A county security lead wants only automated DAST and no manual web testing for a civic portal. What should the tester explain?
Select an answer to reveal the explanation.
Short Explanation
Scanners are great smoke detectors — they are not fire inspectors walking every hallway. Automated DAST finds a lot, but authorization and business-logic gaps still need a human poking the workflows. Buying more threads does not replace that judgment.
Full Explanation
Automated DAST complements but does not replace manual web testing for CPTS-depth coverage. Many access-control and multi-step logic flaws require contextual abuse of application workflows that scanners miss or under-prioritize. Claiming DAST alone proves fixation or every workflow issue overstates tooling. Recommend a blended approach: automation for breadth, manual testing for authz and logic depth.