Comparisons | appsec.fyi

Most of these pages exist because two things get used interchangeably in conversation and then turn out to mean different things when somebody has to make a decision. SAST and DAST are both "scanning". SSRF and CSRF differ by one letter and share almost nothing. IDOR and BOLA are the same bug under two names, which is worth knowing before you argue about it in a triage queue. Each comparison here is written to settle the distinction and then answer the question underneath it — which one do I actually need.

How to read a comparison like this

Paired-technology questions almost never resolve to "X is better than Y", because the two options usually cover different failure modes on purpose. Three questions do more work than a feature table:

What does each one structurally cannot do? This is the most useful question and the one vendor material never answers. SAST cannot know which code paths execute. A WAF cannot know whether a well-formed request is authorized. A bug bounty cannot tell you what was tested. Those limits are properties of the approach, not gaps a better product closes — so they decide which combination you need rather than which product you buy.

What can your team actually operate? A tool whose output nobody triages is worse than no tool, because it trains people to ignore security alerts. Deployment constraints matter just as much: RASP and IAST need an agent in a supported runtime, SAST needs source you own, DAST needs only a URL. Those constraints frequently decide the question before preference does.

Are you buying discovery or assurance? Continuous adversarial attention and a bounded assessment you can hand an auditor are different products. Organizations routinely buy one and expect the other.

Every page below follows the same shape: a direct answer, the decision framework for that specific pair, a worked example running one scenario through both sides, the tooling on each, and what neither option covers. Where a comparison touches a topic with a full resource collection, it links through.

Testing approaches

Four ways of looking for vulnerabilities, distinguished mainly by where they sit and what they can therefore see.

SAST vs DAST Reading code that isn't running versus attacking code that is. Covers why SAST's false-positive rate is structural, and why authentication is the highest-value thing you configure in a DAST scan. SCA vs SAST Vulnerabilities in code you imported versus code you wrote. Explains why SCA finding counts are close to meaningless without reachability, and why the two remediation workflows look nothing alike. SAST vs DAST vs IAST vs RASP The full four-way comparison, including what each one structurally cannot find and a sensible adoption order. The longest page here. WAF vs RASP Filtering traffic before it arrives versus deciding at the dangerous operation itself. Why signature matching is a parsing contest the attacker can retry indefinitely.

Engagement models

Who does the testing, on what terms, and which question the result can actually answer.

Bug Bounty vs Penetration Testing Paying for results versus paying for time — and why only one of them produces the coverage evidence an auditor or customer questionnaire is asking for. Penetration Testing vs Red Teaming Measuring your software versus measuring your detection and response. Includes why purple teaming is usually what people want when they ask for a red team.

Vulnerability classes

Pairs that get confused in reports, which causes real problems in triage and severity arguments.

SSRF vs CSRF One letter apart, almost nothing in common: the victim's browser sends the request in one, the server sends it in the other. No shared defenses at all. XSS vs CSRF Why XSS defeats every CSRF defense but not the reverse, and why a CSRF token is not a mitigating factor in an XSS report. Types of XSS Reflected, stored and DOM-based, plus mutation XSS — where each one lives, which defenses reach it, and how to show impact past an alert box. IDOR vs BOLA The same defect under two names from different lineages. Which term to use with which audience, and why the API Top Ten ranked it first. SQL Injection vs NoSQL Injection Both are injection, but one breaks out of a string and the other changes a field's type — so parameterized queries have no direct NoSQL equivalent.

Identity

Two distinctions that account for a large share of real-world access-control failures.

Authentication vs Authorization Who you are versus what you may do. Why authorization is the one that breaks: it's scattered across every endpoint while authentication is centralized and reviewed. OAuth 2.0 vs SAML Delegated authorization versus federated authentication, and why the fair comparison is SAML against OpenID Connect rather than against bare OAuth.

Defensive technique and supply chain

Two pairs where using one as a substitute for the other is the actual failure.

Input Validation vs Output Encoding Deciding whether to accept input versus how to safely emit it. Why stripping apostrophes corrupts your data without fixing the injection. SBOM vs SLSA An inventory of what's inside versus proof of how it was built. An accurate SBOM of a compromised build is still a compromised build.