Dynamic application security testing

and although in some cases the certificates were self-signed, in others, where the applications were proprietary, the certificates were properly configured.

For the integrations, this company made use of periodic SAST, DAST, and CSA scans, so the encryption algorithms were also the most recent.

On top of that, breaking the certificate was not that simple.

Active monitoring would surely have detected any kind of attempt to break the encryption, so it was not too viable.

Figure 31 from the system card, titled Monitor Evasion Under Task-Guided Sabotage.

Six panels plot rates against chain of thought plus tool call tokens from 1,000 to 40,000 for GPT-5.5 in DAST gray, GPT-5.6 SOL in blue, and GPT-6 Astra in pink.

Side task success.

Astra sits between about 83 and 100% from 5,000 tokens upward.

We're seeing a weird overlapping dynamic now when you start to layer in AI into a continuous pen testing model, agentic AI, offensive AI.

pen testing is very different than the traditional DAST, which had its own isolated market for a long time.

It's also very different than the PTAS, which might go lower in the stack than the app layer and have a broader view of it.

These things are combining is what it really comes down to.

to replace the third-party code scanning tools that we're using right now.

Because we're using some well-known third-party code scanning tools that have both DAST and SAST, so Static Application Security Testing and Dynamic Application Security Testing.

And the dynamic one is like, okay, you're running here, let's do a pen test on it.

And the static one is, okay, here's your code running through a static code analyzer.

To their opinion, they've already pivoted twice.

They started at a CI-CD tool for API security, and they moved on to penetration testing and dynamic application security testing, DAST.

And now they're good.

So it's a small change to the technology, but they're leaders in AI penetration testing.

And James was on the show back in May 2024.

So if you want to go back and take a look at that episode to hear his security origin story, but also the title of that episode was, Is DAST Dead? But James, we do want to welcome you to the podcast, but also my favorite question to ask people right now is, what do you like to do that takes you away from technology, screens, just gets you outside? Like, is there something that gets you away from tech? Yeah, we have

three kids and a cat and a dog and nine chickens most recently.

And so we are usually busy with a mixture of kids activities plus animal activities and those things.

Visit Korgia.com. C-O-R-G-E-A dot com.

Corgea, one security platform for the entire SDLC.

But as I said in that first episode, we talked about, is DAST dead? And that brought lots of fire from a lot of different angles.

A lot of different people had a lot of feedback and comments on that one.