Show, Don't Tell: What Evo Continuous Offensive Security Found in a Real Enterprise SaaS

Snyk presents Evo Continuous Offensive Security (COS) as an AI-driven platform combining AI pentesting, agent red teaming, and dynamic application security testing to continuously assess applications and AI systems in a manner intended to resemble human-led red-team exercises. In a black-box assessment of a multi-tenant SaaS application with hundreds of microservice endpoints, the company says its multi-agent approach performed authentication, reconnaissance, business-context inference, vulnerability testing, cross-validation, attack chaining, and reporting, ultimately identifying 33 confirmed issues. Two highlighted findings were an authorization and mass-assignment flaw in a legacy tenant settings endpoint that allegedly allowed low-privilege users to alter security-critical configuration and potentially compromise an entire tenant, and a CORS origin-reflection issue that could enable malicious websites to extract logged-in users’ access tokens. The company argues that its distinguishing capabilities are reasoning about business logic and authorization flaws that signature-based scanners may miss, independently validating exploitability to reduce false positives, and providing concrete proofs of concept and business-impact explanations to help organizations prioritize remediation.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.