Waratek IAST

Overview

Waratek IAST is a runtime application security tool for Java software. It is most relevant to teams whose QA or automated tests already exercise the application and who want vulnerability findings within that workflow. Its code-level traces are useful; its language scope and per-application charges make it a focused rather than general-purpose choice.

Key features

An agent instruments the running application and tracks data flows and execution paths in real time. Findings arrive during ordinary functional testing, so teams do not need to schedule a separate security scan phase. That is a good fit for established test pipelines, but the analysis can only cover paths those tests actually run.

Each finding includes the exact code line, a full stack trace, and the data flow that led to the issue. This gives developers a concrete starting point for investigation rather than only a vulnerability label. Waratek analyzes compiled bytecode or binaries, so source-code access is not required.

Waratek reports a 100% true positive rate, 0% false positive rate, and an OWASP Benchmark score of 100. Those are strong accuracy claims, but they do not broaden the product beyond Java applications.

Starter has basic CI/CD integration. Team adds collaboration features and SSO / SAML; its Jira and Slack integrations are marked Coming Soon, so teams that depend on them should confirm availability before choosing the plan. Enterprise lists advanced CI/CD plugins, custom rulesets, and software composition analysis, also marked Coming Soon.

Pricing

PlanPriceWhat it includesStarterfree; free trial convertible to a purchase orderOne application per organization, full IAST runtime analysis, basic CI/CD integration, standard vulnerability reporting, and email and knowledge base support.Team$2,499/ monthThree applications, scalable to five at +$833/mo per additional app (up to two); team collaboration, SSO / SAML, and email, chat, and knowledge base support with a 48-hour maximum response. Jira and Slack integrations are Coming Soon.EnterpriseCustom pricingCustom or unlimited applications, a dedicated success manager, priority support, and custom onboarding with a same-business-day maximum response. Advanced CI/CD plugins, custom rulesets, and software composition analysis are Coming Soon.Starter is a no-cost trial, not a free plan, and its one-application cap makes it best for evaluating the workflow on a single project. Team is the published paid option for growing engineering and QA groups, but its included application count is modest and each of the next two apps adds $833/mo. Larger organizations can discuss Enterprise pricing, though several listed capabilities are still marked Coming Soon.

Platforms

Waratek’s application security platform is for Java applications. The product supports Linux, Windows, and web environments, with self-hosted deployment also available. Documentation describes a Portal SaaS option and an on-prem Portal Dedicated deployment, allowing teams to choose between hosted and dedicated portal setups.

Who it's for

Software and security engineers evaluating runtime findings on one application can start with Starter. Growing engineering and QA teams that need more application capacity, collaboration, or SSO / SAML are the intended Team audience. Mid-market and large enterprises can consider Enterprise for custom application capacity and higher-touch support, while checking that Coming Soon features meet their requirements before committing.

Pros and cons

Pro: Line-level findings, stack traces, and data-flow context give Java developers actionable clues for tracing issues.

Pro: Findings are generated during standard functional tests, avoiding a distinct security-scan phase in teams with suitable test coverage.

Pro: Bytecode and binary analysis avoids requiring source-code access.

Con: Java-only scope rules it out for teams seeking coverage across other application languages.

Con: Team starts at $2,499/ month for three applications, and expanding to five raises the monthly bill by up to $1,666.

Con: Jira, Slack, and several Enterprise capabilities are marked Coming Soon, limiting their value until they are available.

Alternatives

Compare interactive application security testing software if you want to survey the category before choosing a product.

HCL AppScan is a better fit for teams wanting a free SAST scanner through an on-prem GitHub extension, with coverage for 35+ languages.

Aikido CSPM suits teams looking for a free-forever developer plan with limits across users, repositories, container images, domains, and cloud accounts.

Veracode DAST is an option for teams seeking web-application and API testing with a live demo and a free trial.

Contrast Assess is another paid application-security option.

DongTai IAST is worth considering for teams that prefer a free, self-hosted IAST deployment through Docker Compose or Kubernetes.

Acunetix may suit teams seeking a one-time agentic pentest priced at $500 per pentest, capped at one application and its API suite.

New Relic IAST is a possible alternative for teams interested in a free plan with 100 GB of monthly data ingest and one free full platform user.

NowSecure Platform is another paid platform to consider.

Verdict

Waratek IAST is a sensible choice for Java teams that want runtime vulnerability findings embedded in their existing test runs, especially when code-level traces and avoiding source access matter. Its main constraints are the narrow language scope and Team’s per-application cost; look elsewhere if you need multi-language coverage, a lasting free tier, or integrations and Enterprise features that are not yet available.