• Single-page apps broke crawling. Client-side routing, a JavaScript-rendered DOM and async API calls defeat crawler-based discovery. Coverage silently collapses — and the scan still reports “complete”, which is the dangerous part.
• Runtime cost. A full scan takes hours to days. That is incompatible with gating a pull request.
• No root cause. It tells you an endpoint is vulnerable; somebody still has to find the line.
• APIs moved east-west. Machine-to-machine and internal traffic is invisible to a crawler that starts at a login page — and in 2025 APIs were 17% of published vulnerabilities but 43% of newly added KEV entries.

1 — It tests what is actually deployed. It is the only category that sees the running configuration: the reverse proxy, the WAF (web application firewall) bypass, the misapplied header, the staging endpoint nobody knew was public. SAST cannot see any of that, because none of it is in the source.

2 — Authentication and session flaws. Session fixation, token handling, logout behaviour, cookie scoping.

3 — Zero false positives on confirmed exploitation. A tool that gets a reflected payload back has proven the finding. That is a stronger evidentiary position than any static finding, and it is why DAST output survives an argument with a developer.

4 — Schema-driven API testing, which is the modern form: point it at an OpenAPI or GraphQL schema — a machine-readable description of the API — instead of crawling for endpoints.

This is the only AppSec category with a credible, large-N, longitudinal measurement, for a simple reason: public GitHub is observable by anyone, so the finding is reproducible in principle rather than being vendor telemetry.

The counterintuitive finding, and the one to remember: private repositories are roughly six times more likely than public ones to contain a hardcoded secret. Developers self-censor in public. So every public-GitHub number is a floor, not a ceiling — your own estate is almost certainly worse than the headline. And about 28% of incidents originate outside repositories entirely, in Slack, Jira and Confluence, where those are 13 percentage points more likely to be rated critical.

Two of the three tools every older guide recommends are dead. Terrascan was archived by Tenable in November 2025 — the repository notice reads that the project is no longer maintained. tfsec is deprecated in favour of Trivy, its own maintainer having consolidated all scanning efforts there.

Notice the strategic shape, because it is the actual answer to “which scanner should we buy”: this entire layer is free and open source, and two of the three leaders are maintained by the platform vendors themselves. The scanners are loss-leaders. Nobody sells container scanning any more — they sell the console that aggregates its output.

And what container scanning structurally cannot do: it tells you a package with a CVE is present in a layer. It cannot tell you the binary is ever executed, that the container runs as non-root, that capabilities are dropped, or that the image is the one actually deployed. Base-image CVE count is the single most-gamed metric in this category — moving to a distroless or Alpine base can drop the number by 90% while changing your real risk very little. If someone reports that as a security win, ask what stopped being exploitable.