Vulnerabilities that Hide from Your Tools

### Flaws That Escape Automated Security Scanners At 00:00, application security educator Jillian Ratliff explores business logic flaws and architectural vulnerabilities that routinely bypass automated static (SAST) and dynamic (DAST) scanners at the AppSec Village.

### Strengths and Scope of Automated Tooling At 05:55, Ratliff reviews what automated scanning tools do well. Rule-based tools excel at detecting predictable, syntax-level issues such as missing security headers, default passwords, outdated dependencies, and simple cross-site scripting patterns.

### The Blind Spots of Automated Analysis At 11:46, the presentation examines why scanners produce false negatives. Automated tools lack contextual understanding of business requirements, struggling with non-English naming conventions, multi-factor authorization logic, and credentials stored in auxiliary documentation files.

### Business Logic Flaws and Parameter Tampering At 17:43, Ratliff illustrates high-impact business logic vulnerabilities, including Insecure Direct Object References (IDOR), parameter manipulation in shopping carts, and race conditions during account transfers, demonstrating that scanners cannot determine whether an authorized action violates business policy.

### Cultivating Developer Security Mindsets Concluding between 23:59 and 31:48, Ratliff advocates for interactive, continuous developer education. Rather than relying on annual compliance training, she encourages security teams to host monthly threat modeling sessions that empower developers to spot architectural flaws during code design.

(AI summary — Gemini Flash)