Understand how Threat Led Penetration Testing (TLPT) establishes a foundation for DORA compliance Watch the video›

A Deep Dive Into Fuzzing

Get the buzz on fuzz testing in software development.

Get the buzz on fuzz testing in software development

Did you know fuzzing is a great way to spot vulnerabilities and bugs in your software? If you're thinking about adding this technique to your software testing toolkit (or taking it to the next level), this episode can help!

Used extensively by security researchers, fuzzing (aka fuzz testing) has become popular with software developers too. And for good reason. Fuzzing utilities are available for a wide variety of use cases and can be left running for days at a time with minimal interaction.

Watch the on-demand session with Bishop Fox alumnus Matt Keeley.

What We Learned: 

In this session, Matt explored fuzzing as a dynamic testing approach for uncovering software vulnerabilities. We covered the key differences between black-box and white-box fuzzing, how instrumentation-guided fuzzing improves code coverage, and why mutation-based vs. generation-based fuzzing matters. The discussion also highlighted real-world applications, from binary analysis and memory corruption detection (heap overflows, use-after-free, out-of-bounds reads/writes) to identifying race conditions and DoS vectors in web applications and network protocols.

The session included a live fuzzing demo using AFL (American Fuzzy Lop) to target a compiled binary, demonstrating how input mutation and execution tracing can efficiently surface segmentation faults and exploitable conditions. We also covered CI/CD pipeline integration, harnessing techniques for deeper code coverage, and how symbolic execution can refine fuzzing strategies. The Q&A tackled best practices for triaging crashes, distinguishing between exploitable vs. non-exploitable bugs, and when to consider custom fuzzing setups over existing frameworks. Watch the replay to explore how fuzzing can harden your applications against real-world attacks.


Matt k

About the speaker, Matt Keeley

Security Researcher

Matt Keeley is former Senior Security Consultant at Bishop Fox specializing in application penetration testing, product security reviews, and source code analysis. He holds a Bachelor of Science in Computer Science (Cybersecurity) from Arizona State University Master of Science Computer Science from Georgia Institute of Technology. During his sophomore year at ASU, Matt co-founded the DevilSec cybersecurity club, where he presents weekly red/blue team topics to students and arranges for top speakers, CEO’s, and guests of honor to present on industry related subjects. Matt is an avid security researcher and is considered an internal subject matter expert for product security reviews. He was also recently quoted in IT Business Edge and interviewed on the InfoSec Prep podcast. Matt currently holds his OSCP, OSWE, OSCE, OSWP and CRTO certifications.

More by Matt

Joe sechman

About the speaker, Joe Sechman

AVP of R&D at Bishop Fox

Joe is a Bishop Fox alumnus. Over his career, Joe has amassed many security certifications, delivered several presentations, and has co-authored multiple industry publications with groups such as ISC2, ISACA, ASIS, HP, and IEEE.

Additionally, Joe is a prolific inventor with nine granted patents in the fields of dynamic and runtime application security testing, attack surface enumeration, and coverage (U.S. Patents 10,699,017, 10,515,219, 10,516,692, 10,515,220, 10,423,793, 9,846,781, 10,650,148, 10,587,641, and 11,057,395). Prior to joining Bishop Fox, Joe held leadership positions with companies such as Cobalt Labs, HP Fortify, Royal Philips, and Sunera LLC (now Focal Point Data Risk). Earlier in his career, Joe served as the lead penetration tester within SPI Labs at SPI Dynamics where he cut his teeth alongside some of the best and brightest application security industry professionals. Joe received his Bachelor of Business Administration degree in Management Information Systems from the Terry College of Business - University of Georgia.
More by Joe

This site uses cookies to provide you with a great user experience. By continuing to use our website, you consent to the use of cookies. To find out more about the cookies we use, please see our Privacy Policy.