Software Security Testing in a DevSecOps Pipeline
I agree that relying on "developer education" is quite futile, at least when it's the sole course of action. Combine this, however, with automation and you can achieve far greater impact. Both sides, DAST and SAST can be covered with:


Unit test authentication: Make sure that you have unit tests that check registration, login, password reset and that it is integrated with your development process (continuous integration). Implement processes that automatically block changes to your code when they fail.
Testing against known vulnerabilities: These are automated DAST tests that test your application from outside. Programs that handle this task include BDD and mittn which is inspired by GAUNTLT.


Integrate everything properly with a CI server (Jenkins, Gitlab, Travis) and stop having to rely on your programmers' "best effort security"

Note: my opinion of proper CI integration, from a language/platform agnostic view, covers the following

Tests/examples:
 - unit tests that cover at minimum 80%, better 90%
 - integration tests that ensure the modules work with one another
 - example programs that show how a user should use the API

Build automation:
 - Automatically build every pushed commit
 - Build library, test and example code
 - Build for each platform/configuration
 - Run the tests

Merge/pull requests:
 - Block merges into master branch if any thing fails
 - Require code review of at least one other colleague

Code analysis:
 - Run nightly static code analysis (style, anti-conventions, dangerous constructs)
 - Run nightly dynamic code analysis (memory leaks, race conditions, known security flaws)

Publish results:
 - Publish graphs/trends of test/analysis history
 - Talk about changes/targets in weekly meetings
 - Act on problem areas with sprints/work packages