Where static analysis reads source code, DAST treats your app as a black box. A scanner crawls your pages and API, sends unusual inputs, and looks for signs of trouble: error messages that reveal internals, missing security headers, reflected script, exposed files, weak cookie settings.
Because it tests the deployed thing, it catches problems code review misses, such as a misconfigured server, a debug route left on, or a header stripped by your host. It cannot see your source, so it may miss logic flaws deep behind a login, and it needs test credentials to reach authenticated pages.
Only scan systems you own or have written permission to test, and prefer a staging copy with fake data, since scanners can create records or trigger emails. Run it against each release, give it a low-privilege test account, and review the results by hand. Combine it with static analysis: each finds things the other cannot.