IAST
Interactive application security testing
An agent inside the running application observes data flow while tests or real traffic exercise it, combining the code-level detail of SAST with the runtime evidence of DAST; it covers only the code that is exercised.
Covered in
Guide
Combine static and dynamic tests around a verified finding
Use analysis tools to find evidence, then retain an application regression that demonstrates the failure and the fix.
Guide
Choose and evaluate application security testing tools
What SAST, DAST, IAST, SCA, secrets, IaC, container and API scanners and ASPM each find and miss, where each runs, how to evaluate them on a seeded repository with per-CWE scoring and triage cost, and which to adopt first.
Practice: Local project: Repair a security pipeline for GitHub Actions and GitLab CI