November 2025 Summaries

Prompt injection attacks pose significant threats to AI-powered applications, as they exploit the intelligence of large language models (LLMs) rather than traditional code vulnerabilities. These attacks, highlighted as the top concern in the OWASP Top 10 for LLM applications, can lead to unauthorized data access, system manipulation, and compromised decision-making. They occur when user inputs intentionally alter an AI's behavior, akin to SQL injection but targeting the AI's reasoning processes. With AI integration outpacing security measures, continuous testing and monitoring during development are crucial to mitigate these risks. Effective defense strategies include architectural constraints, input and output filtering, segregating external content, enforcing human oversight, and automated runtime testing. By adopting a comprehensive, multi-layered security approach, organizations can safeguard against prompt injection attacks and protect their data and systems while leveraging AI's capabilities.

In the evolving landscape of modern software development, the partnership between StackHawk and Cycode aims to elevate application security programs by integrating comprehensive security testing with centralized visibility and remediation capabilities. StackHawk's Dynamic Application Security Testing (DAST) is designed to identify and fix exploitable vulnerabilities in pre-production, seamlessly integrating with developers' tools to deliver contextual fixes without hindering development speed. However, runtime findings often remain isolated, creating challenges in tracking vulnerabilities back to their source and prioritizing them amidst other security risks within the Software Development Life Cycle (SDLC). The collaboration with Cycode enhances this process by automatically ingesting StackHawk findings into its Application Security Posture Management (ASPM) platform, correlating them with SDLC metadata to enrich findings with context, and orchestrating remediation workflows. This integration offers complete traceability from runtime findings to the exact source code and developer responsible, unified visibility across security findings, and automated workflows to streamline the remediation process, ultimately enabling AppSec teams to address critical vulnerabilities with a risk-based prioritization approach.

In August 2025, a security researcher uncovered vulnerabilities in Intel's internal APIs, exposing the personal data of 270,000 employees due to broken authentication and security misconfiguration, common issues that automated API security testing could have detected during development. API security testing is crucial as APIs have become the primary attack vector for modern applications, and 99% of organizations faced API security issues in the past year, often delaying application releases. This testing process systematically examines API endpoints, authentication, and data handling to identify vulnerabilities before deployment, making use of methods like Dynamic Application Security Testing (DAST) which simulates real attacker interactions to find exploitable weaknesses. The guide emphasizes the need for continuous, automated security testing integrated into CI/CD pipelines, which allows for fast feedback and remediation, ensuring security does not hinder development speed but rather acts as a competitive advantage. It outlines practical steps to implement API security testing, including inventorying APIs, establishing API specifications, configuring authentication, running initial scans, integrating testing into CI/CD, and setting up remediation workflows, highlighting that addressing vulnerabilities during development is far more cost-effective than doing so in production.

Static and dynamic application security testing (SAST and DAST) are essential for maintaining application security, with SAST identifying vulnerabilities in code before deployment and DAST validating exploitable vulnerabilities in running applications. However, when these tools function independently, they create inefficiencies, such as duplicate alerts and a lack of context for developers, complicating prioritization and remediation efforts. To address this, the integration of Endor Labs' AI-Native SAST with StackHawk's DAST offers a solution by correlating static and dynamic findings, thus eliminating duplicate alerts and prioritizing vulnerabilities based on validated exploitability. This collaboration provides developers with consolidated alerts that include detailed context, such as code location and runtime exploitability, enabling them to focus on critical issues. As the pace of development increases and AI-generated code expands potential attack surfaces, this integration enhances security efforts by automating correlation and prioritization, reducing noise, and accelerating the remediation process.

Penetration testing and vulnerability scanning are both crucial components of a robust security program, each serving distinct roles and complementing one another. Vulnerability scanning is an automated process that identifies known vulnerabilities across an entire infrastructure by comparing systems against databases like the CVE, which allows for frequent and comprehensive monitoring but may result in false positives. In contrast, penetration testing involves skilled security professionals who simulate real-world attacks to exploit vulnerabilities, providing validated insights into actual risks and vulnerabilities that scanners might miss. While vulnerability scans are ideal for routine checks and immediate responses to new disclosures, penetration tests are best suited for in-depth assessments of critical systems and help confirm the exploitability of threats. Effective security strategies integrate both, using vulnerability scans to guide penetration testing priorities and employing modern DAST tools to enhance automated validation, ensuring vulnerabilities are addressed efficiently and comprehensively throughout the development lifecycle.

StackHawk has introduced new plugins within its runtime testing engine to detect five critical large language model (LLM) security risks from the OWASP LLM Top 10, including prompt injection, sensitive data disclosure, improper output handling, system prompt leakage, and unbound consumption. These risks have emerged as AI technology rapidly transforms application development, with LLM capabilities increasingly integrated into applications without traditional security reviews, creating new attack vectors. Unlike traditional application security (AppSec) tools, which are not equipped to address LLM-specific vulnerabilities, StackHawk's approach integrates into developer workflows to identify these risks early in the development process, thus teaching developers best practices for secure LLM integration. By focusing on runtime testing, StackHawk aims to address the unique security challenges posed by LLMs, ensuring that applications are protected in real-time and that security measures evolve alongside AI-driven development.

Black box testing is a software testing approach that validates an application's functionality from a user's perspective without examining its internal code structure. This method focuses on testing what the software does by interacting with inputs and outputs, making it particularly effective for identifying bugs, broken workflows, and security vulnerabilities that manifest when systems are tested as a whole. Black box testing is versatile and applicable to various testing types, including functional, security, non-functional, regression, acceptance, and compatibility testing. Techniques such as equivalence partitioning, boundary value analysis, decision table testing, state transition testing, and error guessing are employed to ensure comprehensive test coverage. Despite its advantages, such as not requiring programming skills and providing a user-centric perspective, black box testing has limitations, including limited code coverage and difficulty in diagnosing performance issues. To achieve full test coverage, it is often used in conjunction with white box testing, which examines the internal workings of the code. Best practices for effective black box testing include starting with clear requirements, prioritizing based on risk, combining multiple techniques, automating repetitive tests, using realistic test data, and testing in production-like environments. Continuous security testing through Dynamic Application Security Testing (DAST) tools, integrated into CI/CD pipelines, helps catch vulnerabilities early, providing immediate feedback on security issues.

As AI coding assistants accelerate development, the proliferation of applications and APIs creates challenges for Application Security (AppSec) teams, who struggle to discover and test these rapidly emerging assets, leading to concerns about unseen and untested attack surfaces. Dynamic Application Security Testing (DAST) often stalls at scale due to difficulties in identifying what needs testing and managing the configuration burden across numerous applications. This is compounded by the fact that many APIs and applications remain undiscovered until they are already in production, making traditional discovery methods insufficient. StackHawk addresses this visibility issue by integrating API discovery directly from source code, enabling real-time and proactive identification of APIs, microservices, and other components. This approach ensures that AppSec teams can focus on testing the most critical and relevant applications, minimizing wasted effort on irrelevant repositories and outdated configurations. By continuously generating OpenAPI specifications through code analysis and AI, StackHawk enhances DAST effectiveness, allowing organizations to maintain up-to-date coverage and demonstrate measurable improvements in security posture to leadership.