Interactive Application Security Testing (IAST)

Interactive Application Security Testing (IAST) means observing an app from the inside while it runs. Instrumentation hooks into the running process and reports what the code does as it does it, including logic and data flows that are hard to see from the outside.

On mobile, IAST uses runtime instrumentation to follow how an app handles input, keys and sensitive data during real use. It sits between pure static and pure dynamic testing and explains behaviour the other two only hint at.