As software systems become larger, more complex, and more connected, the threat landscape is evolving. Meanwhile, software testing processes and tooling are struggling to keep up. Compliance-driven security efforts fail to account for the daily reality of developers, leaving software systems vulnerable to potentially catastrophic security breaches such as log4shell.
AI-powered software testing is about to revamp the way we develop and secure code. In this article, I want to explain why the rise of AI-powered testing tools is introducing the cultural and procedural change we so desperately need to build secure applications amidst growing complexity.
Application Security Is Struggling to Keep Up With the Speed of Change
50% of organizations experienced an API security incident last year (Google Cloud, 2022). This comes as no surprise: while software systems are becoming larger in size, more interconnected and more interdependent, many industries are still using software testing processes and tooling that are ill-equipped to address the security challenges that these developments pose.
Across many industries, such as finance, healthcare, and government, security efforts are driven by compliance. While it can be an effective instrument to ensure testing is considered at the management level, compliance-driven security alone is insufficient for dealing with today’s threat landscape. Usually, large parts of compliance-driven security consist of pentests, which have many downsides including:
- Inconclusive results due to lacking code coverage measurements
- Issues are found late, as tests aren’t done for every deployment
- Tests only scratch the surface due to timeboxes
- Tests are overly expensive given their suboptimal ROI
Since this approach lacks code coverage it puts testers on par with attackers, as they have no way of determining which parts of the source code were traversed by their inputs. As attackers often are not bound to timeboxes, one could even argue that they have an advantage.
Nonetheless, black-box pentests are often enough for compliance.
Recommended AI ML Blog:
AI Shifts Incident Management From Reactive to Proactive
How AI-Powered Software Testing Enables Dev Teams to Stay Ahead
With the help of AI, large parts of test case generation can be automated. Traditional testing methods (e.g., classic unit tests) use few deterministic test cases to test for the known-unknown, i.e., a program state that the tester suspects to be erroneous. By enhancing this approach with self-learning AI, developers can generate thousands of additional test cases every second to test for the unknown-unknown, i.e., bugs and security issues that the tester would never have thought of.
By using genetic algorithms, AI-powered white-box testing tools can gather information about previous test runs, which they can then use to auto-generate new test inputs that reach deeper into the software under test. This gives developers full visibility into the code coverage of their tests and allows them to uncover deeply hidden bugs and security vulnerabilities beyond the reach of traditional testing tools. Leveraging the source code in this way can be compared to solving a maze with full visibility over its paths. While a black-box test would be the equivalent of trying to find a path that leads to a bug by pure chance, AI-powered white-box tests are the equivalent of simply covering all paths.
How AI Is Transforming Security Processes and Culture
AI-powered testing tools have the potential to empower developers to take ownership of security. By integrating them into CI/CD processes, developers can independently test their code for deeply hidden security and quality issues as easily as they would write a unit test. This form of test automation has tremendous cultural implications, as it introduces thorough testing into every single pull request, starting at the early stages of the SDLC.
A relevant concern regarding this setup is whether or not it makes sense to give developers ownership of testing. Aren’t they busy enough as it is? After all, AI-powered testing tools should not lead to increased workloads for developers. For precisely this reason, it’s crucial that AI testing tools are highly automated and integrated into CI/CD so they can seamlessly run in the background. Developers can then focus on interpreting test results and remediating findings. This way, automated testing tools can speed up the development process by allowing developers to find and fix hidden bugs and vulnerabilities before they make it into the codebase.
Who Will Be Replaced By AI?
AI-enabled testing tools are not expected to replace developers in the near future; instead, they will empower them to produce code that is not only better but also more secure. Even for security professionals, the rise of automated testing tools will not result in replacement, as security is becoming increasingly important in today’s landscape. More likely, automated security tools will allow security professionals to shift their focus towards higher-level tasks that require human expertise and critical thinking, such as designing more robust security architectures.
Read More:
Generative AI: The Next Wave of Personalization Demands Greater Agility
AI Will Inevitably Make our Software More Robust
Ultimately, the emergence of AI-enabled testing tools holds vast promise for the way we build, test, and secure software and our perception of how testing should be done.
In the long run, humans might or might not become obsolete in application security. Who knows. For now, the role of AI in security will be to find bugs in places where human intelligence would never have looked and to empower devs to focus on what they do best: innovate.
Comments are closed.