A method and device for detecting a malicious circuit on an integrated circuit (IC) device is provided. The method includes generating a plurality of test patterns on the IC. A scan test circuit and the plurality of test patterns are used to test don't care bits of a function under test on the integrated circuit. Scan out data from the scan test circuit is provided in response to the plurality of test patterns. The scan out data is stored in a memory on the integrated circuit. The scan out data is monitored over a predetermined time period. If it is determined that a characteristic of the scan out data has changed within the predetermined time period, an indication that a malicious circuit has been detected is output. The device includes circuitry for performing the method in the field.