The Power of Instrumentation to Automate Components of Vulnerability Testing – from the Creator of IAST

OWASP Portland podcast: pentesting success requires cleverness beyond technical skill, security talent is short across every domain, and client communication must match each audience's level.

ServiceTitan's Cassio Goldschmidt explains how software security frameworks evolved, and why application type, compliance rules, platform, and programming language shape each company's approach.

I’ve always been a firm believer in incorporating manual testing as part of any security assessment; after all, a human is the best judge of evaluating the contents of application output, and best able to truly understand how an application is supposed to function.

Burp Infiltrator instruments Java and JVM-based applications by patching bytecode with hooks on unsafe APIs, pinging Burp Collaborator when scanner payloads reach them — an IAST-style capability.

SaaS providers face rising API and multi-tenant threats; regular pentesting aligned to OWASP and PTES across the SDLC reduces breach risk and supports SOC 2, ISO 27001, GDPR, and HIPAA.

APIs expose backend logic and sensitive data directly; targeted API security testing uncovers broken authentication, excessive data exposure, and access control flaws that traditional pentests miss.