Conf42: DevSecOps 2025

Do Threat Models Dream of Fuzzing Apps?

we’re introducing a new technique that uses existing tools in a novel way: using a threat model as a configuration file for continuous, adaptive pentesting: * parse model, get attack surface, risks. * create scanner inputs for ZAP, Nuclei, and fuzzers. * Scan * Filters results * Report