Notifications
Clear all
Topic starter
02/08/2026 11:57 am
TL;DR: Broken access control has remained OWASP’s top web application risk through 2025, while a separate business logic category was created because syntactic defenses do not catch intent failures; Gecko Security’s BSides London companion piece argues LLMs can reason through those gaps where traditional tools cannot, according to Gecko Security. The shift matters because modern code generation and microservice sprawl are increasing the number of places where authorization assumptions quietly fail.
NHIMG editorial — based on content published by Gecko Security: LLMs to find business logic vulnerabilities in source code
Questions worth separating out
Q: Where do business logic vulnerabilities fail in practice?
A: They fail wherever the application assumes intent instead of enforcing it.
Q: Why do broken access control issues survive normal application security testing?
A: They survive because many tools look for patterns inside a single file or repository, while the failure often lives in how multiple functions or services enforce the same rule differently.
Q: What do security teams get wrong about review loops in AI-assisted development?
A: Teams often assume a review loop automatically means control is preserved.
Practitioner guidance
- Map business workflows to explicit authorization rules Document the actions, states, and role boundaries that each endpoint or object reference is allowed to support.
- Add adversarial tests for workflow abuse Create test cases for IDOR, privilege escalation, tenant crossing, and multi-step misuse of legitimate functions.
- Review AI-generated code for hidden access assumptions Treat code produced with AI assistance as a risk amplifier when it touches authorization, object lookup, or role logic.
What's in the full article
Gecko Security's full post covers the operational detail this post intentionally leaves for the source:
- The BSides London talk context and the research workflow behind the LLM-based approach to finding business logic bugs
- Examples from Cal.com, N8N, GitLab, and Optus that show how authorization failures manifest in real systems
- The comparison between SAST, DAST, runtime tooling, and human-style reasoning for semantic vulnerability discovery
- The implementation model Gecko Security uses to trace call chains from source to sink and infer intended behaviour
👉 Read Gecko Security’s analysis of how LLMs find business logic vulnerabilities →
Business logic flaws and AI-assisted testing: are your controls keeping up?
Explore further
02/08/2026 1:05 pm
Broken access control is still the clearest signal that intent-based security is failing at scale. OWASP keeping this category at the top reflects a governance problem, not just a coding problem. Organisations have improved at blocking known technical patterns, but many still fail to encode who can do what, when, and in which state. The practitioner conclusion is simple: security review has to include business intent, not only syntax.
A question worth separating out:
Q: How should teams test for business logic flaws before release?
A: They should build tests around misuse of legitimate functionality, not just malicious inputs. The right approach is to validate state transitions, privilege changes, object access, and tenant separation across full workflows. If an action becomes unsafe only when combined with another action, the test suite needs to cover that chain explicitly.
👉 Read our full editorial: LLMs are changing how teams find business logic vulnerabilities
