March 2026 Summaries

AI-powered penetration testing tools are transforming the landscape of application security by automating tasks traditionally performed manually, such as reconnaissance, vulnerability discovery, exploit development, and reporting. While these tools offer impressive capabilities, such as chaining exploits and identifying vulnerabilities missed by conventional scanners, they are not a complete replacement for deterministic Dynamic Application Security Testing (DAST). The most effective security programs integrate periodic AI pentesting with continuous DAST to provide comprehensive coverage. Different AI pentesting tools excel in various areas, with some focusing on network and infrastructure testing while others target application and API security. Open-source tools like PentestGPT offer flexibility and transparency, ideal for research and learning, while commercial platforms like Horizon3 and Penligent provide infrastructure and support suited for ongoing security programs. The future of AI in penetration testing is moving towards agentic AI, where AI agents autonomously reason about security issues, though human oversight remains crucial to handle creativity and judgment. StackHawk complements AI pentesting by offering DAST scans in CI/CD pipelines, ensuring continuous security validation between periodic assessments.

JSON-RPC, a remote procedure call protocol using JSON for data exchange, presents unique security challenges due to its single-endpoint, method-based architecture which traditional REST-focused security measures do not fully address. As its adoption grows, especially in blockchain platforms like Ethereum, securing JSON-RPC services requires protocol-specific strategies such as method-level authorization, automated vulnerability testing, and enforcing Transport Layer Security (TLS) since JSON-RPC does not default to encrypted transport. Unlike REST, JSON-RPC routes all requests through a single HTTP endpoint, necessitating direct inspection of the request body and method fields to enforce access controls. Additionally, JSON-RPC’s flexibility in parameter data structures makes input validation crucial to prevent injection attacks. Security measures need to include rate limiting at multiple levels, generic error responses to avoid method enumeration, and the use of automated security testing tools like StackHawk to ensure vulnerabilities are caught during development. This approach helps address issues like batch request amplification, which could otherwise be exploited to bypass standard rate limiting, and method enumeration where attackers could map API surfaces by probing for available methods.

StackHawk has introduced support for JSON-RPC API security testing, addressing a gap in traditional security tools that often overlook this protocol. JSON-RPC, a lightweight remote procedure call protocol using JSON, is popular for its simplicity, but it shares common vulnerabilities with other APIs, such as SQL injection and cross-site scripting. JSON-RPC uses a single endpoint architecture, making it challenging for conventional scanners to detect method-specific vulnerabilities. StackHawk provides a solution by integrating JSON-RPC security testing into existing development workflows. The process involves configuring StackHawk to scan JSON-RPC APIs, running a scan, and reviewing findings, with the tool utilizing an OpenRPC schema to map the API's methods and parameters. The tutorial includes setting up a vulnerable JSON-RPC application for testing, creating a StackHawk application, configuring a YAML file for JSON-RPC, and running the scan using HawkScan. After the scan, results can be reviewed on the StackHawk platform, offering insights into vulnerabilities and providing remediation guidance. This advancement allows developers to include JSON-RPC security testing in their CI/CD pipelines alongside REST and GraphQL services.

AI is increasingly integrated into various applications, from customer support bots to code assistants, but often without rigorous security measures. This trend introduces unique vulnerabilities, such as prompt injection and model poisoning, which traditional security practices do not fully address. The OWASP LLM Top 10 outlines these risks, emphasizing the need for specific defenses like context isolation, output validation, and least-privilege access. To safeguard AI applications, developers should adopt a comprehensive security strategy that includes robust authentication, input validation, and rate limiting, alongside deploying AI gateways for centralized control and monitoring. Additionally, AI models should be treated as untrusted components, which requires implementing layered defenses and maintaining continuous testing and monitoring throughout the AI lifecycle. The text underscores the importance of integrating these security measures from the design phase through to production, ensuring AI systems remain secure in the face of evolving threats.

