A DevSecOps team already runs static code analysis and dependency scanning early in their CI/CD pipeline. However, a recent penetration test found authentication bypass and session-handling flaws that only manifest when the application is actually running. Which additional automated testing stage should the team add to catch these runtime vulnerabilities before production release?