Automate Pen Testing in Dockerized CI CD Environment

### Integrating Automated Penetration Testing into CI/CD At 00:00, Yanyan Wang presents an engineering framework for automating application penetration testing within containerized continuous integration and deployment (CI/CD) pipelines at the AppSec Village.

### Overcoming the Bottleneck of Manual Security Assessments At 07:30, Wang discusses the disconnect between rapid DevOps deployment cycles and traditional periodic penetration testing. Relying solely on manual annual assessments leaves applications exposed, requiring security teams to shift dynamic testing left into automated delivery pipelines.

### Containerizing Dynamic Security Scanners At 14:46, the presentation details packaging security tooling using Docker. Wang demonstrates how containerizing headless browser automation drivers, custom scanning scripts, and interception proxies creates reproducible testing environments that execute seamlessly across Jenkins and GitLab CI runners.

### Driving Security Scans via Automated Functional Tests At 22:11, Wang explains how to achieve thorough application test coverage. By configuring existing Selenium and Cypress regression suites to proxy traffic through automated security engines like OWASP ZAP, the security scanner exercises authenticated application workflows without requiring manual crawling.

### Threshold Gates and Vulnerability Triage Concluding between 31:52 and 43:27, Wang reviews pipeline policy enforcement. She outlines strategies for establishing severity thresholds, automatically filing bug tickets, and failing automated builds only on verified high-severity vulnerabilities to prevent developer fatigue.

(AI summary — Gemini Flash)