10 Security Gaps DAST Misses That Agentic AI Finds

DAST tools occupy a comfortable position in most application security programs. They integrate into pipelines, run without supervision, and produce reports that look thorough. For the category of vulnerabilities they are designed to catch, they do exactly what they promise.

The problem is what that category excludes.

Dynamic application security testing works by firing payloads at a running application and matching responses against a signature library. That model handles surface-level, input-output vulnerabilities well. It handles anything requiring context, state, reasoning, or multi-step logic poorly or not at all. And the vulnerabilities that live in those blind spots are exactly the kind that show up in serious security incidents.

Agentic AI pentesting is built specifically to close that gap. Instead of matching patterns, agentic systems reason through attack paths the way a skilled human tester would, adapting in real time to what the application reveals. The result is coverage across the full attack surface, including the ten categories below that DAST consistently cannot reach.

1. Broken access control and IDOR

Broken access control is the top vulnerability in the OWASP Top 10 and among the most common findings in real pentest engagements. Insecure direct object reference (IDOR) is its most exploitable form: user A can access user B's data simply by changing a resource identifier in the request.

DAST cannot model this. To find an IDOR, a tool needs to authenticate as user A, request resource 1042, then authenticate as user B and confirm that 1042 is accessible from a session that should not have permission. DAST has no multi-user context model and cannot reason about which resources belong to which users.

Agentic AI pentesting creates full session context for multiple users and actively tests whether authorization boundaries hold between them. It does not just flag that a parameter is present; it proves whether it is exploitable.

2. Business logic vulnerabilities

Business logic vulnerabilities are among the hardest to find automatically and among the most impactful when exploited. They do not manifest through malformed input or broken HTTP handling. They manifest when an attacker understands what an application is supposed to do and finds a sequence of steps that violates that intent.

Common examples: applying a discount code twice by manipulating request order, bypassing a multi-step approval workflow, triggering a negative balance by submitting a negative quantity, or skipping a step in a multi-stage onboarding flow to access a feature that should not yet be available.

DAST has no model of application intent. It cannot identify that skipping step 3 of 4 reaches an unauthorized state, because it does not know what the steps are supposed to accomplish. Agentic systems map workflow structure, infer intended behavior, and then systematically test deviations from it.

3. Multi-step authentication bypasses

Authentication is one of the most consistently broken areas in real-world applications, but the flaws rarely live in the obvious places. DAST can test whether a login form accepts weak passwords or whether a JWT has the right algorithm. It cannot reason through multi-step flows.

Multi-step authentication bypasses require understanding the sequence: what state the server expects after step 1, what happens if step 2 is skipped, whether the final token is issued without validating that all prior steps completed correctly. These are logic flaws, and finding them requires tracing execution across multiple requests with stateful context.

Agentic AI pentesting traces these flows end to end. It models each step of an authentication sequence, identifies which state transitions the server validates and which it assumes, and systematically tests whether the flow can be short-circuited to reach an authenticated state without completing legitimate steps.

4. Race conditions in transactions and sessions

Race conditions occur when two concurrent requests interact with shared state in a way the application did not anticipate. The classic example is a double-spend: submit a withdrawal request twice in rapid parallel succession and the balance check on both requests reads the same pre-withdrawal balance, allowing both to succeed.

These vulnerabilities are invisible to sequential DAST scanning. A tool that fires one request at a time cannot observe the conditions under which race conditions surface, because the flaw only appears when requests interleave at the right moment.

Agentic systems can fire parallel requests with precise timing, monitor for state inconsistencies, and confirm whether race conditions produce exploitable outcomes, a class of finding that sequential automated tools structurally cannot reach.

5. Chained attack paths

A single low-severity information disclosure rarely gets prioritized. A low-severity information disclosure that feeds into a medium-severity authentication weakness that chains into a high-severity privilege escalation is a different matter entirely.

Real-world breaches rarely hinge on a single flaw. They chain multiple weaknesses across components into a path that leads to significant impact. DAST tests each endpoint in isolation and has no mechanism for connecting findings across a session.

This is where the gap between DAST and agentic pentesting is most commercially significant. Agentic systems carry context across the entire assessment. When they discover a subdomain exposing internal API documentation, they do not report it in isolation. They use it to target the API, test whether the internal endpoints enforce authentication, and chain the discovery into a demonstration of what an attacker could actually reach. The 10x Pentest platform is built around this exploit-chaining model, treating the assessment as a coherent attack rather than a list of independent endpoint tests.

6. Authenticated application surfaces

Most applications are not fully accessible without credentials. Admin panels, account settings, transaction histories, user management interfaces, API endpoints that require tokens. DAST can be given credentials, but its ability to navigate complex authenticated state is limited.

Multi-step flows with required field sequences, role-based interfaces that present different options to different users, stateful workflows that change available actions based on prior steps, these are difficult for DAST to traverse reliably. In practice, large portions of authenticated application surfaces go untested.

Agentic pentesting maintains authenticated sessions with full state awareness. It navigates role-based interfaces, tracks what each role can access, and systematically tests whether privilege boundaries hold between roles, covering the surfaces where the most sensitive functionality lives.

7. Second-order and stored injection flaws

Second-order injection occurs when malicious input is stored in the application and later executed in a different context. The classic case: a username field that does not trigger SQL injection at registration because the input is parameterized, but is later interpolated into an administrative query without proper handling when an admin views the account.

