DAST, API security, and the work behind it.
Practical guides and original research on dynamic application security testing, API discovery, DevSecOps, and AI-era code security.
Top 10 DAST Tools in 2026 (Honestly Ranked)
An honest, criteria-based ranking of the top DAST tools in 2026, including where our own product wins and loses.
Read full post → InsightIndirect Prompt Injection, Explained: When an Agent's Tool Output Becomes an Instruction
Indirect prompt injection arrives inside data a model was asked to read. How it works, why unattended agents raise the stakes, and which controls hold.
InsightDid Your DAST Scan Actually Test the App? A Passing Check Should Say How Many Requests It Sent
A passing DAST check can mean the rule found nothing or sent nothing. Per-rule request counts and a tested-nothing flag tell you which one you have.
InsightThe App Your Agent Built This Morning Has Never Been Scanned
Apps built with coding agents skip DAST because nobody onboarded them. Put the scan in the agent's definition of done: an org rule, a skill, one MCP call.
InsightServer-Side Request Forgery (SSRF), Explained
Nineteen SSRF flaws sit in CISA’s KEV catalog. The bug is not that the server made a request. It is that nobody checked where the request was going.
ResearchPaperCut's Missing Auth Check Just Became a KEV
CVE-2026-81578 lets an unauthenticated request reach PaperCut's config editor; chained with CVE-2026-82078 it becomes RCE. The whole chain hinges on one missing check. Includes a Nuclei template.
InsightAI Infrastructure Security Testing: The Newest Layer, the Oldest Bugs
A CVSS 10.0 MCP server, a gateway that forwards a header into a fetch, a route that returns its own password. Not one of them is an AI vulnerability.
InsightWeb Cache Deception: When Your CDN Serves One User’s Data to Everyone
A cache key contains the method and the URL. It does not contain the user. Everything hard about this follows from that one line.
InsightReverse Proxy Access Control Testing: The Layer in Front of Your Code
A CVSS 10.0 flaw in Oracle’s WebLogic proxy plug-in landed in CISA’s KEV catalog. The bug is not in anyone’s application code.
InsightMFA Enforcement Testing: Policy vs. the Live Endpoint
An identity audit tells you who is enrolled. Only a live request tells you whether the endpoint enforces. Those two answers drift apart quietly.
InsightCORS Misconfiguration: The Wildcard Is Not the Risk
Access-Control-Allow-Origin: * cannot leak an authenticated response, because browsers will not allow it. The configuration that does is the one written to replace it.
InsightZombie CVEs: The Case for AI Code Regression Testing
Frontier coding agents write working code 83% to 95% of the time. Only 24% to 36% of it is also secure. Most of the rest revives a vulnerability somebody already fixed, with no CVE attached.
InsightDAST vs Penetration Testing: What Each One Proves
Each one proves something different, and neither proves everything. A plain-language taxonomy of DAST, human pentesting, and the autonomous category, for your next RFP or budget conversation.
ResearchA Zero-Day With No CVE, No Patch, and Nothing to Match
The GeoServer flaw under active exploitation is unauthenticated SQL injection through an OGC filter. On day zero there is no CVE and no signature. The only thing that catches it is behavior.
InsightSpeed Was Never the Bottleneck. Trust Was.
AI collapsed the cost of producing a change. It did not collapse the cost of believing one, and every AI security pitch optimizes the half that already got cheap.
InsightMCP Solves Half of Your AI Security Problem
MCP closes the find-to-fix loop for developers working through a coding agent. It has nothing to attach to when the app was built by someone who will never run one, and both land on the same AppSec team.
InsightJWT Validation: Decoding a Token Is Not Verifying It
Five separate assertions hide inside the sentence "the token is valid." Algorithm, key, issuer, audience, expiry, and where each one quietly goes missing.
InsightPatched Twice, Bypassed Twice: A Case for Authentication Bypass Regression Testing
N-able N-central picked up two KEV entries for one authentication bypass, because the first patch was incomplete. Why a CVE number is not evidence that a protected route refuses a session.
InsightSQLite Got a Critical CVE for a Vulnerability That Doesn't Exist
Six critical SQLite CVEs were fabricated by a language model and rejected four days later. What that says about severity labels, and about the pipelines that consume them.
