Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

The Attack Surface Is Everyone Now

hacktron.ai | blog | #ai-security | #attack-surface | #risk-management | #saas | #oss | #assume-breach

Summary

Why AI is broadening the attack surface across OSS, new SaaS, and fast-shipping teams, and how to position yourself with an assume-breach mindset.
Published
Collected

original ↗

Related coverage

blog · xbow.com
Introducing Autonomous Exposure Management: Offensive Security at Enterprise Scale
XBOW tests your whole external application estate the way an attacker would, with no source code and no credentials, and proves what is exploitable.
blog · blog.trailofbits.com
How CISA can improve OSS security
Responding to a US RFI on OSS security, Trail of Bits proposes memory-safe rewrites in Rust, stronger supply chains, large-scale vulnerability reduction, and better developer education.
blog · projectblack.io
Bypassing EDR with Local AI
A pentest shows Claude refuses to build an LSASS dumper, but local DeepSeek and uncensored Qwen models produce a working XOR-encrypted minidumper, making AI-assisted EDR evasion nearly effortless.
blog · bugcrowd.com
Savant Forge: Automated offensive testing to keep pace with AI-generated code
Bugcrowd's Savant Forge combines fuzz testing with symbolic execution to surface real exploitable vulnerabilities in CI/CD pipelines, while Savant Runtime tracks live third-party components in production to support SBOM compliance.
blog · yeswehack.com
Is AI pentesting safe?
YesWeHack examines three key AI pentesting concerns - scope control, harm avoidance, and traceability - and shows how its Agentic Pentest harness addresses them for safe autonomous testing.
blog · yeswehack.com
How to use Gemini CLI for Bug Bounty research: analyse evidence, validate manually
Learn how to use Gemini CLI for Bug Bounty research to analyse captured traffic and source code at scale, surface leads and validate findings manually.
back