Static Application Security Testing Course

Name: Static Application Security Testing SAST Practice Training Course
Availability: InStock

Introduce SAST through practical scan scoping, pipeline integration, finding triage, false-positive governance, remediation, and improvement.

Static Application Security Testing Course

At a glance

Duration: 1 Week
Format: Classroom
Cities: Amman, Abu Dhabi, Rome, Langkawi, Frankfurt, Phuket and more
Next session: 8 – 12 November 2026, Amman
Average fee: 5,750 €

Home
Our Categories
Static Application Security Testing SAST Practice Training Course

Download Brochure (PDF) Print PDF

Overview

Static Application Security Testing SAST Practice Training Course is a one-week foundation course for developers, application security analysts, DevSecOps engineers, quality teams, and technical leads, who leave with a SAST Adoption, Triage and Remediation Workflow. Participants practice static code analysis, SAST pipeline integration, security finding triage, false-positive management, and remediation tracking across software delivery. Agile Leaders Training Center presents Static Application Security Testing practice.

Who Should Attend

Developers responsible for building and maintaining application code
Security personnel responsible for application findings and secure development support
DevSecOps teams responsible for build and delivery pipelines
Quality teams responsible for test evidence and release readiness
Technical leaders responsible for SAST policy, adoption, and improvement

The course assumes participants can read basic source code and development workflows, and it leaves penetration testing, exploit development, tool administration at scale, and language-specific secure coding mastery outside its scope.

Departments and Industries

The course supports departments and sectors that develop, acquire, test, or maintain software.

Software engineering and application development
Application security and product security
DevSecOps, platform engineering, and release management
Quality assurance and software testing
Technology vendors and internal digital-product teams

Learning Objectives

By the end of this course, participants will be able to:

Explain SAST methods, strengths, limitations, and complementary tests.
Configure a scoped scan and establish an initial baseline.
Integrate SAST feedback into developer and CI/CD workflows.
Review findings using data flow, context, severity, and exploitability.
Govern false positives, suppressions, remediation, and exceptions.
Build a SAST Adoption, Triage and Remediation Workflow.

Course Agenda

Day 1: Understand Static Security Analysis

SAST Position in the Secure Development Lifecycle Map
Source Code, Intermediate Representation, and Rule Analysis Model
Pattern, Data-Flow, and Taint-Analysis Concept Map
SAST Strength, Limitation, False-Positive, and False-Negative Matrix
SAST, DAST, SCA, and Manual Review Comparison Framework

Day 2: Scope and Configure Scanning

Application, Repository, Language, and Framework Inventory
Tool Capability and Coverage Evaluation Checklist
Scan Scope, Branch, Build, and Dependency Configuration
Rule Set, Severity, and Policy Baseline
Initial Scan Quality and Coverage Review

Day 3: Integrate SAST into Delivery

IDE, Commit, Pull-Request, and Pipeline Feedback Design
CI/CD Security Gate and Failure-Condition Matrix
Scan Scheduling and Incremental Analysis Workflow
Developer Notification and Finding Ownership Model
Pipeline Performance and Exception Handling Plan

Day 4: Triage and Remediate Findings

Source-to-Sink and Data-Flow Finding Review
Code Context, Reachability, and Exploitability Assessment
False-Positive Validation and Suppression Governance
Remediation Priority and Service-Level Decision Matrix
Developer-Security Collaboration and Closure Evidence

Day 5: Practice SAST Operations

Suggested Exercise: Scope a Static Analysis Scan
Suggested Exercise: Triage a Data-Flow Finding
Suggested Exercise: Review a False-Positive Claim
Suggested Exercise: Design a CI/CD Security Gate
Capstone Exercise: Complete a SAST Adoption, Triage and Remediation Workflow

Practical Exercises

The course uses suggested activities based on application repositories, scan results, pipeline decisions, and remediation records.

