Scan Policy Performance
Performance testing results for Traceable's eight predefined API Security Testing policies, across Replay and DAST traffic types.
Traceable's API Security Testing (APIST) provides you with a set of predefined scan policies you can use without defining your own attack selections. Each predefined policy bundles a fixed set of test plugins chosen for a specific testing requirement, so you can start scanning without deciding which individual attacks to enable.
Predefined policies appear alongside your own policies under Testing → Policies. For more information on predefined policies, see Policies. Traceable measures the performance of predefined policies to help you anticipate scan behavior before running one in your own environment.
What you will learn from this topic
By the end of this topic, you will be able to understand:
What you need in place before running a scan with a predefined policy.
How predefined policies perform as API counts increase, according to traffic type.
Performance testing
The performance results provide a reference as API counts increase. They are based on controlled testing under realistic performance conditions. The results highlight how scan duration and test-case count scale across policies, helping you select the right policy and traffic type for your use case.
Scope
The following table defines the scope of the testing:
Environment
Production-like benchmark environment
Traffic type
Replay, DAST
API counts
10, 20, 40, 80
Policies
Eight predefined policies
Auth hook
Enabled on echo app
Runners
1 (to isolate variables)
Fixed test configuration
The following parameters were held constant across all runs, ensuring comparable results:
App
echo (perf-echo)
echo
Pipeline test_type
perf_replay
perf_quick_live
policy_type
Built-in name
Built-in name
API latency
200 ms
200 ms
Authentication
Enabled
Enabled
Request headers
5
5
Request body
20
20
Request query
5
5
Scenarios per API
40
40
API buffer %
25%
25%
Scan execution threads
40
40
CLI version
2.7.0 or later
2.7.0 or later
Runners
1
1
Runner configuration
2 CPU, 4Gi Memory
2 CPU, 4Gi Memory
Environment
Production
Production
Results
The test results show the execution times and the number of test cases generated as the API count increases, according to the traffic type.
Replay scan
The following tables show the performance results of the 8 predefined policies for Replay scans:
DAST scan
The following tables show the performance results of the 8 predefined policies for DAST scans:
Last updated
Was this helpful?