Man vs Machine: manual and automated security testing
summary
Compares SAST and DAST automation versus manual testing using a 2.3M-vulnerability dataset: automation finds most issues and covers about 90% automation coverage, but manual testing still finds classes machines miss (CSRF, DOM XSS) and explores undocumented “Nakatomi” paths. Dataset averages average 42 vulns/app. Overlap between static scans and human findings is small; recommended pipeline is static → dynamic → targeted manual testing and then bug bounties up to $200k only after basic controls, with examples including static tools flagging unencoded JavaScript and real-world failures like Equifax patching lapses.
AI-written summary · about
chapters (23)
- 0:00Introduction
- 0:41Agenda
- 2:01Automation tools
- 3:05Why this topic
- 8:18Scope coverage
- 10:06Speed
- 10:36Reporting
- 12:23Tasks not done by humans
- 14:25Application level
- 16:56Exploration
- 19:56Avast Top 10
- 20:56Project
- 23:30Results
- 27:53Humans dont scale
- 28:41Defenders Dilemma
- 29:33Nakatomi Space
- 32:28Overlap
- 33:16Crosssite scripting
- 37:21Bug bounties
- 38:35Black market
- 40:18Humans vs machines
- 40:43Complete picture
- 42:54Questions
related talks
17mManual versus automated penetration testing on AWS
44mApplication Security: Everything we know is wrong
41mSkillful, Scalefull Fullstack Security in a State of Constant Flux
19mPenetration Testing
33mAutomated security: face your vulnerabilities
43mSecurity Testing Tools: Can I Touch You There?
39mAutomating myself out of a job...
40mAutomated Security: Face Your Vulnerabilities