Testing methods
IAST
Interactive Application Security Testing
Interactive Application Security Testing (IAST) uses an in-application agent to observe data flow and code execution while the application is exercised by tests or traffic. By combining runtime visibility with code-level context, IAST can reduce false positives, but it requires deploying an agent and is limited to code paths that are actually exercised.
Key points
- Agent-based: instruments the app to watch execution during testing.
- Blends runtime and code context to cut false positives.
- Only covers code paths that tests or traffic actually reach.
FAQ
How is IAST different from RASP?
IAST is a testing technology that observes an app during testing to find vulnerabilities. RASP is a runtime protection technology that detects and blocks attacks against an app in production. They share instrumentation but serve different goals.
Related
Impactr finds and proves whether flaws like this are actually reachable in your own web apps and APIs, with a reproducible exploit as evidence.