Static application security testing

I think in the new environment, you're able to do things significantly quicker than you were previously.

Like, I remember doing pen tests back in the day where you were asked to do source code reviews or at least code-assisted pen tests, and you'd have to use one of the SAST scanners, the static code analysis tools that was out there and was available, but it was always, it was always a headache.

I don't think anybody...

Like, when I ran a pen testing team over at Context, nobody enjoyed doing that security, like, code review side of things.

to replace the third-party code scanning tools that we're using right now.

Because we're using some well-known third-party code scanning tools that have both DAST and SAST, so Static Application Security Testing and Dynamic Application Security Testing.

And the dynamic one is like, okay, you're running here, let's do a pen test on it.

And the static one is, okay, here's your code running through a static code analyzer.

I would say half the floor was like AI SOC.

And so how do you define your moat or your differentiation to stand out and solve problems? So we currently support like API testing, web app testing, SAST and DAST validation, and then LLM chatbots.

We believe strongly in like human in the loop and that, and I'll give you a good example.

We've benchmarked against different solutions out there, both open source and commercial.

And I think year over year, as within the OWASP top 10, we've seen like BOLA and IDOR move up the chart, that this is the opportunity that presents itself is really we're talking about authorization level vulnerabilities from the DAST side.

And then AI SAST to me is the same logic, but applied to like code analysis.

So it's really about getting the maximum value out of like a contextual understanding of your application.

Okay, so does AI pen testing imply agentic? Like, are these things synonymous?

And the question, like, could...

Could OpenAI or Anthropic make a, I'll just use like sneak check marks, whoever, like could they make one of those solutions? Sure.

But I don't like AI SAST, which is what they currently have the closest version of, is still just one slice of the alphabet soup that you named.

And so I just have a hard time believing that they're going to in a timely manner, expand across that entire suite of offerings.

It changes is how you are looking and defining your, your security strategy, right? How you build a plan, how you are executing at that, and you need to look at from different angle.

We look at the AppSec, the traditional AppSec with SCA and SAST, right, infrastructure and code containers and such, and then comes the AI capabilities.

Again, this is runtime.

It's guardrail, it's, it's red teaming, it's, um, prompt injection and, uh, jailbreaking, right? This is a completely different angle that you need to plan and act upon.

And so I've just been shocked by the number of teams who are willing to rethink their entire security program in light of AI.

They're like, do I even need a SAST SCA scanner? Like, what does a scanner even do now that we're deploying code so quickly in an entirely different way? And it's leading them to rethink almost every aspect of their security program.

And there's such a willingness to throw out old tools, adopt new ones, and figure out the right stack that it's really been pretty crazy to see how quickly it's happened.

And where are you at in that throwing out old tools kind of journey? Because it is something that I think from the vendor perspective, I put my little vendor hat on.

And SaaS is still important.

But I think if we just remove all of that and we had to do it...

Is there still a world where SAST SCA scanning is needed? Is it more important? Is it morphed in? How does that future exist?

It's so much of the goal of Latio as a whole is to provide people tailored recommendations for their environment.

Go ahead, Ken.

Just a question around where are the vulnerabilities coming from? Are these like you're doing nightly or weekly scans and these are SCA vulnerabilities or you're doing those same scans in container vulnerabilities or is it SAST vulnerabilities, DAST vulnerabilities? What's kind of the general breakdown that we're talking about?

Yeah, it's everything so.

Our most is the detections that we have put into place, so we leverage our bug bounty to.