HCL AppScan IAST monitors application runtime behavior during functional and QA testing to detect security vulnerabilities. It uses patented algorithms for Java and .NET to track data flow and validate findings, reducing false positives compared to traditional IAST scanners.
The technology originated from IBM Security AppScan before HCL Technologies acquired the product line from IBM in 2019. It is available through AppScan on Cloud (SaaS) and AppScan Enterprise (on-premises).
What is HCL AppScan IAST?
The IAST agent deploys on your application’s web server and monitors traffic passively. As system tests or DAST scans send requests, the agent watches what happens inside the application — requests, call stacks, variables — and reports vulnerabilities it finds. Unlike a DAST scanner that only sees HTTP responses, the agent sees inside the application, providing code locations, URLs, and specific vulnerable entities like parameters, headers, or cookies.
Sessions run indefinitely until manually stopped or the agent disconnects.
Key Features
| Feature | Details |
|---|---|
| Java Support | Tomcat 7+, WebSphere 8.5+, JBoss/WildFly 10+, WebLogic 12+, Jetty, Quarkus (JRE 1.8.144+) |
| Java Frameworks | Spring 5/6, Struts, Resteasy, Vert.x 3/4 |
| .NET Support | Framework 4.5-4.8, .NET 5-9, Core 3.1 on IIS 7+ or Kestrel |
| Node.js Support | Express 4 with ECMAScript 6 |
| PHP Support | 7.4, 8.1, 8.2, 8.3 |
| System Requirements | Minimum 2 CPUs, 8 GB RAM (recommended: 4 CPUs) |
| Deployment Models | AppScan on Cloud (SaaS) and AppScan Enterprise (on-premises) |
| Session Duration | Indefinite (runs until manually stopped) |
Passive Runtime Monitoring
The agent monitors traffic sent to the application and reports vulnerabilities as they occur. It doesn’t generate its own test traffic. You drive the application through system tests, manual exploration, or DAST scans, and the agent catches vulnerabilities in the code paths exercised.
This means IAST adds no extra time to your testing. The security monitoring happens alongside whatever testing you already do.
Managed Code Execution for .NET
The .NET agent runs entirely in managed code without disabling JIT optimizations. This keeps performance impact low while maintaining full visibility into both custom application code and framework interactions.
API Discovery
The IAST agent catalogs all APIs exercised during testing. This helps security teams maintain accurate API inventories and catch undocumented endpoints.
Getting Started
When to Use HCL AppScan IAST
HCL AppScan IAST fits enterprises with established Java and .NET portfolios, particularly those already using AppScan for SAST or DAST. The auto-correlation across testing types is a major draw for reducing remediation workload.
The broad Java server support (Tomcat, WebSphere, JBoss, WebLogic, Jetty, Quarkus) makes it a good fit for complex enterprise environments. If you need support for languages like Python, Go, or Ruby, consider Contrast Assess or Seeker IAST.
