List: websecurity@lists.webappsec.org
From: Paul Johnston
Re: [WEB SECURITY] Security test case automation
Thu, Jan 23, 2014 9:44 AM
There are two main approaches: DAST which scans a
running web app, and SAST which analyses source code. They have
different strengths and weaknesses, so you get the most benefit from
running both and combining the results.
What you cannot automate is the mindset of a hacker. Security is not
just about checking for a known set of issues.