How Agentic SAST Decodes Business Context to Hunt Privilege Escalation

[ Abstract ]

Traditional Static Application Security Testing (SAST) is highly effective at identifying syntax-based vulnerabilities like SQL injection or Buffer Overflows, but completely blind to RBAC Privilege Escalation. These bugs do not violate language syntax; they violate application-specific business logic. A tool cannot detect them without deeply understanding the "business context": what roles exist, what permissions they imply, and how objects relate to their owners. This talk presents a paradigm shift in AppSec: Semantic-Grounding SAST. We introduce AuthMatrix, an agentic scanner we developed internally that extracts business context directly from source code to construct a dynamic "Knowledge Base." This knowledge base codifies complex roles, feature flags, and app specific user role boundry (e.g., ignore the difference between superadmin and admin). Guided by this context, LLM-based subagents execute semantic reasoning to hunt for authorization discrepancies with 89-94% precision. Attendees will learn how to build agentic pipelines that reconstruct business semantics, paving the way for automated logical vulnerability detection in massive, enterprise-scale web applications.