Blog
Ostorlab Blog
Vulnerability research, CVE deep dives and engineering write-ups from the Ostorlab team on AI pentesting and mobile, web and API security testing.
Ostorlab Neutron Leads UC Berkeley CyberGym: 100% Detection and 96.75% Verified Exploitation
A technical deep-dive into how Ostorlab Neutron achieved 100% vulnerability detection and a 96.75% verified exploit solved rate (1,458/1,507 tasks) on UC Berkeley's CyberGym benchmark, combining pure source reverse engineering with deterministic protocol modeling.
Sep 15, 2026
AI Pentesting for SOC 2: 6 Providers Compared
Compare Ostorlab, XBOW, Aikido, Intruder, Escape and Penti for SOC 2 pentests on exploit evidence...
Sep 25, 2026
Best Tools for Testing Mobile App Shielding Bypass
Compare Apktool, JADX, Ghidra, Frida, Objection and LLDB for manual tests with Ostorlab’s automat...
Sep 23, 2026
Post-Mortem: Why Autonomous AI Agents Escape Scope and How to Contain Them
A technical post-mortem on an AI agent that wandered outside its testing scope during an authoriz...
Sep 18, 2026
Read by Topic
Latest from Engineering, Product & SecurityWhen Does an AI Scanner Become an AI Pentest?
Learn what separates AI-powered scanning from AI pentesting and how Ostorlab Deep Agentic Scan follows evid...
Jul 22, 2026
Source Code Security: From Signal to Validated Risk | Ostorlab
Learn how source code security testing works, why traditional SAST creates false positives, and how agentic...
Jul 16, 2026
The App Was Never Opened
Agentic harnesses change what an LLM can do in mobile app security testing. On its own, a model can name li...
Jun 25, 2026
Best On-Premises AppSec Testing Platforms (2026)
Compare Ostorlab, Invicti, Burp Suite DAST, HCL AppScan and Fortify for on-premises AppSec testing: deploym...
Sep 15, 2026
Best EASM Platforms in 2026: 7 Tools Compared
Compare 7 external attack surface management platforms, such as Ostorlab, Defender EASM, Cortex Xpanse and ...
Sep 11, 2026
Best Web App Security Testing Tools in 2026
Compare Ostorlab, Burp Suite DAST, Invicti, InsightAppSec, AppScan, XBOW and OWASP ZAP, plus when DAST is e...
Sep 11, 2026
AI Pentesting for SOC 2: 6 Providers Compared
Compare Ostorlab, XBOW, Aikido, Intruder, Escape and Penti for SOC 2 pentests on exploit evidence, human re...
Sep 25, 2026
Best Tools for Testing Mobile App Shielding Bypass
Compare Apktool, JADX, Ghidra, Frida, Objection and LLDB for manual tests with Ostorlab’s automated Android...
Sep 23, 2026
Post-Mortem: Why Autonomous AI Agents Escape Scope and How to Contain Them
A technical post-mortem on an AI agent that wandered outside its testing scope during an authorized API ass...
Sep 18, 2026
Changelog
View all changesThe Breach Brief Newsletter
Weekly offensive AI and cybersecurity breakdowns curated by Ostorlab.
Would You Like a PoC With That?
Sep 23, 2026
Agents Bake. Who Tastes?
Sep 16, 2026
Too Spicy For The Menu
Sep 09, 2026
Who Gets the Prime Cut?
Sep 03, 2026