Scan Policy Performance

Traceable’s API Security Testing (APIST) provides you with a set of predefined scan policies you can use without defining your own attack selections. Each predefined policy bundles a fixed set of test plugins chosen for a specific testing requirement, so you can start scanning without deciding which individual attacks to enable.

Predefined policies appear alongside your own policies under Testing → Policies. For more information on predefined policies, see Policies. Traceable measures the performance of predefined policies to help you anticipate scan behavior before running one in your own environment.

Note

The performance figures later in this topic are based on Replay scans.

What you will learn from this topic

By the end of this topic, you will be able to understand:

• What you need in place before running a scan with a predefined policy.

• How predefined policies perform as API counts increase.

Performance testing

The performance results provide a reference as API counts increase. They are based on controlled testing under realistic performance conditions. The results highlight how scan duration and test-case count scale across policies, helping you select the right policy for your use case.

Scope

The following table defines the scope of the testing:

Fixed test configuration

The following parameters were held constant across all runs, ensuring comparable results:

Results

The test results show the execution times and the number of test cases generated as the API count increases. The following tables show the performance results of 8 predefined policies for scans: