New Relic IAST review
Focused web IAST with exploit validation, remediation context, and CI/CD integration.
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
New Relic IAST is an interactive application security testing capability within the New Relic observability platform. It is designed for DevOps, engineering, and security teams that need to assess running web applications in non-production environments. Using New Relic APM agents, it analyzes APIs, method calls, and traces while simulating attacks to identify vulnerabilities that can be exploited. Its focus is validated findings rather than static issue lists, with proof-of-exploit context helping teams distinguish actionable risks.
The feature set centers on application insight and remediation. Runtime analysis is paired with CVSSv3 severity scoring, code-location details, and stack-trace context, giving developers information for investigating and fixing findings. Coverage analysis spans APIs, methods, and traces, while authentication testing, API testing, scan scheduling, and duration controls support different assessment workflows. Teams can also exclude selected APIs or parameters, which helps shape testing around the application under review.
New Relic IAST fits organizations already using New Relic APM agents and wanting security checks connected to existing delivery processes. It supports CI/CD pipelines and ticketing systems, making findings easier to route into development workflows. IAST is billed through New Relic’s optional Compute Add On, with usage calculated in Compute Capacity Units, rather than presented as a standalone IAST price. The capability is web-focused and should be run only in non-production environments, so teams seeking broader runtime targets or production testing should choose an alternative. For teams prioritizing validated web findings, remediation context, and observability-platform alignment, it is a focused option.
New Relic IAST pros and cons
- Where it wins
- Validates exploitable vulnerabilities with attack simulations and proof-of-exploit context
- Adds CVSSv3 scoring, stack-trace context, and guided remediation details
- Supports API testing, coverage analysis, and CI/CD integration
- Where it doesn't
- Targets web applications rather than broader runtime environments
- IAST runs only in non-production environments
- Billed through Compute Capacity Units via an optional Compute Add On
New Relic IAST fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update