Why broken access control testing still relies heavily on manual work

Broken object-level authorization has ranked at the top of the OWASP API Security Top 10 for years, yet scanners struggle to detect it. The core difficulty is that such flaws produce well-formed responses that look valid, so detecting them requires knowing who the caller is and whether they should access the object. Effective testing needs at least two real user identities with their own data, plus the ability to carry object IDs between sessions and across state changes. Determining whether a result is a true leak or an acceptable outcome also requires contextual judgment, and automated tools must avoid both false positives and missed breaches. The author describes a two-session differential approach that attaches evidence to each finding and separates unconfirmed results from confirmed vulnerabilities.