingly require evidence of SAST in their vendor security questionnaires.

Pricing varies widely (2026): (1) **Snyk Code** — free for open-source and small teams, $25-100/developer/month for paid plans, (2) **Checkmarx One** — typically $150-400/developer/year for enterprise, (3) **SonarQube** — free Community Edition; commercial Developer Edition from $120/year per million lines of code, (4) **Veracode** — typically $200-500/developer/year, (5) **GitHub Advanced Security** — $49/active committer/month, (6) **Open-source tools** (Semgrep, Bandit) — free, but require investment in tuning and integration. Total cost of ownership includes developer training, false-positive triage time, and policy management. ROI usually positive — finding a single critical vulnerability before production saves 10-100x the annual SAST cost.