APIs sit at the center of AI-powered apps, LLMs, and MCP servers, and most teams cannot see all of theirs. Abhinav Mishra shows how Qualys TotalAppSec discovers shadow APIs, tests them, and drives remediation. Join us at ROCon Americas, October 13-15 in Austin, Texas: https://www.qualys.com/rocon/2026/americas Try Qualys ETM free for 30 days: https://www.qualys.com/free-trial-new/enterprise-trurisk-management Recorded at Black Hat USA 2026, this session walks through runtime discovery of APIs and web apps with a single connector, eBPF-based traffic analysis, AI-powered scan optimization, and DAST with real-time testing for issues like SQL injection and broken object level authorization (BOLA). Findings trace back to the code commit and committer, feed TruRisk prioritization, open tickets in ServiceNow, Jira, and Azure DevOps, and trigger automatic retesting in CI/CD pipelines. The core problem is visibility. Qualys customers who expect 30 to 40 APIs often find close to 280 that were never scanned, and AI adds more shadow assets in the form of unsanctioned models and MCP servers, all of which call APIs. The demo ends with an application risk score dropping from 800 to 540 after Rocky builds a patch plan. Speaker: Abhinav Mishra, Director, Product Management, Qualys Chapters: 0:00 Intro: application security in the AI age 0:24 Public-facing apps and APIs at the center of AI 1:24 Why periodic scanning breaks in the frontier AI era 2:12 TotalAppSec: runtime discovery, validation, and remediation 3:22 Shadow APIs: 40 expected, close to 280 found 4:47 AI-powered scan optimization 5:42 DAST, custom signatures, and TruRisk prioritization 7:16 Remediation and CI/CD retesting 8:05 Demo: connectors and API discovery 11:01 Demo: BOLA detection and payload evidence 12:56 Demo: Rocky prioritizes and builds a patch plan 14:07 Risk score drops from 800 to 540 #BlackHat2026 #APISecurity #AppSec

 62      0