Security Testing Before and After Deployment
How testing application security before deployment (SAST on source code) and after deployment (DAST on running application) provides complementary visibility into different aspects of application security.
Primary question: Why test application security both before and after deployment?
Direct answer
Testing before deployment identifies code-level weaknesses in source code. Testing after deployment identifies runtime weaknesses in the running application. Together they provide visibility into both the code and its behavior that neither approach achieves alone
Testing before deployment identifies code-level weaknesses in source code that exist regardless of runtime behavior. Testing after deployment identifies runtime weaknesses that manifest only when the application is running with real configuration, data, and user interactions. Together they provide visibility into both the code and its behavior that neither approach achieves alone.
Pre-deployment testing (SAST) provides early feedback to developers, enabling faster remediation and reducing the cost of fixing code-level weaknesses. Post-deployment testing (DAST) provides visibility into runtime configuration issues, authentication-related weaknesses, and behavior that only appears when the application is running.
Testing only before deployment misses runtime weaknesses. Testing only after deployment misses code-level weaknesses in paths not exercised during testing and cannot provide early feedback to developers. Both testing stages are needed for broader application security coverage.
Definitions
Pre-deployment testing
Security analysis performed before the application is deployed, typically on source code or build artifacts. SAST is the primary pre-deployment testing technique.
Post-deployment testing
Security analysis performed after the application is deployed to a test or staging environment, analyzing the running application. DAST is the primary post-deployment testing technique.
Code-state vs runtime-state
The distinction between analyzing the application as code (code-state) versus analyzing the application as it runs (runtime-state). Each state reveals different properties and weaknesses.
The engineering problem
Organizations that test security only before deployment miss runtime weaknesses that only manifest after deployment, when the application is running with real configuration and data. [derscanner-dast]
Organizations that test security only after deployment miss code-level weaknesses in paths not exercised during testing, cannot identify the root cause from source code, and cannot provide early feedback to developers. [derscanner-sast]
Without testing at both stages, organizations have an incomplete picture of application security — they either know about code weaknesses without runtime confirmation, or runtime behavior without code-level root cause.
Security controls
Each control inspects a different artifact and produces evidence for an engineering decision.
Pre-deployment testing
SAST- Artifact
- Application source code or build artifacts.
- Risk
- Code-level weaknesses not identified before deployment.
- Output
- SAST findings with code location, severity, and analysis context.
Evidence: DerScanner static analysis documentation
Post-deployment testing
DAST- Artifact
- Running application in test or staging environment.
- Risk
- Runtime weaknesses not identified before production deployment.
- Output
- DAST findings with endpoint, attack vector, and runtime evidence.
Evidence:
Combined assessment
SAST + DAST assessment- Artifact
- Findings from both pre-deployment and post-deployment testing.
- Risk
- Missing weaknesses that exist in only one testing stage.
- Output
- Broader security assessment covering both code-level and runtime weaknesses.
Evidence:
Verification workflow
- Source code is analyzed by SAST before deployment to identify code-level weaknesses.
- Application is deployed to a test or staging environment.
- DAST analyzes the running application to identify runtime weaknesses.
- Findings from both testing stages are reviewed together to understand the full security posture.
- Correlation between SAST and DAST findings provides additional context for prioritization.
- Remediation addresses findings from both testing stages.
- Rescan verifies fixes through both static re-analysis and dynamic re-testing.
DerScanner · Enterprise
Relationship to DerScanner
DerScanner provides SAST and DAST capabilities that can be used for pre-deployment and post-deployment security testing, with correlation to connect findings from both stages.
DerScanner performs static analysis and dynamic analysis, and can correlate findings between the two to provide combined code-to-runtime evidence. [derscanner-sast][derscanner-dast]
Limits of verification
- Post-deployment testing requires a running target in a test or staging environment, which must be maintained and kept representative of production.
- Correlation requires a supported mechanism; not all SAST and DAST tools provide correlation functionality.
- Testing at both stages requires additional time and resources compared to testing at a single stage.
Related knowledge
Combining SAST and DAST
Why organizations use both SAST and DAST together
Relationship: related-toSAST and DAST in CI/CD
How SAST and DAST fit into a CI/CD security workflow
Relationship: related-toCode-to-Runtime Security Testing
Connecting code-level weaknesses with runtime application behavior
Relationship: related-toCanonical terms used: Pre-deployment testing; Post-deployment testing; Code-state vs runtime-state; Before and after deployment.
Evidence and references
- DerScanner static analysis documentationDerScanner performs static analysis and reports source-code security findings.
derscanner-sast - DerScanner dynamic analysis documentationDerScanner DAST is a web-application scanner that detects vulnerabilities and backdoors by providing malformed or random inputs, using the black-box method without requiring source code. When source code is available, dynamic-analysis results can be correlated with static-analysis results for better accuracy and easier prioritization.
derscanner-dast
Security testing before and after deployment