The graph is a simplified web application: a frontend talks to four API endpoints, each endpoint calls into one of two backend services, and both services share a database. A handful of edges in that graph are seeded with a hidden vulnerability (e.g. an unsanitized field that reaches a SQL query).
DAST sits entirely outside the application. It only ever sends requests to the endpoints it can see and reasons about vulnerabilities from the HTTP responses it gets back — it never reads the source. That makes surface-layer bugs easy to spot but leaves deep, backend-only flaws mostly invisible, so it converges slowly and misses coverage of what it cannot reach.
IAST runs an agent instrumented inside the running application. Every request's execution path — frontend → endpoint → service → database — is traced live, so a vulnerable sink is caught wherever it sits, with the exact taint path highlighted from input to sink. Detection is faster and far more complete because the agent has full internal visibility.
DAST: P(detect | surface) ≈ 0.55 P(detect | deep) ≈ 0.10 (per probe, black-box)
IAST: P(detect | any edge) ≈ 0.85 (per pass, taint-tracked, full visibility)
- Scan speed — how fast probes (DAST) or traffic passes (IAST) fire.
- Injected vulnerabilities — how many graph edges are seeded with a hidden flaw before the run.
- Coverage — the share of graph edges the current scan has actually touched.