New Relic IAST

New Relic IAST checks running applications for exploitable vulnerabilities and connects findings to remediation workflows. It is best suited to DevOps and security teams using New Relic agents with Go, Java, Node.js, or Ruby services. Its strongest appeal is runtime evidence paired with remediation context; analysis carries usage-based charges, and its language coverage is narrow.

Overview

Designed for continuous application security testing across the development lifecycle, IAST simulates real-world attacks and can provide proof of exploit without code changes. Integration with New Relic Vulnerability Management connects vulnerability discovery with fixing and verification, making it a better fit for teams seeking an ongoing workflow than a standalone scan.

New Relic was founded in 2008 and is headquartered in San Francisco. Customers can choose data centers in the United States or European Union. New Relic lists FedRAMP, HIPAA-enabled capabilities, ISO 27001, ISO 42001, PCI DSS, SOC 1, SOC 2, and TISAX certifications or attestations.

Key features

Runtime evidence and remediation

New Relic APM agents deliver IAST, which can be enabled through a configuration change. That is a practical path for teams already instrumenting applications with New Relic, but a less attractive proposition for organizations that would adopt its agents solely for IAST. Support covers Go, Java, Node.js, and Ruby; other language stacks are outside its stated reach.

Dynamic assessment validates vulnerabilities by simulating attacks and providing proof of exploit. IAST is designed to produce fewer false positives than traditional application security tools, a useful distinction for teams trying to limit time spent triaging findings. Guided remediation supplies code location, stack trace, HTTP trace, encountered URLs, exploit mechanism, and parameters, giving developers specific leads for investigation and repair.

Workflow and risk context

Findings receive CVSS version 3 severity scores in Low, Medium, High, and Critical ranges. CI/CD pipeline and ticketing integrations support routing findings into development and response processes. New Relic also offers more than 780 integrations across applications, logs, and infrastructure data, which may matter to teams consolidating monitoring integrations in its ecosystem.

Authenticated testing and API testing are supported, and instrumentation is agent-based. The optional Compute Add On bills IAST according to Compute Capacity Units consumed during analysis, so usage rather than a fixed IAST price determines that portion of cost.

Pricing

New Relic’s platform plans have custom pricing apart from Free, while IAST analysis is billed through the optional Compute Add On based on consumed Compute Capacity Units. The Free plan costs nothing and includes 100 GB of data ingest per month, one free full platform user, unlimited basic users, and more than 50 capabilities. It offers a way to use the platform without a plan charge, but the one-full-user allowance may constrain teams that need broader full-user access.

Standard has custom pricing and includes up to five full platform users, ticketed support, a two-business-day support response SLA, and SAML single sign-on. It suits smaller teams needing support and single sign-on, but caps full platform access at five users. Pro has custom pricing, unlimited full platform users, a two-hour critical initial support response SLA, and Data Plus eligibility. Enterprise has custom pricing and adds unlimited full platform users, priority ticket routing, a one-hour critical initial support response SLA, and FedRAMP Moderate and HIPAA eligibility with Data Plus. Pro and Enterprise are more appropriate when user limits or response commitments matter, while Enterprise is the fit for those eligibility requirements.

Plan prices, seat limits, or trial terms beyond these stated inclusions are not provided here; weigh the usage-based analysis charge separately from the platform plan.

Platforms

IAST targets web applications and runs through New Relic agents. It supports API testing and authenticated testing, with CI/CD integration for teams embedding checks in delivery pipelines.

Who it's for

Choose New Relic IAST if your team uses New Relic agents and builds services in Go, Java, Node.js, or Ruby, particularly when exploit validation and actionable runtime details are priorities. Its lifecycle integration and workflow connections suit DevOps and security teams aiming to continuously find, fix, and verify high-risk vulnerabilities. Look elsewhere if your application stack falls outside its four supported languages or you need predictable analysis costs independent of usage.

Pros and cons

• Exploit proof without code changes: dynamic assessment can validate real-world exploitability and help prioritize actionable findings.
• Useful remediation context: code locations, traces, URLs, exploit mechanics, and parameters give developers concrete investigation leads.
• Lifecycle and workflow fit: Vulnerability Management, CI/CD, and ticketing integrations connect findings to ongoing work.
• Limited language coverage: support is confined to Go, Java, Node.js, and Ruby.
• Usage-based analysis billing: Compute Capacity Unit consumption can make analysis costs depend on runtime use rather than a fixed IAST fee.

Alternatives

Compare interactive application security testing software to review the category. Contrast Assess is a paid alternative with API, Linux, macOS, self-hosted, web, and Windows platforms; consider it when that platform coverage better matches your environment.

DongTai IAST offers a free, open-source self-hosted deployment at no cost, with Docker Compose single-node or Kubernetes cluster deployment, making it a fit for teams seeking a self-hosted no-cost option. Waratek IAST is a paid alternative with a free trial and support for Linux, self-hosted, web, and Windows. Black Duck Seeker is another paid option, with Linux, macOS, web, and Windows platforms.

HCL AppScan has a freemium offer: CodeSweep is a free on-prem GitHub extension with a SAST scanner for more than 35 languages, so it is worth considering when free extension-based SAST or broader language coverage is the priority. Acunetix is a paid alternative with a free trial and web, API, Linux, self-hosted, and Windows platforms. OpenText Fortify on Demand is a paid web-platform alternative. NowSecure Platform is a paid option for Android, iOS, API, and web environments, with pricing by demo or order form.

Verdict

New Relic IAST is a strong choice for DevOps and security teams already using its agents on supported languages: attack validation, concrete remediation context, and lifecycle integration make findings more actionable. Choose another tool if your stack is outside Go, Java, Node.js, and Ruby, or if usage-based analysis billing does not suit your budgeting needs.