{
  "video": {
    "id": "f3o0-9Dlw3E",
    "title": "AI Hackers Are Faster Than Your Pen Test — Eli Cohen, Snyk",
    "duration": 1169,
    "upload_date": null,
    "channel": "AI Engineer",
    "source": "AI Engineer",
    "event_format": ""
  },
  "analysis": {
    "video_id": "f3o0-9Dlw3E",
    "title": "AI Hackers Are Faster Than Your Pen Test — Eli Cohen, Snyk",
    "one_liner": "Pen testing once or twice a year can't keep up with coding agents producing more insecure code and AI attackers who can breach a system in as little as 4 minutes. Snyk's Eli Cohen argues for continuous, LLM-driven pen testing on every PR that proves exploitability, and gives four questions to ask any vendor.",
    "summary": "Cohen argues that AI has made the security backlog unmanageable. Developers ship far more code, much of it insecure, while attackers use the same frontier models to chain low-severity bugs into critical ones and break into systems in minutes. SAST is cheap but blind to runtime issues, DAST finds issues like BOLA and XSS but misses business logic, and human pen testing is the gold standard but too slow, too expensive and too infrequent. He presents Snyk's Evo continuous offensive security as an alternative: a multi-agent AI pen tester built from the ground up on LLMs. It runs on every code change, is fed context from the other scanners, and validates that findings are actually exploitable.",
    "key_points": [
      "Snyk's figures: developers write 218% more lines of code than before, more than 85% use coding agents, and 62% of LLM output is insecure or broken.",
      "Attackers use AI to chain low-severity vulnerabilities into critical ones and focus on application context, the area where LLM-generated code produces the most vulnerabilities.",
      "Attack stats cited: one AI-driven operation breached 600 firewalls across many countries. A successful AI attack takes about half an hour on average (garbled in the transcript as '24 34 minutes') and as little as 4 minutes. 43% of MCP servers have vulnerabilities.",
      "SAST catches things like SQL injection and XSS cheaply on every change but misses runtime authorisation and configuration issues. DAST sends exhaustive predefined payloads and finds issues like BOLA (user A can access user B's data) but is weak on business logic.",
      "Human pen testing is the gold standard for business logic, but it costs a lot, happens 1–3 times a year, and ends in a 'glorified report in PDF' that developers must triage, fix and then wait for a retest.",
      "Evo's architecture: an LLM orchestrator (the 'brain', following a dynamic plan) drives a recon agent (endpoints, APIs, fingerprints, then an inferred architecture), specialised vulnerability-testing agents (known classes plus 'hunting in the wild'), an exploit-validation 'judge', a remediation agent and a reporting agent.",
      "The pen test runs on every PR or delta. Output from the static scanner, dynamic scanner and other engines is fed in to guide the LLM, because models find more when they know where to look.",
      "No single tool is enough: DAST is the best tool for cross-site scripting, while AI pen testing is best for business logic, so you combine them. The suite also covers agent red teaming: multi-step attacks such as prompt injection, data exfiltration and goal hijacking."
    ],
    "takeaways": [
      "Move offensive security testing from a once- or twice-a-year event to every code change or PR.",
      "When evaluating AI pen testing tools, whether from a vendor or built in-house, ask four questions: Does it run continuously, or only at points in time? Does it reason about application context? What extra context can it take in? Does it prove exploitability, or just flag bugs?",
      "Feed SAST/DAST findings and environment context into the LLM tester. Richer context gives better results, and Cohen says it also makes the LLM cheaper to run.",
      "Keep layered tooling: use DAST for payload-heavy classes like XSS and AI pen testing for business logic and authorisation flaws.",
      "Add agent red teaming (prompt injection, data exfiltration, goal hijacking) for AI agents running in production, and check MCP servers, given that 43% have vulnerabilities."
    ],
    "topics": [
      "application security",
      "ai pentesting",
      "offensive security",
      "agents",
      "red teaming",
      "sast",
      "dast",
      "mcp"
    ],
    "tools": [
      "Snyk",
      "Snyk Evo",
      "Helios",
      "Claude Code",
      "Codex",
      "MCP",
      "Mythos"
    ],
    "quotes": [
      {
        "text": "what you going to do with the rest of the 350 days you have a year that no one tested your application",
        "at": "08:17",
        "url": "https://www.youtube.com/watch?v=f3o0-9Dlw3E&t=497s"
      },
      {
        "text": "It sounds like a movie from the 90s, right? It doesn't make sense to do this anymore.",
        "at": "08:40",
        "url": "https://www.youtube.com/watch?v=f3o0-9Dlw3E&t=520s"
      },
      {
        "text": "your LLM are as good as the context that you feed them with",
        "at": "14:57",
        "url": "https://www.youtube.com/watch?v=f3o0-9Dlw3E&t=897s"
      }
    ],
    "words": 3540
  },
  "summary_url": "/#f3o0-9Dlw3E",
  "transcript": {
    "html": "/transcripts/f3o0-9Dlw3E.html",
    "txt": "/transcripts/f3o0-9Dlw3E.txt",
    "vtt": "/transcripts/f3o0-9Dlw3E.vtt"
  }
}