: Security resources are scarce, and practitioners need guidance in the effective and efficient usage of techniques and tools available in the cybersecurity industry for detecting and preventing the exploitation of vulnerabilities in software, as per the practitioners’ requirements. Two emerging tool types, Interactive Application Security Testing (IAST) and Runtime Application Self-Protection (RASP), have not been thoroughly evaluated against well-established counterparts such as Dynamic Application Security Testing (DAST) and Static Application Security Testing (SAST). The goal of this research is to aid practitioners in making informed choices about the use of Interactive Application Security Testing (IAST) and Runtime Application Self-Protection (RASP) tools through an analysis of their effectiveness and efficiency in comparison with other vulnerability detection and exploit prevention techniques and tools.This paper aligns with the ESEM audience as it provides an empirical evaluation of emerging software security testing techniques and tools IAST and RASP using a large, real-world system and a replicated, validated methodology. The study quantitatively analyzes the techniques and tools IAST and RASP effectiveness and efficiency, addressing a critical need for data- driven guidance in secure software engineering. Moreover, its contributions in experimental design, measurement, and comparative analysis make it well-suited for the ESEM audience interested security focused software engineering practices.