The use of coding assistance tools and generative AI is accelerating software development at an unprecedented pace. In the automotive industry, the advancement of Software Defined Vehicles (SDVs) is driving rapid growth in software and cloud-based services surrounding vehicles, including infotainment systems, Over-The-Air (OTA) updates, and vehicle management services.
In these domains, in addition to C and C++, which have traditionally been the primary languages for automotive software development, languages and architectures commonly used for web applications and cloud services, such as Java, JavaScript/TypeScript, Python, and Go, are now widely adopted. As a result, addressing application-level security challenges, including authentication, authorization, access control, and API integration, has become more important than ever.
In recent years, initiatives such as SAST and OSS vulnerability management through SBOM utilization have significantly improved the visibility of risks within source code and software supply chains. However, vulnerabilities arising from weaknesses in authentication and authorization mechanisms, access control flaws, and business logic issues, which stem from the relationships among multiple processes and functions, cannot always be adequately detected by traditional rule-based analysis.
In this session, we will introduce a new approach to vulnerability detection using DryRun Security, an AI-powered reasoning SAST solution. By understanding code context and processing intent, AI can identify vulnerabilities that conventional analysis methods may overlook. We will examine how this approach complements traditional SAST and OSS vulnerability management and explore new ways to address risks hidden within authentication, authorization, and business logic.