Four real AppSec testing types, each catching a different class of bug:
| Check | What it scans | Stage |
|---|
| SAST | source code, before it runs — pattern-matches unsafe code like string-built SQL or hardcoded secrets | commit |
| SCA | third-party dependencies against CVE databases | build |
| IAST | the running app from the inside, via instrumentation, while QA exercises it | test |
| DAST | the running app from the outside, as an attacker would, with no source access | staging |
The cost to fix a bug grows roughly exponentially the later it's caught — a well-documented industry pattern (Systems Sciences Institute / Boehm curve): a defect is cheap to fix in code, costlier once it's built, costlier again once it reaches test, and by far the most expensive once it escapes to production and becomes an incident (rollback, hotfix, disclosure, possible breach).
Shift-left means running all four checks as early as their stage allows, so almost nothing reaches production undetected. Traditional means security testing is bolted on at the end — only DAST runs, right before release — so anything DAST can't see (most code-level and dependency bugs) ships straight through.