A dynamic AppSec program that developers use is not fundamentally different from one they ignore in terms of what it scans.