Notifications
Clear all
Topic starter
19/08/2026 3:26 pm
TL;DR: DAST still misses business logic flaws like BOLA while traditional penetration testing cannot keep pace with modern API deployment velocity, according to Equixly. The shift matters because agentic AI can continuously model application behaviour to close that gap, changing API assurance from a point-in-time activity into an ongoing control.
NHIMG editorial — based on content published by Equixly: Agentic AI is reshaping the DAST vs. penetration testing debate
By the numbers:
- A 2025 empirical study across 75 real-world web applications found that DAST tools outperformed SAST tools in detecting broken access controls, insecure design, and vulnerable and outdated components.
Questions worth separating out
Q: What breaks when DAST is used as the only API security test?
A: DAST misses flaws that depend on application meaning, especially broken object level authorization and multi-step business logic abuse.
Q: Why do APIs need testing beyond traditional penetration tests?
A: Traditional pentests are deep, but they are time-bound and quickly outdated in fast-moving release cycles.
Q: How do teams know whether API testing is actually covering business logic risk?
A: Look for evidence that the testing can change user context, sequence calls, and verify whether ownership and function-level checks are enforced across endpoints.
Practitioner guidance
- Validate authorization on every authenticated API path Test whether each endpoint enforces object ownership, role scope, and function-level entitlements after login, not just whether it returns a response.
- Map testing depth to deployment cadence Treat quarterly penetration testing as a minimum review point, then add automated or agentic tests on every release that can change request order, identity context, and workflow state.
- Prioritise BOLA and BFLA in API review Build explicit test cases for broken object level authorization and broken function level authorization across mobile, web, and service-to-service APIs because those flaws bypass pattern-based scanning.
What's in the full article
Equixly's full article covers the operational detail this post intentionally leaves for the source:
- Side-by-side explanation of how DAST engines, manual pentesting, and agentic testing behave against the same API surface
- Examples of the vulnerable API flows and logic flaws used to demonstrate where scanners missed BOLA and related issues
- Performance and cost context for manual API penetration testing at scale, including endpoint coverage and testing hours
- Operational breakdown of how the agent models endpoints, authentication flow, and multi-step attack sequences
👉 Read Equixly's analysis of how agentic AI changes API security testing →
Agentic AI and API testing: what changes for security teams?
Explore further
19/08/2026 4:10 pm
API authorization is now an identity problem, not just an application test problem. When APIs control who can see an object, invoke a function, or move a workflow state, they are enforcing identity decisions in code. That means IAM, application security, and testing discipline have to converge around the same control surface. Practitioners should treat API authorization as part of access governance, not a separate QA checkbox.
A few things that frame the scale:
- From our research: 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems (39%), inappropriately sharing sensitive data (31%), and revealing access credentials (23%). according to AI Agents: The New Attack Surface report.
- Only 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation.
A question worth separating out:
Q: How should security teams use agentic testing without over-relying on automation?
A: Security teams should use agentic testing to expand coverage, speed up discovery, and reduce repetitive triage, but keep humans responsible for interpreting business impact and validating the most sensitive paths. The right model is machine-assisted assurance, where automation improves cadence and consistency while expert judgement handles chaining, edge cases, and remediation decisions.
👉 Read our full editorial: Agentic AI is reshaping the DAST vs. pentesting debate