Joe Sullivan, a veteran in the security industry with experience at Meta, Uber, and Cloudflare, is joining StackHawk's board, drawn by the company's innovative approach to addressing the evolving security challenges in software development. With the rapid adoption of AI coding tools, software engineering has dramatically changed, accelerating code production and increasing challenges for security teams who need to address issues that aren't detected by traditional static analysis tools. Sullivan highlights the inadequacy of existing tools to handle vulnerabilities that manifest during runtime, emphasizing the need for solutions that effectively test software as it is executed. StackHawk, founded by Joni Klippert and Scott Gerlach, offers a solution tailored for modern development pipelines by focusing on testing running applications for genuine risks, not just in production environments. The company leverages AI to enhance the accessibility and power of runtime testing, aligning with the industry's shift towards handling security post-execution, and Sullivan believes StackHawk's approach is essential for the future of software security.

The AI-Driven Development Lifecycle (AI-DLC) is revolutionizing the software development lifecycle by integrating AI into every phase, from planning to deployment, fundamentally altering how software is created and secured. This transformation, formalized by AWS and echoed by companies like Microsoft and CircleCI, emphasizes increased velocity with AI taking a more active role as a collaborator rather than just a tool. AI's involvement leads to faster code generation, continuous testing, and more frequent deployments, but it also creates challenges for security teams that need to adapt quickly to keep pace with the rapid changes and expanding attack surfaces. The shift necessitates new approaches in application security, emphasizing early discovery, pipeline-integrated testing, and continuous visibility to effectively manage the security implications of AI-accelerated development processes. As AI compresses traditional development phases and blurs boundaries, the industry must collaboratively ensure that security measures evolve in tandem with these advancements to maintain robust protection in an increasingly automated environment.

Engineering teams often excel in REST API security testing due to well-defined structures and tools like OpenAPI specifications that facilitate automated scanning and vulnerability identification. However, when it comes to WebSockets, the absence of standardized specifications, along with their stateful, bidirectional nature, poses unique challenges. Unlike REST APIs, WebSockets maintain persistent connections and allow for freeform messaging, which complicates automated testing and requires a deeper understanding of application-specific protocols. WebSocket security testing demands manual efforts such as validating Origin headers, ensuring authentication and authorization on a per-message basis, and implementing robust input validation and connection limits to prevent vulnerabilities like Cross-Site WebSocket Hijacking (CSWSH). While the underlying vulnerability categories remain similar across both protocols, the methods for testing them differ significantly, necessitating a tailored approach to WebSocket security that complements existing REST API testing practices.

Dynamic application security testing (DAST) has evolved from being a slow, production-only activity to a versatile, fast, and integral part of the CI/CD pipeline, enabling security testing at multiple stages of development. Modern DAST tools, designed for API-first and config-as-code environments, can now provide real-time feedback to developers, addressing the increased risks posed by AI-assisted rapid code generation. These tools allow for comprehensive testing not only in production environments, where testing is limited to non-invasive checks, but also in staging, CI/CD pipelines, and even at the developer's workstation. Each stage of testing has its own set of constraints and focuses, from read-based checks in production to full exploitation attempts in staging, and from smoke tests in pipelines to comprehensive local testing during code creation. This multi-stage approach is crucial for detecting a wide range of vulnerabilities, including authorization bypasses and business logic flaws, and ensures that security issues are addressed early when they are easier and cheaper to fix. StackHawk exemplifies this shift-left strategy by enabling DAST across all development stages, aiming to catch vulnerabilities early and integrate security feedback into the developer workflow, ultimately reducing the remediation cost and window of exposure.

As the integration of Large Language Models (LLMs) into applications becomes widespread, traditional application security tools fall short in addressing the unique vulnerabilities these AI components introduce. LLM security involves safeguarding applications from risks like prompt injection, context poisoning, and improper output handling, which are not typically detected by standard security testing methods. The OWASP LLM Security Top 10 highlights these vulnerabilities, emphasizing the need for runtime testing that evaluates how applications behave with user interactions involving LLMs. Attackers exploit LLMs by manipulating natural language inputs, which can lead to data leaks, unauthorized actions, and bypassing security controls. To protect against these threats, organizations must implement robust input validation, output monitoring, and context isolation, while also conducting runtime testing to ensure defenses are effective under attack conditions. As LLMs become integral to customer-facing features, addressing these security challenges is crucial to prevent data breaches and service disruptions.