AnnouncementsNightVision Skills Are Now Available in Codex
Four skills, installable from the Codex plugin directory, that let a coding agent discover an API from source, configure a DAST scan, wire it into a pipeline, and triage what comes back.
InsightMass Assignment: How a Signup Form Creates an Admin Account
The form showed four fields. The endpoint accepted nine, and one of them was role. What a mass assignment vulnerability is, which frameworks are at risk, and how to test for it by hand.
InsightAuthentication Is Not Authorization
A valid login is not a valid claim to the data behind the next ID. What broken object level authorization is, why it hides from testing, and how to test for it on purpose.
InsightYour API Spec and Your Running API Disagree
The OpenAPI spec says one thing; the running app answers another. Why API documentation drifts from reality, where the gaps hide, and how to test the inventory you actually expose.
InsightScan, Fix, Verify Is Only as Good as the Evidence: Wiring a DAST MCP Server Into Your Coding Agent
Your coding agent can write the fix but cannot see the running application. How to wire DAST into the agent loop over MCP, and keep a human on the merge.
InsightASP.NET Core API Security Testing: Start From the Source, Not the Swagger File
A generated swagger.json reflects annotation discipline, not the route table. How a source-derived spec, including the authorization attributes, changes what your scan is pointed at.
InsightYour Scan Passed Because It Never Logged In
A passing DAST scan can mean the scanner never logged in. How silent authentication failure happens, why it hides, and how to verify an authenticated scan actually got inside.
InsightEveryone Is a Developer Now. That's Your New Attack Surface.
Vibe coding turned non-developers into app builders. The five security pain points that creates, and why the old AppSec review gate cannot absorb them.
InsightMCP Server Security Testing: The Shadow API Someone Is Already Scanning
SANS saw 49 IPs probing one host for MCP servers; Knostic found 1,862 exposed, none authenticated. A shadow MCP server is an API nobody wrote down. How to inventory, authenticate, and test it.
InsightShadow API Discovery: Why Your API Inventory Should Start From Source Code
Traffic and gateway tools only see endpoints that pass through them. Source-derived discovery finds shadow and zombie REST endpoints before deployment.
InsightFrom Runtime Finding Back to the Line That Caused It
Source-linked DAST connects supported runtime findings to endpoint code, giving AI agents reproducible evidence for changes that still pass through human review.
InsightAutonomous Penetration Testing: A CISO Reality Check
Confidence in autonomous penetration testing is falling. The 2026 evidence, where full autonomy breaks, and the agent-ready, human-in-the-loop model that holds up.
GuideAPI and Application Security Testing: What You Should Know
Our comprehensive guide to next-generation API and application security testing: why legacy DAST and SAST miss API-first apps, how discovery-driven testing works, and how NightVision maps to federal API security requirements.
Buyer's GuideTop 10 API Security Tools in 2026 (Honestly Ranked)
Runtime protection, testing, and discovery compared, honestly ranked across the API security category.
InsightTeamPCP Shows Why “Secure the App” Now Means “Secure the Pipeline”
TeamPCP's supply-chain attacks turn stolen CI/CD secrets into ransomware. Learn how DAST and API discovery shrink the blast radius of pipeline compromise.
InsightThe Native Domain of Agentic Engineering
Why static analysis is the native domain of agentic engineering: AI agents both build and rely on static analysis, powering API eNVy's rapid evolution.
AnnouncementsNightVision Skills for Claude Code Are Now Available. Here's What They Do.
NightVision skills for Claude Code: four skills covering scan configuration, API discovery, finding triage, and CI/CD integration, installable in a minute.
InsightClaude Code Security Is Here. What It Changes, and What It Doesn’t.
Claude Code Security is strong at code reasoning and patches. Here's how NightVision's API inventory controls and runtime DAST complement that scope.
ResearchYour Crawler Is Testing the Same Button 50 Times. Ours Isn't.
FragGen, NightVision's fragment-based crawler upgrade, skips redundant page components, delivering 3.5x more states and 5x faster crawl efficiency.
InsightBeware the Invisible APIs: The Serious Threat Posed by AI Coding Assistants
AI coding assistants create shadow APIs faster than teams can document them. Why legacy security tools fail and how code-level API discovery closes the gap.
ResearchIntroducing Automated Authentication Issue Remediation: From Detection to Pull Request in Minutes
API eNVy now finds authentication vulnerabilities, generates fixes with LLMs, and opens ready-to-review pull requests, in minutes instead of weeks.
