Waratek IAST

Overview

Waratek IAST is runtime application security testing for Java applications, aimed at teams that want vulnerability findings while their normal tests run. It is most compelling for engineering and QA groups with an established test suite; the Java-only scope and per-application Team pricing make it a specialized choice.

Key features

An agent instruments the application and observes data flows and execution paths in real time. QA teams can generate security insights through functional tests or automated suites instead of scheduling a separate security scan. That is a practical fit for teams with regular test runs, but the analysis is bounded by the paths those tests actually exercise.

Findings include the exact code line, a full stack trace, and the data flow that led to the vulnerability. This context gives developers a concrete route from alert to investigation. Waratek says it analyzes compiled bytecode or binaries, so access to source code is not required.

Waratek reports a 100% true positive rate, 0% false positive rate, and an OWASP Benchmark score of 100. Those are strong accuracy claims, but they do not change the product’s Java focus: teams seeking coverage for applications in other languages will need another tool.

Starter includes basic CI/CD integration. Team adds collaboration features and SSO / SAML; its Jira and Slack integrations are marked Coming Soon, so buyers should not treat them as current workflow capabilities. Enterprise lists advanced CI/CD plugins, custom rulesets, and software composition analysis as Coming Soon as well.

Pricing

Starter is $0.00 per free, offered as a free trial that can be converted to a purchase order. It covers one application per organization, with full IAST runtime analysis, basic CI/CD integration, standard vulnerability reporting, and email and knowledge base support. The single-application cap and trial terms make it suitable for evaluating the workflow, not a broad ongoing rollout.

Team costs $2,499/ month and includes three applications, with scale-up to five. Each of up to two additional applications costs +$833/mo. It adds team collaboration, SSO / SAML, and email, chat, and knowledge base support with a 48-hour maximum response. This is the paid fit for growing engineering and QA teams that can justify the application limits; the cost rises with each added application, and two advertised integrations are not yet available.

Enterprise has custom pricing and custom or unlimited applications. It lists a dedicated success manager, priority support, and custom onboarding with a same-business-day maximum response, alongside the Coming Soon features noted above. Its stated audience is mid-market to large enterprises that need a larger deployment and higher-touch support.

Platforms

Waratek describes its application security platform as serving Java applications. Documentation describes a Portal SaaS option and an on-prem Portal Dedicated deployment. The listed platforms include Linux, Windows, web, and self-hosted; those options offer deployment flexibility, but do not broaden language coverage beyond Java.

Who it's for

Starter is positioned for software and security engineers who want to assess runtime analysis on one application. Team is aimed at growing engineering and QA teams running repeatable functional or automated tests. Enterprise targets mid-market and large organizations seeking custom application capacity and dedicated support. It is a poor fit for teams that need multi-language coverage or want findings independent of their test execution.

Pros and cons

• Actionable findings: Code-line, stack-trace, and data-flow context can help engineers investigate issues directly.
• Fits existing QA runs: Security insights are generated during standard tests, avoiding a separate scan phase.
• No source-code access required: Bytecode and binary analysis may suit organizations that restrict source access.
• Narrow language scope: Java-only coverage rules it out as a single solution for applications written in other languages.
• Cost scales by application: Team starts at $2,499/ month for three applications, with per-app charges for expansion.
• Some plan capabilities are forthcoming: Jira and Slack, plus several Enterprise features, are marked Coming Soon.

Alternatives

Consider Aikido CSPM if a free plan and broader platform coverage matter more: its free Developer plan includes two users, 10 repositories, two container images, one domain, one cloud account, and 10 AI AutoFixes per month. HCL AppScan is worth considering for a free on-prem GitHub extension with a SAST scanner covering more than 35 languages, or if a free trial is preferable.

DongTai IAST is an option for teams seeking a free, self-hosted IAST deployment through Docker Compose or a Kubernetes cluster. New Relic IAST may suit teams that value a free tier with 100 GB of monthly data ingest, one free full platform user, unlimited basic users, and 50+ capabilities.

Contrast Assess is another paid option. Veracode DAST is a paid alternative with a free trial and coverage for web applications and APIs. NowSecure Platform is a paid alternative with pricing by demo or order form. Black Duck Seeker is another paid option.

Browse more options in Interactive Application Security Testing Software.

Verdict

Waratek IAST is a strong candidate for Java-focused engineering and QA teams that want runtime findings tied to code and execution flow during their normal tests, without granting source-code access. Choose it when that workflow and detailed triage justify the Team price; look elsewhere if you need coverage beyond Java, broader application capacity at lower cost, or integrations that are still Coming Soon.