Security tools for development teams come with a lot of acronyms. They aren't interchangeable: each one looks at a different part of what you ship. Here's what they cover and how to decide where to start.
| Assessment | What it looks at | Typical findings |
|---|---|---|
| SAST | Your own source code | SQL injection, unsafe deserialisation, missing authorisation checks, hard-coded secrets |
| SCA | Open-source packages you depend on | Libraries with known CVEs, abandoned packages, risky licences |
| IaC | Terraform, CloudFormation, Kubernetes, Helm | Public storage buckets, unencrypted databases, over-permissive IAM roles, privileged containers |
| SBOM | A complete inventory of components | Unknown or outdated components, gaps in supply-chain visibility |
SAST: static application security testing
SAST reads your code without running it and flags patterns that commonly lead to vulnerabilities. It's best at catching issues early, ideally on every pull request. Its weakness is noise: raw tool output often includes many false positives, which is why we review every result by hand before reporting it.
SCA: software composition analysis
Most modern applications are largely made of open-source code. SCA matches your dependencies, including the dependencies of your dependencies, against vulnerability databases. A good SCA review also asks whether the vulnerable code is actually reachable in your app, so you upgrade what matters first.
IaC security review
If your infrastructure is defined in code, its misconfigurations are too. Reviewing IaC catches exposed services and weak permissions before they're deployed, which is much cheaper than finding them in production.
SBOM assessment
A software bill of materials is a machine-readable list of everything in your software, usually in CycloneDX or SPDX format. Enterprise customers and regulators increasingly ask for one. On its own, an SBOM doesn't find vulnerabilities, but it makes every other check faster and lets you answer “are we affected?” within minutes when the next major library vulnerability is announced.
Where to start
- Shipping a web or mobile product? Start with SCA and SAST. They cover the most common sources of exploitable bugs.
- Running on AWS, Azure or GCP with Terraform or Kubernetes? Add an IaC review.
- Selling to enterprises or regulated industries? Expect security questionnaires to ask for an SBOM.
- Need assurance from an attacker's view? None of these replace a penetration test. They find different issues and work best together.
We can run all four as one engagement and give you a single prioritised report. Request a quote.