DAST, API security, and the work behind it.
Practical guides and original research on dynamic application security testing, API discovery, DevSecOps, and AI-era code security.
Top 10 DAST Tools in 2026 (Honestly Ranked)
An honest, criteria-based ranking of the top DAST tools in 2026, including where our own product wins and loses.
Read full post → InsightYour API Spec and Your Running API Disagree
The OpenAPI spec says one thing; the running app answers another. Why API documentation drifts from reality, where the gaps hide, and how to test the inventory you actually expose.
InsightScan, Fix, Verify Is Only as Good as the Evidence: Wiring a DAST MCP Server Into Your Coding Agent
Your coding agent can write the fix but cannot see the running application. How to wire DAST into the agent loop over MCP, and keep a human on the merge.
InsightASP.NET Core API Security Testing: Start From the Source, Not the Swagger File
A generated swagger.json reflects annotation discipline, not the route table. How a source-derived spec, including the authorization attributes, changes what your scan is pointed at.
InsightYour Scan Passed Because It Never Logged In
A passing DAST scan can mean the scanner never logged in. How silent authentication failure happens, why it hides, and how to verify an authenticated scan actually got inside.
InsightEveryone Is a Developer Now. That's Your New Attack Surface.
Vibe coding turned non-developers into app builders. The five security pain points that creates, and why the old AppSec review gate cannot absorb them.
InsightMCP Server Security Testing: The Shadow API Someone Is Already Scanning
SANS saw 49 IPs probing one host for MCP servers; Knostic found 1,862 exposed, none authenticated. A shadow MCP server is an API nobody wrote down. How to inventory, authenticate, and test it.
InsightShadow API Discovery: Why Your API Inventory Should Start From Source Code
Traffic and gateway tools only see endpoints that pass through them. Source-derived discovery finds shadow and zombie REST endpoints before deployment.
InsightFrom Runtime Finding Back to the Line That Caused It
Source-linked DAST connects supported runtime findings to endpoint code, giving AI agents reproducible evidence for changes that still pass through human review.
InsightAutonomous Penetration Testing: A CISO Reality Check
Confidence in autonomous penetration testing is falling. The 2026 evidence, where full autonomy breaks, and the agent-ready, human-in-the-loop model that holds up.
GuideAPI and Application Security Testing: What You Should Know
Our comprehensive guide to next-generation API and application security testing: why legacy DAST and SAST miss API-first apps, how discovery-driven testing works, and how NightVision maps to federal API security requirements.
Buyer's GuideTop 10 API Security Tools in 2026 (Honestly Ranked)
Runtime protection, testing, and discovery compared, honestly ranked across the API security category.
InsightTeamPCP Shows Why “Secure the App” Now Means “Secure the Pipeline”
TeamPCP's supply-chain attacks turn stolen CI/CD secrets into ransomware. Learn how DAST and API discovery shrink the blast radius of pipeline compromise.
InsightThe Native Domain of Agentic Engineering
Why static analysis is the native domain of agentic engineering: AI agents both build and rely on static analysis, powering API eNVy's rapid evolution.
AnnouncementsNightVision Skills for Claude Code Are Now Available. Here's What They Do.
NightVision skills for Claude Code: four skills covering scan configuration, API discovery, finding triage, and CI/CD integration, installable in a minute.
InsightClaude Code Security Is Here. What It Changes, and What It Doesn’t.
Claude Code Security is strong at code reasoning and patches. Here's how NightVision's API inventory controls and runtime DAST complement that scope.
ResearchYour Crawler Is Testing the Same Button 50 Times. Ours Isn't.
FragGen, NightVision's fragment-based crawler upgrade, skips redundant page components, delivering 3.5x more states and 5x faster crawl efficiency.
InsightBeware the Invisible APIs: The Serious Threat Posed by AI Coding Assistants
AI coding assistants create shadow APIs faster than teams can document them. Why legacy security tools fail and how code-level API discovery closes the gap.
ResearchIntroducing Automated Authentication Issue Remediation: From Detection to Pull Request in Minutes
API eNVy now finds authentication vulnerabilities, generates fixes with LLMs, and opens ready-to-review pull requests, in minutes instead of weeks.
