“The SAST is a starting point in which you can make some initial investigation because any static analysis tool will need multiple runs and will need configuration changes as well.”

Transcript evidence from Ochaun Marshall -- IaC and SAST.