Home / Knowledge hub / IAST
Knowledge hub
IAST
An agent inside a running app that watches where input travels.
What it means
IAST stands for interactive application security testing. It loads an agent inside the running application, usually as a library beside your own code, and follows data while the application runs. Datadog describes its version plainly: the tracing library follows user-controlled data as it flows through the application at run time.
Something else has to drive the application. Your test suite, a scanner, or people clicking through screens. IAST generates no traffic of its own. It watches what the traffic touches.
Why it matters
Precision is the appeal. Static analysis reads code without running it, so it raises findings that turn out to be unreachable. Dynamic testing works from outside and sees responses, so it rarely names the line of code. IAST holds the request and the code path together, which shortens the argument about whether a finding is real.
The agent is the price. It has to support your language, it runs inside your process, and it adds overhead. Contrast's own documentation describes instrumenting the application with sensors that analyse it from within. Plenty of organisations refuse a vendor's code in production, so IAST usually lives in staging.
How it shows up
Coverage is the catch worth understanding before anyone signs. The agent reports on paths that something actually walked, so a thin test suite produces thin results. It will never mention the screen nobody exercised.
Ask which languages and frameworks the agent supports, what it costs under load, whether your platform team will allow it near production, and where the collected data goes. Cyberlop takes the other route. We test from outside, and where code must stay private we run from a self-hosted agent that makes four outbound calls and opens no inbound ports.
Questions people ask
IAST, answered
How is IAST different from SAST and DAST?
Static testing reads your source without running it. Dynamic testing attacks the running application from outside with no view of the code. IAST sits inside the running process and sees both the request and the code that handled it.
The practical effect is fewer arguments about false positives, because the tool can show the path the data took.
Is IAST worth it?
It depends entirely on your test automation. The agent only analyses code paths that something executes, so without a strong suite driving the application you get a narrow view.
Most teams reach for static and dynamic testing first, because those fit existing pipelines, and add IAST later when triage time becomes the bottleneck.
Does the agent slow the application down?
Yes, to some degree. Instrumentation means extra work on every request it watches, and the overhead varies by language, framework and how much the agent tracks.
Ask any vendor for numbers under load that resemble your traffic, and test it yourself in staging before believing the brochure.
Can I run IAST in production?
Technically yes, and many organisations decide not to. Running a vendor's library inside a production process is a trust decision as much as a performance one.
If you do allow it, ask what leaves the process, where it goes, and whether request data or customer values can travel with it.
Do I still need other testing if I have IAST?
Yes. IAST sees what your tests exercise, which is never everything, and it says little about whether one customer can reach another customer's record.
Access control still needs testing with real logins in more than one role, which is the work we do beside whatever else you run.
Related
Terms that sit next to this one
SAST
Tools that read your source code without ever running it.
DAST
Tools that attack a running application from the outside.
White-box testing
Testing with access to the source code, not just the running application.
Black-box testing
Testing an app from outside, with no access to the source code.
False positive
A reported issue that turns out not to be real.
No vendor code in your runtime
We test from outside instead of instrumenting your process, and where the code must stay private our self-hosted agent makes four outbound calls and opens no inbound ports. Ask us what it sends.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.