- Home
- Interactive Application Security Testing Software
- New Relic IAST
New Relic IAST
San Francisco, California, USA
What it is
New Relic IAST probes running application code for vulnerabilities that could be exploited, helping DevOps and security teams assess risk through the software development lifecycle. It works through New Relic APM agents and can be enabled with a configuration change. Dynamic assessment simulates attacks and can provide proof of exploit without code changes. Guided remediation can identify the code location, stack trace, HTTP trace, encountered URLs, exploit mechanism, and parameters involved. IAST is integrated with New Relic Vulnerability Management for finding, fixing, and verifying high-risk vulnerabilities. It assigns severity using CVSS version 3 across Low, Medium, High, and Critical ranges, and is designed to produce fewer false positives than traditional application security tools. Supported agent languages are Go, Java, Node.js, and Ruby. It supports authenticated and API testing, CI/CD pipelines, and ticketing systems. Analysis is billed through an optional Compute Add On based on Compute Capacity Units used during analysis. A free New Relic plan is listed; other plan pricing is available on request. New Relic lists data centers in the United States and European Union, and more than 780 integrations across application, log, and infrastructure data.
For and against
For
- Attack simulation can show proof of exploit without code changes.
- Guided remediation provides traces and exploit details.
- Supports Go, Java, Node.js, and Ruby.
- Integrates with CI/CD pipelines and ticketing systems.
- Findings use CVSS version 3 severity ratings.
Against
- IAST analysis is billed through an optional Compute Add On.
- Other plan pricing is available on request.
- Supported languages are limited to Go, Java, Node.js, and Ruby.
The verdict
New Relic IAST combines runtime vulnerability assessment with remediation details and integration into vulnerability management workflows. Teams should account for the optional Compute Add On when evaluating analysis costs.
Who it suits
New Relic IAST is intended for DevOps and security teams seeking continuous application security testing. It suits teams using supported languages and New Relic APM agents.
Plans and prices
Free
100 GB data ingest/month · 1 free full platform user · unlimited basic users · 50+ capabilities
Read 30 Sep 2026 · newrelic.com
Enterprise
Unlimited full platform users · FedRAMP Moderate and HIPAA eligibility with Data Plus · priority ticket routing · 1-hour critical initial support response SLA
Read 30 Sep 2026 · newrelic.com
Pro
Unlimited full platform users · 2-hour critical initial support response SLA · Data Plus eligibility
Read 30 Sep 2026 · newrelic.com
Standard
Up to 5 full platform users · ticketed support · 2 business days support response SLA · SAML single sign-on
Read 30 Sep 2026 · newrelic.com
On the record
- Audience
- IAST is intended for DevOps and security teams that need continuous application security testing across the software development lifecycle.newrelic.com · read 30 Sep 2026
- Billing
- IAST is billed through an optional Compute Add On based on Compute Capacity Units consumed during analysis.docs.newrelic.com · read 30 Sep 2026
- CI/CD and ticketing
- IAST supports seamless integration with CI/CD pipelines and ticketing systems.newrelic.com · read 30 Sep 2026
- Compliance
- New Relic currently lists FedRAMP, HIPAA-enabled capabilities, ISO 27001, ISO 42001, PCI DSS, SOC 1, SOC 2, and TISAX certifications or attestations.docs.newrelic.com · read 30 Sep 2026
- Data residency
- Customers can choose between New Relic data centers in the United States and European Union.newrelic.com · read 30 Sep 2026
- Deployment
- New Relic APM agents deliver IAST and it can be enabled through a configuration setting change.docs.newrelic.com · read 30 Sep 2026
- Exploit validation
- Dynamic assessment simulates real-world attacks and provides proof of exploit without requiring code changes.newrelic.com · read 30 Sep 2026
- False positives
- IAST is designed to provide fewer false-positive findings than traditional application security tools.docs.newrelic.com · read 30 Sep 2026
- Guided remediation
- Guided remediation can identify code location, stack trace, HTTP trace, encountered URLs, exploit mechanism, and parameters.newrelic.com · read 30 Sep 2026
- Integrations
- New Relic offers more than 780 integrations across applications, logs, and infrastructure data.newrelic.com · read 30 Sep 2026
- Purpose
- New Relic IAST probes running code for exploitable vulnerabilities to help prevent cyberattacks and breaches.docs.newrelic.com · read 30 Sep 2026
- Severity scoring
- IAST assigns vulnerability severity using CVSS version 3, with Low, Medium, High, and Critical ranges.docs.newrelic.com · read 30 Sep 2026
- Supported languages
- IAST is available through New Relic agents for Go, Java, Node.js, and Ruby.docs.newrelic.com · read 30 Sep 2026
- Vulnerability management
- IAST is fully integrated with New Relic Vulnerability Management for continuously finding, fixing, and verifying high-risk vulnerabilities across the software development lifecycle.docs.newrelic.com · read 30 Sep 2026
