Interactive testing
Early accessRuntime confirmation from inside the app.
IAST instruments a running service with an in-process agent, tracks tainted input from the HTTP request to the sink, and reports vulnerabilities with the exact request, code path and stack trace. Every finding was observed, not inferred.
GET /search?q=<svg/onload=confirm(1)> HTTP/1.1
Host: shop.acme.example
Cookie: session=eyJhbGciOi… (replayed session)
HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
<h2>No results for <svg/onload=confirm(1)></h2>
The payload is returned unencoded in the page body — the element parses and executes. Differential oracle confirmed it on 3 of 3 attempts.
The question it answers
“What is actually vulnerable under real traffic?”
Capabilities
What IAST does
An in-process agent that confirms vulnerabilities from inside the running app.
In-process agent
Attach with a single -javaagent flag in CI or staging. No source upload, no proxy, no changes to your build.
Runtime taint tracking
Sources are HTTP inputs; sinks are SQL, command execution, file access, deserialization and the response. The agent watches data cross from one to the other.
Proof on every finding
The request that triggered it, the code path it took and the stack trace at the sink — the hybrid of SAST's inside view and DAST's live conditions.
Route coverage
See which routes were discovered, exercised and never reached, so you know what your tests actually touched.
You keep the runtime
The agent runs on your side and reports to an authenticated collector with a per-project token you can revoke at any time.
Same findings queue
IAST findings land next to SAST, SCA, DAST and AI Pentest results with the same severities and workflow.
How it works
From input to evidence
Attach the agent
Add the agent to your JVM service in CI or staging with a project token.
Exercise the app
Run your test suite, a DAST scan or real traffic — the agent observes every request.
Findings stream in
Confirmed vulnerabilities appear with request, path and stack trace as they're observed.
Fix and verify
Re-run the traffic; a fixed sink stops reporting.
IAST is in early access, JVM first
The Java agent is available to Enterprise customers now; other runtimes follow. Join the programme and we'll get you set up with an agent token and deployment guidance.
Request early accessAvailable on
IAST is included on the plans below.
FAQ
IAST, in brief
Full walkthroughs live in the IAST documentation.
When is IAST available?
IAST is in early access with a Java / JVM agent first. Enterprise customers can join the early-access programme from the contact page; other runtimes follow.
Does it slow my application down?
The agent is designed for CI and staging environments and batches its reports. Production deployment guidance ships with the agent.
Ship software you can prove is secure.
See the platform on your own code, or talk to us about a dedicated Enterprise stack.