DAST, API security, and the work behind it.
Practical guides and original research on dynamic application security testing, API discovery, DevSecOps, and AI-era code security.
Top 10 DAST Tools in 2026 (Honestly Ranked)
An honest, criteria-based ranking of the top DAST tools in 2026, including where our own product wins and loses.
Read full post → GuideAPI and Application Security Testing: What You Should Know
Our comprehensive guide to next-generation API and application security testing: why legacy DAST and SAST miss API-first apps, how discovery-driven testing works, and how NightVision maps to federal API security requirements.
Buyer's GuideTop 10 API Security Tools in 2026 (Honestly Ranked)
Runtime protection, testing, and discovery compared, honestly ranked across the API security category.
InsightTeamPCP Shows Why “Secure the App” Now Means “Secure the Pipeline”
TeamPCP's supply-chain attacks turn stolen CI/CD secrets into ransomware. Learn how DAST and API discovery shrink the blast radius of pipeline compromise.
InsightThe Native Domain of Agentic Engineering
Why static analysis is the native domain of agentic engineering: AI agents both build and rely on static analysis, powering API eNVy's rapid evolution.
AnnouncementsNightVision Skills for Claude Code Are Now Available. Here's What They Do.
NightVision skills for Claude Code: four skills covering scan configuration, API discovery, finding triage, and CI/CD integration, installable in a minute.
InsightClaude Code Security Is Here. What It Changes, and What It Doesn’t.
Claude Code Security is strong at code reasoning and patches. Here's how NightVision's API inventory controls and runtime DAST complement that scope.
ResearchYour Crawler Is Testing the Same Button 50 Times. Ours Isn't.
FragGen, NightVision's fragment-based crawler upgrade, skips redundant page components, delivering 3.5x more states and 5x faster crawl efficiency.
InsightBeware the Invisible APIs: The Serious Threat Posed by AI Coding Assistants
AI coding assistants create shadow APIs faster than teams can document them. Why legacy security tools fail and how code-level API discovery closes the gap.
ResearchIntroducing Automated Authentication Issue Remediation: From Detection to Pull Request in Minutes
API eNVy now finds authentication vulnerabilities, generates fixes with LLMs, and opens ready-to-review pull requests, in minutes instead of weeks.
ResearchIntroducing Intelligent Waits for Spidering
NightVision's crawler now uses WebDriver BiDi network and DOM signals instead of fixed delays, so spidering captures fully rendered dynamic web apps.
InsightWhy Every Business Needs NightVision's DAST
Legacy DAST misses undocumented APIs and breaks on modern apps. See how NightVision discovers APIs from code, then attacks them with code-traced proof.
InsightFederal API Security Requirements (U.S.) - and How NightVision Helps
How federal mandates from NIST, CISA, OMB, FedRAMP, and EO 14028 shape API security, and how NightVision's API eNVy plus gray-box DAST helps you comply.
ResearchIntroducing Intelligent Form Handling for DAST Scans
Web forms are gateways to core app features but hard for crawlers to handle. NightVision's LLM-augmented spider generates context-aware form inputs for DAST.
InsightAPI‑Security Approaches in 2025
A breakdown of six API-security approaches in 2025, WAFs, traffic mirroring, spec linting, legacy DAST, and why hybrid DAST plus code-intelligence wins.
InsightIntroducing Broken-Flask: Why SAST, DAST, and CNAPP Aren't Enough
Broken-Flask is an intentionally vulnerable Flask API whose SQL injections evade SAST, SCA, CNAPP, and traditional DAST, proving exploitability is what matters.
InsightMother Knows Best: Fix API Security Problems at Their Source
Reactive API security costs more than prevention. Learn why code-level API discovery plus CI-speed DAST fixes inactive, zombie, and shadow APIs at the source.
InsightFast DAST That Runs at Developer Speed
Modern DAST now runs in minutes, not hours. Eight reasons to plug dynamic security testing into CI, plus how NightVision scans at developer speed.
ResearchIntroducing the NightVision MCP Server: A New Way to Interact with NightVision
The open-source NightVision MCP Server lets AI assistants like Claude and Cursor run DAST scans, discover APIs, and fetch results via natural language.
ResearchNext.js Middleware Bypass (CVE‑2025‑29927) Detection
CVE-2025-29927 lets attackers bypass Next.js middleware via the x-middleware-subrequest header. NightVision's nuclei template detects it with a two-stage approach.
InsightToday Yogi might have said: "You can learn a lot from Discovery."
Why static-analysis API discovery beats the traffic-monitoring approach: faster, cheaper, complete, and it finds inactive, zombie, and shadow APIs before deployment.
Press ReleaseNightVision Transforms Secure Software Development With Application Testing Solution
NightVision launches a gray-box AppSec testing solution that identifies and locates exploitable vulnerabilities in minutes, before code reaches production.
AnnouncementsNightVision Has Completed a SOC 2 Exam. Here's What It Means for You.
NightVision has completed a SOC 2 Type II examination. Learn what a SOC 2 report is, what it covers, and why it matters for the security of your data.
Press ReleaseNightVision Bolsters Advisory Board To Propel Development and Deployment of Application Security Testing Solutions
NightVision builds a high-powered Advisory Board and adds cybersecurity veterans John Steven and Shaun Murphy to its Board of Directors to guide AppSec growth.
AnnouncementsNightVision Raises $5.4 Million In Seed Funding to Develop Fast and Easy-to-Use Application Security Testing
NightVision secures $5.4M in seed funding to build fast, easy-to-use gray-box application security testing that finds exploitable vulnerabilities pre-production.
IndustryThe Essential Role of Dynamic Application Security Testing (DAST) in Complementing Static Application Security Testing (SAST)
Why DAST is essential alongside SAST: it proves vulnerabilities exist by simulating real attacks, works with any framework, and cuts false-positive noise.
Press ReleaseNightVision Now Discovers and Documents Software Application Programming Interfaces (APIs) In Seconds
NightVision releases API eNVy, an API discovery and documentation solution that uncovers shadow APIs in seconds using static analysis, no agents required.
AnnouncementsNightVision hires Qilong Wang to lead Engineering, to Help Shift the DAST Space Towards Developers
NightVision appoints Qilong Wang as VP of Engineering, bringing leadership experience from Mobi, SilverRail, Gomez, and Dynatrace to its developer-first DAST.
Experience confidence in your AppSec program.
Run a free NightVision scan, validated findings on your own app in 10–15 minutes.