Could you break down the main differences between static and dynamic application security testing tools for someone who just graduated with a computer science degree?