Snyk announces Continuous Offensive Security, a platform combining DAST, AI-powered pentesting, and Agent Red Teaming. The post argues that effective AI pentesting requires a foundation in Dynamic Security Testing, not just LLM-driven probing from scratch. Key distinctions are drawn between heuristic-detectable vulnerabilities (handled by scanners) and context-dependent flaws like BOLA/IDOR that require reasoning to find. The architecture uses LLMs as orchestrators with DAST as a cost-efficient tool underneath, preserving token budget for business logic and authorization reasoning. A third capability, Agent Red Teaming, automatically activates when LLM-integrated components are detected in the target application. The system outputs exploit chains rather than flat vulnerability lists, and runs a multi-model harness with a dedicated validation model to confirm exploitability before surfacing findings.
