Two months of Burp AI: empowering security testers with the future of App Sec
Summary: PortSwigger marked two months since introducing five AI capabilities into Burp Suite, including automated follow-up analysis of scanner-identified vulnerabilities, in-context explanations of cookies and headers in Repeater, AI-generated login sequences, and AI filtering of false positives in Burp Scanner starting with Broken Access Control. The company says thousands of testers have adopted Burp AI and that new AI-powered extensions have arrived in the BApp Store via the Montoya API and AI extensibility features.
Why it matters: The vendor's first false-positive target is Broken Access Control, one of the hardest vulnerability classes to detect reliably through automation - so any AI filtering applied there directly shapes which access-control findings your testers ever see.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026