ResearchIntroducing Intelligent Waits for Spidering
NightVision's crawler now uses WebDriver BiDi network and DOM signals instead of fixed delays, so spidering captures fully rendered dynamic web apps.
InsightWhy Every Business Needs NightVision's DAST
Legacy DAST misses undocumented APIs and breaks on modern apps. See how NightVision discovers APIs from code, then attacks them with code-traced proof.
InsightFederal API Security Requirements (U.S.) - and How NightVision Helps
How federal mandates from NIST, CISA, OMB, FedRAMP, and EO 14028 shape API security, and how NightVision's API eNVy plus gray-box DAST helps you comply.
ResearchIntroducing Intelligent Form Handling for DAST Scans
Web forms are gateways to core app features but hard for crawlers to handle. NightVision's LLM-augmented spider generates context-aware form inputs for DAST.
InsightAPI‑Security Approaches in 2025
A breakdown of six API-security approaches in 2025, WAFs, traffic mirroring, spec linting, legacy DAST, and why hybrid DAST plus code-intelligence wins.
InsightIntroducing Broken-Flask: Why SAST, DAST, and CNAPP Aren't Enough
Broken-Flask is an intentionally vulnerable Flask API whose SQL injections evade SAST, SCA, CNAPP, and traditional DAST, proving exploitability is what matters.
InsightMother Knows Best: Fix API Security Problems at Their Source
Reactive API security costs more than prevention. Learn why code-level API discovery plus CI-speed DAST fixes inactive, zombie, and shadow APIs at the source.
InsightFast DAST That Runs at Developer Speed
Modern DAST belongs in CI. Eight reasons to plug dynamic security testing into every pull request, plus how NightVision runs at developer speed.
ResearchIntroducing the NightVision MCP Server: A New Way to Interact with NightVision
The open-source NightVision MCP Server lets AI assistants like Claude and Cursor run DAST scans, discover APIs, and fetch results via natural language.
ResearchNext.js Middleware Bypass (CVE‑2025‑29927) Detection
CVE-2025-29927 lets attackers bypass Next.js middleware via the x-middleware-subrequest header. NightVision's Nuclei template detects it with a two-stage approach.
InsightToday Yogi might have said: "You can learn a lot from Discovery."
Why static-analysis API discovery beats the traffic-monitoring approach: faster, cheaper, complete, and it finds inactive, zombie, and shadow APIs before deployment.
Press ReleaseNightVision Transforms Secure Software Development With Application Testing Solution
NightVision launches a gray-box AppSec testing solution that identifies and locates exploitable vulnerabilities before code reaches production.
AnnouncementsNightVision Has Completed a SOC 2 Exam. Here's What It Means for You.
NightVision has completed a SOC 2 Type 2 examination. Learn what a SOC 2 report is, what it covers, and why it matters for the security of your data.
Press ReleaseNightVision Bolsters Advisory Board To Propel Development and Deployment of Application Security Testing Solutions
NightVision builds a high-powered Advisory Board and adds cybersecurity veterans John Steven and Shaun Murphy to its Board of Directors to guide AppSec growth.
AnnouncementsNightVision Raises $5.4 Million In Seed Funding to Develop Fast and Easy-to-Use Application Security Testing
NightVision secures $5.4M in seed funding to build fast, easy-to-use gray-box application security testing that finds exploitable vulnerabilities pre-production.
IndustryThe Essential Role of Dynamic Application Security Testing (DAST) in Complementing Static Application Security Testing (SAST)
Why DAST is essential alongside SAST: it proves vulnerabilities exist by simulating real attacks, works with any framework, and cuts false-positive noise.
Press ReleaseNightVision Now Discovers and Documents Software Application Programming Interfaces (APIs) In Seconds
NightVision releases API eNVy, an API discovery and documentation solution that uncovers shadow APIs in seconds using static analysis, no agents required.
AnnouncementsNightVision hires Qilong Wang to lead Engineering, to Help Shift the DAST Space Towards Developers
NightVision appoints Qilong Wang as VP of Engineering, bringing leadership experience from Mobi, SilverRail, Gomez, and Dynatrace to its whole-app DAST.
Experience confidence in your AppSec program.
Run a free NightVision scan on your own app: onboarding takes a few clicks and under a minute, and request-level findings retain HTTP evidence.