Skip to main content


IAST is a dynamic application security testing solution, which extends the Checkmarx application security-testing portfolio more deeply in the software development life cycle (SDLC) to identify vulnerabilities and help mitigate risk.

The Checkmarx IAST solution offers an application security self-testing model, where security testing is driven by any application functional testing (typically QA) which is executed automatically or manually. It also delivers results in zero time (immediate detection) and with zero operational overhead, which makes it a perfect fit for CI/CD environments.


IAST passively monitors running applications in testing / staging environments and integrates into existing testing platforms, be it functional, UI, network, manual or any other non-functional testing (load and stress testing). In order to allow this, a monitoring agent is coupled with the application under test (AUT) through instrumentation techniques.

As the standard testing framework runs, the agent collects data regarding the data-flow within the application. The agent itself is unaware of what security vulnerabilities to look for; it merely collects the raw data.

As the IAST Server collects the data, a specific set of security-queries run against the indexed data, detecting vulnerabilities and pushing these to an aggregated dashboard.

The "security brain" lies within the open queries, which are capable of detecting various types of vulnerabilities as described in the IAST Query Language section at the end of this guide.

IAST Advantages

  • Zero scan time – Vulnerabilities are detected while performing functional testing. Once functional testing is over the security “scan” is also completed.

  • Negligible operation overhead – Applications are detected automatically. IAST is also agnostic to application business logic changes and no operation or on-going maintenance is required as a result of such changes.

  • Low maintenance – IAST works passively and natively with any testing framework, not adding any overhead to the CI\CD process, and not requiring any maintenance.

  • Safe – IAST is transparent and doesn't modify the internal state of the application.

  • Full stack visibility – CxIAST detects vulnerabilities in all layers of the application, whether from the customer's own code or from third-party libraries. Being platform aware, CxIAST also detects vulnerabilities related to the platform that the application under test is running.

  • Flexible – The use of query language allows flexible configuration of the security queries.

  • Collaboration with SAST – Our IAST is the only IAST product that integrates natively with a full-blown SAST offering. This allows users to better prioritize their remediation efforts and have a better way to overview the security posture of their projects.

Checkmarx IAST Query Language

The Checkmarx IAST Query Language allows you to gather and analyze application run-time events and return a list of results. For a summary of the IAST Query Language, please refer to the IAST Query Language section.

IAST Vulnerabilities

For a full list of vulnerabilities covered in this CxIAST version, refer to the IAST Vulnerabilities section.