Suggested activity: map application languages, frameworks, repositories, build requirements, and SAST coverage limits.
Suggested activity: trace an untrusted data path and assess the code context, reachability, severity, and remediation evidence.
Suggested activity: distinguish an actionable issue from a false positive and document any approved suppression.
Suggested activity: design ownership, gates, exceptions, measures, and continuous-improvement actions for SAST operations.

FAQs

Who suits Static Application Security Testing practice training, and what does it assume?

Static Application Security Testing practice training suits developers, application security analysts, DevSecOps engineers, quality teams, and technical leads. It assumes basic source-code and development-workflow literacy.

How does SAST differ from dynamic application security testing?

SAST examines source code or compiled representations without running the application. Dynamic testing evaluates a running application and can observe runtime behavior that static analysis may not represent.

Why do SAST findings require manual triage?

SAST findings require triage because a tool identifies potential issues from rules and code models, but application context, reachability, safeguards, business logic, and exploitability determine whether a finding is actionable.

Should every SAST finding block a CI/CD pipeline?

Not every SAST finding should block delivery. Teams should define gates using validated severity, confidence, policy, application risk, baseline status, exploitability context, and an authorized exception process.

How should SAST false positives be governed?

False positives should be validated, documented, assigned a reason and owner, reviewed before suppression, linked to the affected rule and scope, and periodically reconsidered when code, tools, rules, or risk changes.

Conclusion

Participants take back a SAST Adoption, Triage and Remediation Workflow. It combines scope, configuration, pipeline integration, findings review, false-positive governance, remediation, exceptions, evidence, and metrics. The workflow changes disconnected scan output into an accountable development process that gives teams timely feedback while preserving contextual review and complementary security testing.

credits: 5 credit per day

Course Mode: full-time

Provider: Agile Leaders Training Center

Download Brochure (PDF) Print PDF

Showing 61-76 of 76 events

Location	Dates	Duration	Mode	Price
Bali	Week 34, 2027 29 August – 2 September 2027	1 Week	Onsite	€5,700
San Diego	Week 35, 2027 30 August – 3 September 2027	1 Week	Onsite	€14,000
Madrid	Week 36, 2027 6 – 10 September 2027	1 Week	Onsite	€5,700
Lagos	Week 36, 2027 12 – 16 September 2027	1 Week	Onsite	€4,100
Dubai	Week 37, 2027 13 – 17 September 2027	1 Week	Onsite	€4,500
London	Week 38, 2027 20 – 24 September 2027	1 Week	Onsite	€5,700
Manama	Week 38, 2027 26 – 30 September 2027	1 Week	Onsite	€4,700
Sharm El-Sheikh	Week 40, 2027 4 – 8 October 2027	1 Week	Onsite	€4,100
Muscat	Week 40, 2027 10 – 14 October 2027	1 Week	Onsite	€5,700
Paris	Week 41, 2027 11 – 15 October 2027	1 Week	Onsite	€5,700
Tokyo	Week 42, 2027 18 – 22 October 2027	1 Week	Onsite	€10,000
Berlin	Week 42, 2027 18 – 22 October 2027	1 Week	Onsite	€5,700
Kuala Lumpur	Week 43, 2027 25 – 29 October 2027	1 Week	Onsite	€5,200
Barcelona	Week 44, 2027 1 – 5 November 2027	1 Week	Onsite	€5,700
Bangkok	Week 44, 2027 7 – 11 November 2027	1 Week	Onsite	€6,000
Tashkent	Week 44, 2027 7 – 11 November 2027	1 Week	Onsite	€4,500

Frequently asked questions

What does this course cover?

OverviewStatic Application Security Testing SAST Practice Training Course is a one-week foundation course for developers, application security analysts, DevSecOps engineers, quality teams, and technical leads, who leave with a SAST Adoption, Triage and Remediation Workflow. Participants practice static code analysis, SAST pipeline integration, security fi…

Are training dates available?

Yes. Available dates and destinations are listed in the course dates section on this page.

How can I register?

Choose an available date on this page and complete the registration form, or send a programme enquiry.

Can I download the course brochure?

Yes. Use the brochure download link provided on this page.

Static Application Security Testing Course