“I would probably grab an SCA product so that I could make sure that the packages that that we're pulling in, That we have some understanding of what's coming into our project. So I would probably look at an SCA tool off the bat and um, generally, again, this depends on what language you're using and all that stuff, but I would probably, the next thing would probably be a SAST is I would probably, especially if I'm that early, I would want to be making sure we're monitoring the code as closely as possible.”

Transcript evidence from Dan Küykendall -- Why All Application Security Products Suck.