SAST: analyze without running
Static analysis looks for risky patterns in code and configuration. It happens early and pinpoints the affected areas, but can miss the actual behavior of the deployment.
DAST: test from the outside
Dynamic testing interacts with a running application. It sees the surface that is actually exposed, but understands less well the internal paths that are not reached during exploration.
SCA: know the building blocks you use
Software composition analysis links dependencies and their versions to public vulnerabilities. It still requires interpreting the context to know whether the vulnerable feature is actually used.
Why combine them
A signal becomes more useful when it is confirmed from several angles. A vulnerable library, a call in the code and an exposed service make a more credible priority than an isolated version match.