DAST tests the immediate response to input. It fires a payload at a field and checks whether the response indicates injection. If the payload is stored and executed later in a different request context, DAST will not observe it. The injection and the execution are separated by time and context.

Agentic systems follow the data. When they submit input that is stored, they track where that input appears downstream, what context it is rendered or executed in, and whether the handling in that later context is safe.

8. GraphQL and non-REST API vulnerabilities

Modern applications increasingly expose GraphQL APIs alongside or instead of traditional REST endpoints. GraphQL has a fundamentally different attack surface: introspection queries that expose the full schema, deeply nested queries that enable DoS through query complexity, batching attacks, and authorization checks that may not apply uniformly across resolver functions.

DAST was designed for HTTP request-response patterns on REST APIs. It has limited capability to explore GraphQL schemas intelligently, test nested query abuse, or reason about whether authorization is consistently enforced across resolver functions for the same underlying data.

Agentic systems perform GraphQL introspection, map the full schema, and test each resolver for authorization consistency, finding the patterns where one data path is protected but a logically equivalent path through a different resolver is not.

9. JWT and token implementation flaws

JSON Web Tokens are widely used for authentication and authorization, and their implementations contain a predictable set of flaws: the algorithm confusion attack that accepts "none" as a valid signing algorithm, weak signing secrets that are brute-forceable, tokens that remain valid after logout because there is no server-side invalidation, and claims that are trusted without server-side validation.

DAST can flag that a JWT is present and check whether obvious settings like weak algorithms are configured. It cannot systematically test whether the secret is weak by attempting to brute-force it, cannot verify whether logout actually invalidates the token server-side, and cannot probe whether claim tampering is validated for every protected endpoint.

Agentic AI pentesting treats token handling as a coherent attack surface. It tests the full lifecycle: issuance, use, modification, expiry, and invalidation, producing findings that cover the implementation rather than just the surface configuration.

10. Server-side request forgery (SSRF)

SSRF occurs when an application can be manipulated into making server-side HTTP requests to internal resources, including cloud metadata services, internal APIs, and private network endpoints. It is consistently one of the most impactful vulnerability classes in cloud-hosted applications because successful exploitation often leads to credential theft via metadata service access.

Finding SSRF requires understanding which parameters the application uses to construct outbound requests, testing a range of internal targets including cloud provider metadata endpoints, and observing whether the application's response reveals information about what it contacted.

DAST has limited capability here because SSRF detection requires reasoning about what the server is doing internally, not just what it returns to the client. Agentic systems test SSRF systematically, including blind SSRF scenarios where the response does not directly confirm the request was made but where out-of-band signals confirm server-side interaction.

Why these gaps matter

Each of the ten categories above represents real vulnerabilities that appear in real production applications. The fact that DAST does not find them does not mean they are not there. It means they remain in place after every automated scan, quietly waiting for someone who reasons about them rather than patterns against them.

That is the distinction that separates agentic pentesting from automated scanning. As described in the overview of agentic pentesting and continuous security validation, agentic systems do not just check whether known patterns are present. They reason through the application's behavior, adapt their approach based on what they discover, and produce findings with proven exploitability rather than theoretical risk.

DAST belongs in security programs as a fast, cheap detector of surface-level regressions. But treating DAST coverage as application security coverage leaves all ten of these gaps open. For teams who want to close them without waiting weeks for a traditional pentest, continuous agentic pentesting is how that becomes operationally realistic.

Frequently asked questions

1. Why can't DAST find business logic vulnerabilities?

DAST operates by matching application responses against a library of known vulnerability signatures. Business logic flaws do not have signatures. They require understanding what an application is intended to do and then identifying sequences of steps that violate that intent. That kind of reasoning is outside the architectural model that DAST is built on. No amount of configuration makes a pattern-matching system capable of inferring application intent.

2. Is DAST still worth using if it misses these ten categories?

Yes, but with accurate expectations. DAST is fast, inexpensive to run continuously, and reliably catches surface-level issues like reflected XSS, SQL injection in accessible parameters, missing security headers, and insecure cookie configuration. For those specific categories, it adds value. The mistake is treating a clean DAST report as evidence of broad security coverage. The ten gaps above are structural, not configuration issues, and will remain regardless of how DAST is tuned.

3. How does agentic AI pentesting find broken access control if DAST cannot?

Agentic systems create multi-user session context. They authenticate as one user, map the resources that user can access, then authenticate as a second user with different permissions and systematically test whether those resources are accessible from the lower-privilege session. This is the same methodology a human pentester uses. DAST cannot replicate it because it has no model of which resources belong to which users.

4. Can agentic AI pentesting run continuously the way DAST does?

Yes. Agentic pentesting is designed for continuous operation, triggering on deployment events and running against the full application surface without requiring scheduling or human coordination. Unlike traditional manual pentesting, which is a periodic event, agentic testing operates at the pace of development. You can see how this works in practice on the 10x Pentest platform page or review pricing to understand what continuous coverage costs at your team's scale.

5. What is the best way to combine DAST and agentic pentesting?

Use DAST in CI/CD pipelines for fast detection of known vulnerability signatures on every build. Use agentic pentesting for continuous coverage of the full attack surface, including all ten categories above, running on a schedule that matches your deployment cadence. The two tools do not compete for the same job. DAST catches surface regressions quickly. Agentic pentesting finds the issues that matter most. For teams ready to move from periodic testing to continuous security validation, get in touch to see what that looks like for your stack.