Modernizing the Application Penetration Engagement and Reporting Lifecycle
summary
Claims a full rebuild of the application penetration engagement lifecycle: moves from Word + VBA + SmartDocs + SharePoint snippets to a content-first pipeline with 400+ template findings imported into a Microsoft list, automated exports into Plex trck (CKEditor HTML), and orchestration by Microsoft 365 and Power Platform flows. It records DAST vs manual discovery, auto-generates scoped emails to sales and PM, enables analytics on scoping accuracy, and reduces copying errors — migration works but surfaces platform bugs and some manual fallbacks remain.
AI-written summary · about
chapters (10)
- 0:00Modernizing pen testing
- 3:13Legacy engagement pain points
- 16:54Reporting challenges
- 21:52Reporting modernization
- 26:28Choosing PlexTrac
- 29:16Migrating template content to Microsoft 365
- 32:29Automating workflows
- 36:17Centralizing data
- 38:42Lessons learned
- 40:07Next steps
related talks
43mBuilding a Secure DevOps Pipeline
53mLessons Learned: A Retrospective on Application Security Failures
30mFrom Zero to a DevSecOps Hero: Extending Microsoft Sentinel
03h 28mEntra ID & M365 as Code with DSC
51m600 apps in 60 days: Our journey to uncover vulnerable dependencies at scale with ...
31mAutomated compliance testing tools for 365 apps
30mSecuring DevOps using OWASP DevSecOps Tools
19mFlagship Projects: Mobile Security Testing Guide