ResearchIntroducing Intelligent Waits for Spidering
NightVision's crawler now uses WebDriver BiDi network and DOM signals instead of fixed delays, so spidering captures fully rendered dynamic web apps.
InsightWhy Every Business Needs NightVision's DAST
Legacy DAST misses undocumented APIs and breaks on modern apps. See how NightVision discovers APIs from code, then attacks them with code-traced proof.
InsightFederal API Security Requirements (U.S.) - and How NightVision Helps
How federal mandates from NIST, CISA, OMB, FedRAMP, and EO 14028 shape API security, and how NightVision's API eNVy plus gray-box DAST helps you comply.
ResearchIntroducing Intelligent Form Handling for DAST Scans
Web forms are gateways to core app features but hard for crawlers to handle. NightVision's LLM-augmented spider generates context-aware form inputs for DAST.
InsightAPI‑Security Approaches in 2025
A breakdown of six API-security approaches in 2025, WAFs, traffic mirroring, spec linting, legacy DAST, and why hybrid DAST plus code-intelligence wins.
InsightIntroducing Broken-Flask: Why SAST, DAST, and CNAPP Aren't Enough
Broken-Flask is an intentionally vulnerable Flask API whose SQL injections evade SAST, SCA, CNAPP, and traditional DAST, proving exploitability is what matters.
InsightMother Knows Best: Fix API Security Problems at Their Source
Reactive API security costs more than prevention. Learn why code-level API discovery plus CI-speed DAST fixes inactive, zombie, and shadow APIs at the source.
InsightFast DAST That Runs at Developer Speed
Modern DAST belongs in CI. Eight reasons to plug dynamic security testing into every pull request, plus how NightVision runs at developer speed.
ResearchIntroducing the NightVision MCP Server: A New Way to Interact with NightVision
The open-source NightVision MCP Server lets AI assistants like Claude and Cursor run DAST scans, discover APIs, and fetch results via natural language.
ResearchNext.js Middleware Bypass (CVE‑2025‑29927) Detection
CVE-2025-29927 lets attackers bypass Next.js middleware via the x-middleware-subrequest header. NightVision's Nuclei template detects it with a two-stage approach.
InsightToday Yogi might have said: "You can learn a lot from Discovery."
Why static-analysis API discovery beats the traffic-monitoring approach: faster, cheaper, complete, and it finds inactive, zombie, and shadow APIs before deployment.
Press ReleaseNightVision Transforms Secure Software Development With Application Testing Solution
NightVision launches a gray-box AppSec testing solution that identifies and locates exploitable vulnerabilities before code reaches production.
AnnouncementsNightVision Has Completed a SOC 2 Exam. Here's What It Means for You.
NightVision has completed a SOC 2 Type 2 examination. Learn what a SOC 2 report is, what it covers, and why it matters for the security of your data.
Press ReleaseNightVision Bolsters Advisory Board To Propel Development and Deployment of Application Security Testing Solutions
NightVision builds a high-powered Advisory Board and adds cybersecurity veterans John Steven and Shaun Murphy to its Board of Directors to guide AppSec growth.
AnnouncementsNightVision Raises $5.4 Million In Seed Funding to Develop Fast and Easy-to-Use Application Security Testing
NightVision secures $5.4M in seed funding to build fast, easy-to-use gray-box application security testing that finds exploitable vulnerabilities pre-production.
IndustryThe Essential Role of Dynamic Application Security Testing (DAST) in Complementing Static Application Security Testing (SAST)
Why DAST is essential alongside SAST: it proves vulnerabilities exist by simulating real attacks, works with any framework, and cuts false-positive noise.
Press ReleaseNightVision Now Discovers and Documents Software Application Programming Interfaces (APIs) In Seconds
NightVision releases API eNVy, an API discovery and documentation solution that uncovers shadow APIs in seconds using static analysis, no agents required.
AnnouncementsNightVision hires Qilong Wang to lead Engineering, to Help Shift the DAST Space Towards Developers
NightVision appoints Qilong Wang as VP of Engineering, bringing leadership experience from Mobi, SilverRail, Gomez, and Dynatrace to its whole-app DAST.
Experience confidence in your AppSec program.
Run a free NightVision scan on your own app: onboarding takes a few clicks and under a minute, and request-level findings retain HTTP evidence.