SAST is static application security testing of source code. SCA is software composition analysis of dependencies. IaC scanning checks infrastructure as code files. CSPM is cloud security posture management of live accounts. Secrets scanning looks for credentials in text. Container scanning inspects image contents. Here are short answers to the questions people ask most.
Questions and answers
What does SAST stand for and how is it different from DAST?
Static application security testing examines code without running it. OWASP's DevSecOps guideline describes static analysis as examining the code without executing the program. DAST tests a running application from outside, so it sees runtime behaviour but not source lines.
What is SCA, and is it the same as an SBOM?
SCA identifies the components you use and checks them against known vulnerabilities. An SBOM is the inventory itself. SCA often produces or consumes one, but the SBOM is a list, while SCA is the analysis.
Is container scanning part of SCA?
It overlaps. Container scanning reads the built image, including operating system packages. SCA reads manifests. See SCA vs container scanning.
What counts as infrastructure as code?
Files that define infrastructure: Terraform, CloudFormation, Kubernetes manifests, Dockerfiles. Trivy's documentation lists Dockerfile and Kubernetes checks as examples, with Terraform and CloudFormation also supported.
What is the difference between IaC scanning and CSPM?
One reads definitions before apply, the other reads the live cloud afterward. This comparison explains drift.
What does a secrets scanner look for?
Patterns for tokens, keys and passwords across files and, in some tools, history. GitHub's scanning covers all branches in history plus issues, discussions and wikis.
Why do tools disagree on severity?
They use different scoring inputs. Some use the base score from a public database, others adjust for exploit data or whether the code is reachable. Pick one scale and document how you map the others.
Do I need all of them?
Not on day one. See the order to adopt scanners.
Quick check
Is an SBOM a scanner?
No. It is an inventory of components. A scanner analyses an inventory or code for problems.
Does SAST run the application?
No. It examines code without executing it. Testing a running app is DAST.
Sources
- OWASP DevSecOps Guideline: Static Application Security Testing
- Trivy: misconfiguration scanning
- GitHub Docs: About secret scanning
Last reviewed: 19 October 2026.
