Using IAST to Unlock the Benefits of DevSecOps
summary
IAST adds bytecode/runtime instrumentation to the app server (think New Relic-style agents) to trace data flows and catch real exploits like SQL injection by following HTTP params into queries, not by pattern matching. Claims: 16 seconds on the OWASP Benchmark versus 40–90+ minutes for other tools; mean time to remediate <1 week versus ~290 days for SAST; new vulnerabilities drop from 10/month to <1/month. Also produces runtime SBOMs, route coverage, library usage and architecture maps, and deploys via Kubernetes operators at scale.
AI-written summary · about
chapters (14)
- 0:00Intro
- 2:04Public expectations don't match reality
- 5:04DevSecOps will fix everything
- 8:37Instrumentation changes everything
- 12:10Example: Detecting SQL injection
- 13:45IAST
- 17:42Runtime vulnerability snapshots
- 19:09Runtime library analysis
- 21:07Runtime route coverage
- 23:13Runtime architecture diagrams
- 24:50Deploying IAST at scale
- 25:55DevSecOps - Getting secure code moving
- 29:33Metrics that matter
- 32:53Outro
related talks
43mJumpstarting Your DevSecOps Pipeline with IAST and RASP
22mSecurity for Developers
43mDevSecOps on steroids - Powered by your Selenium tests
25mHow to select between SAST, DAST, IAST, RASP, and AST
21mAdding DAST to CI/CD, Without Any Losing Friends
51mSecurity Observability 101: Thinking Inside the Box!
19mApplication Security at High Velocity
52mApplication Security at DevOps Speed and portfolio scale