Webinar Description
Key Takeaways
- Explores hybrid SAST approaches that combine deterministic scanning with contextually aware analysis to detect business logic vulnerabilities
- Addresses gaps in traditional SAST tools, which often miss IDORs, authentication bypasses and broken access controls
- Demonstrates integration with developer workflows through GitHub and GitLab pull requests
- Designed for application security professionals, DevSecOps teams and security program managers
About the Webinar
Veracode and DryRun Security are hosting a live webinar examining hybrid Static Application Security Testing (SAST) methods. The session focuses on combining traditional deterministic scanning with contextually aware analysis to identify vulnerabilities that pattern matching approaches typically miss.
Business Logic Vulnerabilities and Traditional SAST Limitations
Traditional SAST tools rely primarily on pattern matching to detect known vulnerability types. This approach struggles with business logic flaws, which do not follow predictable patterns. Insecure Direct Object References (IDORs), authentication bypasses and broken access controls represent categories of vulnerabilities that often evade conventional scanning methods.
The webinar examines how hybrid SAST addresses these detection gaps by analysing code with greater contextual awareness, examining application behaviour in ways that reflect how attackers approach code review.
Developer Workflow Integration
The session covers practical implementation aspects, including how hybrid SAST findings can be delivered directly within pull requests through GitHub and GitLab integrations. This approach aims to reduce operational overhead while increasing codebase visibility without requiring organisations to replace existing compliance and reporting processes.
Who Should Attend
This webinar is relevant for application security engineers, security architects, product security managers, DevSecOps practitioners and development team leads. It is particularly suited to organisations with in-house development teams seeking to expand vulnerability detection coverage within existing security programs.