Overview of AppSec IAST Benchmarking
masterThis benchmark suite measures the performance overhead of Datadog's Interactive Application Security Testing (IAST) feature. It drives real Express.js request handling with the tracer loaded to compare the per-request taint-tracking overhead across different configurations:
- IAST Off vs. On: Comparing baseline performance against IAST-enabled performance.
- Sampling Modes: Evaluating performance with
default samplingversusalways-activeIAST. - Endpoint Types: Measuring overhead on both a non-vulnerable endpoint and an endpoint containing a command-injection sink that triggers vulnerability reporting.