(Sandra Oliver joined SinClare Soft Pvt. Ltd. as a DevSecOps engineer in January of 2010. Her organization develops software and web applications…

Active IAST combines runtime agent monitoring with active security testing through a web scanner. The solution Sandra uses has both components: an active scanner that probes the application externally while an internal agent monitors the application's behavior and pinpoints vulnerabilities in the code. This dual approach of active scanning with runtime instrumentation is characteristic of Active IAST, which provides comprehensive security analysis by correlating external attack patterns with internal code execution paths.

B. Semi-passive IAST: This category doesn't exist in standard IAST taxonomy.

C. Semi-active IAST: Not a recognized IAST classification in industry standards.

D. Passive IAST: Only monitors runtime without active scanning component described.

3. References:

1. Gartner (2019). "Magic Quadrant for Application Security Testing" - Section on IAST Technologies, pp. 8-10

2. NIST SP 800-95 (2007). "Guide to Secure Web Services" - Chapter 4.2 on Runtime Security Testing

3. OWASP Testing Guide v4.0 (2014). "Interactive Application Security Testing" - Section 4.12.1

4. IEEE Computer Society (2017). "Runtime Application Self-Protection and Interactive Testing" - DOI: 10.1109/MSP.2017.3681052

5. Software Engineering Institute, Carnegie Mellon (2018). "DevSecOps: Integrating Security Testing" - Technical Note CMU/SEI-2018-TN-002, pp. 23-25

1. Gartner “Magic Quadrant for Application Security Testing”, 2014, §“Interactive AST”, p.11.

2. OWASP, “IAST – Passive vs Active Modes”, OWASP Wiki (2020-12-03), ¶3-4.

3. IEEE Security & Privacy, Vol. 15(4), 2017, “Interactive Application Security Testing”, pp. 80-83, DOI:10.1109/MSP.2017.3151346.