New Relic IAST

New Relic IAST tests running applications for exploitable vulnerabilities and connects findings to remediation workflows. It is aimed at DevOps and security teams building continuous security checks into development. Its core appeal is attack validation with useful runtime context; the narrow language coverage and usage-based add-on billing are important constraints.

Overview

Rather than relying only on static signals, New Relic IAST dynamically assesses running code by simulating real-world attacks. It can provide proof of exploit without code changes, helping teams distinguish actionable weaknesses from findings that may not be exploitable. The product is designed to generate fewer false positives than traditional application security tools.

Findings integrate with New Relic Vulnerability Management to support continuous identification, fixing, and verification of high-risk vulnerabilities across the software development lifecycle. This makes IAST a stronger fit for teams that want security work tied to an ongoing development process than for those seeking a standalone, occasional scan.

Key features

Runtime testing and remediation context

New Relic APM agents deliver IAST, which can be enabled with a configuration setting change. For teams already using those agents, that offers a direct path to runtime security testing. Teams outside the New Relic agent environment have less reason to choose it, and applications must use Go, Java, Node.js, or Ruby; other language stacks are outside its stated coverage.

Guided remediation can provide the code location, stack trace, HTTP trace, URLs encountered, exploit mechanism, and parameters. That context gives developers concrete starting points for investigation rather than leaving security teams with a severity label alone. CVSS version 3 scores findings as Low, Medium, High, or Critical.

Workflow and deployment fit

CI/CD pipeline and ticketing integrations help route findings into development and response workflows. New Relic also offers more than 780 integrations spanning applications, logs, and infrastructure data, a broad ecosystem for teams consolidating operational context. Authenticated and API testing are supported, while the runtime target is web.

Customers can choose New Relic data centers in the United States or European Union. New Relic currently lists FedRAMP, HIPAA-enabled capabilities, ISO 27001, ISO 42001, PCI DSS, SOC 1, SOC 2, and TISAX certifications or attestations. These options matter to organizations with residency or compliance requirements, though the Enterprise plan's stated FedRAMP Moderate and HIPAA eligibility is specifically tied to Data Plus.

Pricing

New Relic IAST is a paid capability with pricing on request. Analysis is billed through an optional Compute Add On according to Compute Capacity Units consumed, so costs depend on analysis usage rather than a published flat IAST price. Teams should account for this variable charge when estimating ongoing testing costs.

New Relic's platform plans provide a free entry point, but the published plan details do not give a separate IAST price:

• Free — free: Includes 100 GB of data ingest per month, one free full platform user, unlimited basic users, and 50+ capabilities. It is the lowest-risk way to start with the platform, but has a single full-user allowance and does not remove IAST's optional Compute Add On billing.
• Standard — custom pricing: Includes up to five full platform users, ticketed support, a two-business-day support response SLA, and SAML single sign-on. It suits smaller teams that need those access and support provisions; the five-user ceiling may constrain broader platform use.
• Pro — custom pricing: Includes unlimited full platform users, a two-hour critical initial support response SLA, and Data Plus eligibility. It fits teams that need broader user access and faster critical support without the Enterprise plan's specified compliance eligibility.
• Enterprise — custom pricing: Includes unlimited full platform users, FedRAMP Moderate and HIPAA eligibility with Data Plus, priority ticket routing, and a one-hour critical initial support response SLA. It is the relevant tier for organizations needing those eligibility and support terms, but comes with custom pricing.

Because IAST analysis uses the optional Compute Add On, the free platform plan should not be mistaken for free IAST analysis.

Platforms

New Relic IAST targets web applications and is delivered through agents for Go, Java, Node.js, and Ruby. It supports API testing, authenticated testing, and CI/CD integration. Agent-based deployment is most convenient for organizations already using New Relic APM; the four-language limit is a material exclusion for teams with other application stacks.

Who it's for

This is a good fit for DevOps and security teams that want continuous application security testing across development, especially when they already use New Relic APM and Vulnerability Management. Teams that need exploit evidence, remediation details, and links to CI/CD or ticketing workflows can get a coherent runtime process from those capabilities.

It is a weaker fit for teams using unsupported languages, organizations unwilling to adopt New Relic agents, or buyers who need a predictable public IAST price. Usage-based Compute Capacity Unit billing may also make it less suitable where a fixed analysis budget is essential.

Pros and cons

• Pro: Attack simulation can produce proof of exploit without code changes, helping teams focus on vulnerabilities with evidence of exploitability.
• Pro: Guided remediation supplies code and request-level context, including stack traces, HTTP traces, URLs, exploit mechanisms, and parameters.
• Pro: Integration with Vulnerability Management, CI/CD pipelines, and ticketing supports continuous workflows from discovery toward remediation and verification.
• Con: Agent support is limited to Go, Java, Node.js, and Ruby, excluding other language stacks.
• Con: IAST analysis incurs optional Compute Add On charges based on consumption, and its price is available on request rather than as a public fixed amount.

Alternatives

Compare interactive application security testing software if you want to consider a wider set of products.

• Aikido CSPM is worth considering if a freemium option across API, desktop, web, and operating-system platforms is a better fit.
• HCL AppScan may suit teams seeking a free CodeSweep download with an on-prem GitHub extension and SAST scanner, or a product with a free trial.
• Waratek IAST is an alternative for buyers who want a free trial of a paid IAST product, with Linux, self-hosted, web, and Windows platform support.
• DongTai IAST is the alternative to consider for a free, open-source self-hosted deployment via Docker Compose or Kubernetes.
• Contrast Assess is another paid application security option.
• Veracode DAST is a paid option for web applications and APIs, with a free trial.
• NowSecure Platform is a paid alternative with pricing by demo or order form.
• Black Duck Seeker is another paid option for Linux, macOS, web, and Windows.

Verdict

Choose New Relic IAST if your team uses New Relic agents with Go, Java, Node.js, or Ruby applications and wants attack validation connected to remediation workflows. Its strongest reason to buy is the combination of exploit evidence and actionable runtime context. Look elsewhere if your language stack is outside its coverage or you need a predictable public price for analysis.