Skip to main content

Interactive Security Testing (IAST)

🌟 Objective​

To leverage the normal execution of the application to perform security testing with active instrumentation, combining:

  • The precision of SAST with the real context of DAST;
  • Continuous monitoring of insecure calls, misuse of libraries, poorly validated variables and other risks;
  • The generation of findings directly related to the application's behaviour at runtime;
  • Improved coverage without duplicating manual or automated testing effort.

IAST is ideal for validating security without the additional effort of creating test cases or dedicated scanners.

🔍 What IAST is​

IAST (Interactive Application Security Testing) is a security testing approach that uses instrumentation on the application server to observe calls, flows and executions in real time - while the application is being used in functional, manual or automated tests.

It makes it possible to:

  • Observe unsanitised data propagating to critical functions;
  • Verify insecure use of libraries or native APIs;
  • Detect vulnerable executions in real time with full visibility of the stack;
  • Associate findings with concrete users, calls, routes and parameters.

💡 IAST requires integration with the application's runtime, which is easier in stacks such as Java, .NET, Python and Node.

⚙️ How to apply​

  1. Select an IAST tool compatible with the application's stack;
  2. Instrument the staging server with IAST agents (or configured containers);
  3. Run functional, manual or automated tests while IAST is active;
  4. Analyse the findings generated in real context - by flow, route, user ID;
  5. Triage the results and prioritise based on execution and impact;
  6. Integrate results in continuous improvement cycles (e.g. security backlog).

⚠️ IAST does not replace DAST or SAST - it acts in a complementary way to maximise visibility.

✅ Good practices​

  • Use IAST in staging or integrated test environments;
  • Validate coverage (e.g. endpoints exercised during the test);
  • Prioritise findings based on real impact (executed vs potential);
  • Review the permissions and the performance impact of the instrumentation;
  • Use IAST as a passive observer in QA and integration tests.

📎 Cross-references​

DocumentStrategic relevance
Chapter 02 - RequirementsValidates EX-REQ-203, EX-REQ-307, EX-REQ-404
Chapter 06 - DevelopmentObserves violations in real time
01-sast.mdIAST observes flaws that SAST only detects statically
02-dast.mdComplements DAST with visibility into the backend
06-cobertura-e-priorizacao.mdMeasures coverage by real execution
08-gestao-findings.mdIAST findings are highly traceable

Illustrative identifiers (EX-…); they do not correspond to the Ch. 02 Requirements Catalogue.

🧠 IAST combines code visibility with real execution - making security testing more relevant, precise and contextualised, without depending on false positives or assumptions.