Michael Howard (Principal Security Program Manager)

Multipass:
- Run all available tools
- Look for patterns
- Deeper review of riskiest code

What does the bad guy control

- SQL injection issues
- Crypto issues (ie SHA512)
- Server XSS antixss library
- Integer Arithmetic issues
- Buffer overflow

Build or buy a Fuzzer