Interactive Application Security Testing (IAST) instruments running applications — via an in-process agent — to observe code execution, data flow, and framework behavior during functional or load tests, identifying real, exploitable vulnerabilities with full context (request, stack, data flow, impacted line). Core capabilities include low-overhead runtime instrumentation, vulnerability detection keyed to actually-executed code paths (not theoretical ones), true/false exploitability classification, integration with existing QA and load-test workflows, and rich debugging context (request → stack → vulnerable line). IAST complements SAST (static, pre-runtime) and DAST (external black-box): it sees what the code actually does at runtime without the blind probing of DAST. Leading vendors include Contrast Security, Seeker (Black Duck / Synopsys), Checkmarx IAST, Invicti, and HCL AppScan.