What is AI SAST? A guide to AI-powered static application security testing | Endor Labs

Summary

Endor Labs describes AI SAST as static application security testing that combines rule-based pattern matching, dataflow and program analysis, and multi-pass LLM reasoning to find logic flaws such as IDORs, broken access control, and business logic bypasses that rule engines cannot express. The guide notes that the category is also called agentic application security testing, and that Gartner named Endor Labs a Sample Vendor for it in the 2026 Hype Cycle for Application Security.