IAST (Interactive Application Security Testing)

IAST agents are loaded into the application process (typically via a language runtime hook) and watch data flows, function calls and HTTP requests in real time. By combining the inside view of SAST with the runtime context of DAST, IAST can confirm whether tainted input actually reaches a dangerous sink, which sharply reduces false positives and pinpoints the vulnerable line of code. It is usually run during functional or QA testing rather than against production. IAST works best for instrumented languages such as Java, .NET, Node.js and Python; example tools include Contrast Security, Checkmarx CxIAST and Seeker.