These get sold as though they compete. They don't. Three find different classes of problem, and the fourth exists because the first three produce more findings than anyone can act on.
What each one does
SAST analyses source code without running it. Catches flaws in code your team wrote: injection, unsafe deserialisation, hardcoded secrets, missing authorisation checks.
SCA inventories your dependencies and checks them against vulnerability databases. Catches known CVEs in libraries you didn't write, plus licence issues. SBOM generation usually lives here.
DAST probes a running application from outside, like an attacker with no source access. Catches misconfiguration, exposed endpoints, and anything that only appears at runtime.
ASPM isn't a scanner. It connects to the tools you already have, deduplicates overlapping findings, adds context about what's deployed and reachable, and produces a prioritised list.
What each catches that the others can't
Catches | Misses | |
|---|---|---|
SAST | Flaws in first-party code, pre-merge | Dependencies; runtime behaviour |
SCA | Known CVEs in third-party code | Anything you wrote yourself |
DAST | Runtime and config issues, real exploitability | Anything not reachable from the tested surface |
ASPM | Nothing — it correlates | Everything, if the scanners underneath missed it |
A SQL injection you wrote is SAST. A vulnerable logging library is SCA. A misconfigured CORS policy in production is DAST. None substitutes for another.
What order to adopt them
Under 20 engineers. SCA first. Cheapest, highest signal, and most breaches trace to a known unpatched dependency. Then SAST. Skip DAST and ASPM.
20 to 100. Add SAST properly, with a baseline so existing debt doesn't block every pull request. DAST becomes worthwhile if you have a public-facing app handling real data. ASPM is premature.
100+, or regulated. All three scanners, plus ASPM once reconciling findings across tools has become someone's actual job.
The common mistake is buying ASPM early. It manages complexity, it doesn't reduce it. With two scanners you don't have a correlation problem, you have a fixing problem.
What ASPM actually means
The term is used loosely. Some vendors mean a genuine aggregation layer over third-party tools. Others use it for their own multi-scanner suite, which is different, you get correlation only across their products.
Worth asking directly: does this connect to tools I already own, or only to yours?
Where remediation fits
None of these four fixes anything. They all produce findings, and the gap between a finding and a merged fix is where most application security programmes actually fail. That's the problem Kolega works on. SAST that produces a reviewable fix alongside the finding rather than another ticket.