April 2026 Summaries

Security teams are increasingly inundated with signals from various tools, including SAST, SCA, secrets detection, and cloud misconfigurations, which complicate their ability to manage risks effectively. The acceleration of AI-driven development further exacerbates this issue by increasing the volume of code, APIs, and potential vulnerabilities. Wiz offers a solution by consolidating security signals, particularly bridging the gap with Shift-Left DAST through integration with StackHawk. This integration allows StackHawk's pre-production dynamic application security testing findings to flow directly into the Wiz Security Graph, providing a unified view of application and cloud risks. By correlating DAST findings with infrastructure context, exposure data, and ownership, security teams gain actionable insights that prioritize vulnerabilities based on their full impact, facilitating faster remediation. The integration ensures that vulnerabilities are addressed before they become compounded with infrastructure-level exposures, helping teams to efficiently manage the backlog of open findings that grow as AI-generated code becomes more prevalent.

OpenAI's Codex Security is an application security agent designed to identify vulnerabilities in source code by leveraging a repository-centric approach that starts with threat modeling and automated validation, significantly reducing false positives and noise compared to traditional static application security testing (SAST) tools. While Codex Security is a substantial improvement for detecting code-level vulnerabilities, it does not replace dynamic application security testing (DAST), which is essential for identifying runtime vulnerabilities that arise from deployment configurations, broken authorization, and business logic flaws. The integration of Codex Security into workflows used by developers through the Codex web interface with ChatGPT enhances usability by providing contextual patches directly in the development environment. However, the system cannot exercise deployed applications or infrastructure, meaning vulnerabilities that only manifest at runtime, such as insecure configurations or broken object-level authorization, require DAST to confirm exploitability. The combined use of Codex Security for code analysis and DAST for runtime validation is recommended to comprehensively address potential security gaps, especially in environments accelerated by AI coding agents, which may introduce vulnerabilities that static analysis alone cannot fully mitigate.

AI-powered development tools, such as GitHub Copilot, are revolutionizing coding by significantly accelerating the process, but they also introduce new security challenges that require careful management. GitHub Copilot, an AI coding assistant developed with models from OpenAI and Anthropic, has transformed from an autocomplete tool into a comprehensive development platform used by millions worldwide. While Copilot enhances productivity by contributing to nearly half of its users' code, it also presents risks like replicating insecure patterns and introducing vulnerabilities due to its reliance on training data. Dynamic Application Security Testing (DAST), such as that provided by StackHawk, is essential for identifying runtime vulnerabilities in AI-generated code, which traditional static analysis tools might miss. Integrating StackHawk into development workflows allows for continuous, automated security testing that complements the speed of AI-generated code, ensuring security measures like authentication and input validation are correctly implemented. By balancing AI's rapid development capabilities with robust security practices through tools like StackHawk, developers can harness the power of AI while maintaining a strong security posture.

StackHawk has introduced automated security testing for remote MCP servers, which have rapidly become essential for connecting enterprise applications with AI services. MCP servers, which facilitate standardized communication using the JSON-RPC 2.0 protocol, have seen a massive increase in adoption due to their ability to unify various AI tools with existing services. However, their network accessibility raises significant security concerns, as they can expose organizations to familiar risks like SQL injection and server-side request forgery (SSRF), potentially compromising internal systems and user data. Prior to StackHawk's innovation, testing these servers was a blind spot for many organizations, with options limited to manual penetration tests or scripts. StackHawk's new tool integrates MCP server scanning into its platform, allowing users to identify vulnerabilities by simulating interactions with MCP servers, extracting tool parameters, and fuzzing them for common security flaws. This approach provides detailed findings and remediation guidance, addressing an urgent need as MCP adoption and associated risks continue to grow.

In February 2026, Anthropic launched Claude Code Security, sparking debate and market reactions about its impact on application security (AppSec). This tool, which builds on the earlier /security-review command, employs AI to reason about code, identifying vulnerabilities that traditional rule-based tools might miss. While Claude Code Security has demonstrated the ability to find high-severity vulnerabilities in open-source codebases, it is limited by not testing running applications, unlike dynamic application security testing (DAST) tools that engage with live environments to uncover runtime vulnerabilities. The community response highlights excitement about the AI's potential to suggest context-aware fixes but also raises concerns about non-determinism and reliance on AI models to secure AI-generated code. Despite these limitations, combining Claude Code Security with runtime testing is seen as a comprehensive approach to shipping secure software, ensuring both AI-powered analysis and validation through real-world testing.

XBOW and StackHawk represent two distinct approaches to application security testing, each offering unique advantages suited to different needs within a security program. XBOW is an autonomous offensive security platform designed to replace manual penetration testing with AI, identifying sophisticated vulnerabilities through adaptive, black-box testing, and delivering comprehensive reports with validated findings. Conversely, StackHawk is a shift-left DAST platform that integrates seamlessly with development workflows, running automated security scans on every code change to catch vulnerabilities early in the CI/CD pipeline. While XBOW excels in uncovering complex, multi-step exploits and providing context-aware remediation, StackHawk emphasizes rapid, deterministic testing with results directly tied to specific code commits, supporting continuous security feedback for developers. The choice between these tools depends on whether the priority is deep, periodic assessments akin to those conducted by human pentesters or continuous, inline security checks that align with agile development practices. Together, they can complement each other, covering both immediate and strategic security layers within an organization’s application security framework.

AI penetration testing tools are rapidly gaining popularity, with startups like XBOW and Terra Security raising significant venture funding to automate tasks traditionally requiring manual pen testers. Unlike DAST tools, which run on every build to test web apps and APIs, AI penetration testing is designed to replace manual pen testing by simulating real-world attacks on infrastructure, networks, and cloud environments. While AI pen testing can uncover complex attack scenarios and is more cost-effective than manual methods, it is not suitable for continuous testing due to its scope and cadence limitations. Instead, it excels in periodic, deep-dive security validations. On the other hand, AI-powered DAST offers continuous, application-layer security testing integrated into CI/CD pipelines, catching vulnerabilities at every code change. The complementary use of both tools provides comprehensive security coverage: DAST for ongoing application security and AI pen testing for periodic infrastructure-wide validation. This dual approach addresses the rapid introduction of new vulnerabilities, especially with the rise of AI-generated code, ensuring that both application-layer and infrastructure-level threats are effectively managed.

At the recent RSA Conference, significant attention was given to the transformative impact of AI on application security (AppSec) and the ongoing efforts to adapt to this rapid change. The event highlighted a notable disconnect between the confidence of vendors and the uncertainty of security practitioners, as AI-driven development accelerates code generation faster than it can be reviewed, necessitating a rethinking of security programs. Discussions emphasized the importance of bridging the gap between code analysis and real-world application behavior, with runtime testing emerging as a crucial strategy for identifying exploitable vulnerabilities. Despite the challenges, there was a collective willingness among attendees to collaborate on evolving AppSec practices, focusing on shared responsibility, education, and the development of new frameworks like the AI-driven development lifecycle (AI-DLC). The conference underscored the need for an operational shift in security approaches, as the rapid adoption of AI tools by both developers and attackers alters the dynamics of threat landscapes and vulnerability management.