The widespread adoption of coding assistance tools and generative AI is accelerating software development at an unprecedented pace. At the same time, the volume of generated code and the complexity of software systems are rapidly increasing, while the personnel and time available for security reviews are not necessarily growing at the same rate. As a result, it is becoming increasingly difficult to maintain security review practices using traditional approaches alone.
This challenge is particularly significant in the automotive industry. As Software Defined Vehicles (SDVs) continue to evolve, software and cloud-based services surrounding vehicles, including infotainment systems, Over-The-Air (OTA) updates, and vehicle management services, are expanding rapidly. In these environments, technologies such as Java, JavaScript/TypeScript, Python, and Go are increasingly being adopted alongside C and C++, which have traditionally dominated automotive software development. Consequently, application-level security controls, including authentication, authorization, and access control, have become more critical than ever.
However, weaknesses in authentication and authorization, as well as business logic flaws, cannot always be identified by examining a single source code file in isolation. Determining whether an operation should legitimately be permitted often requires an understanding of the relationships among multiple modules, APIs, and services across the system.
In this session, we will introduce DryRun Security, an AI-powered reasoning SAST solution that represents a new approach to vulnerability detection. By understanding code context and overall system behavior, AI can identify security issues that may be overlooked by conventional analysis techniques. We will discuss how security reviews can evolve in the age of AI and share practical insights for achieving both development speed and security quality.