All articles

Security

Ostorlab vs MobSF (Mobile Security Framework) for mobile app security testing: static and dynamic analysis, device re...

Security

Ostorlab vs Oversecured for mobile app security testing: iOS and Android coverage, exploit proof, authenticated testi...

Product

The best Snyk Code, Checkmarx One and GitHub Advanced Security alternatives for SAST in 2026, and how Ostorlab compar...

Product

How a small agent that turned bug tickets into pull requests became Ostorlab's ticket agent: an AI teammate you give ...

Engineering

False positives are an engineering-capacity problem, not only a scanner-quality problem. Learn how to measure their c...

Product

Ostorlab fits teams testing connected mobile, web, API, and code assets on every release. Where it fits, which plan t...

Security

Ostorlab vs. pentesting firms: cost, testing frequency, depth and remediation, and when to use AI pentests, consultan...

Security

API-only scanners miss attack chains that start with secrets or routes in mobile apps, web bundles, or code. Two real...

Security

Compare Ostorlab, XBOW, Aikido, Intruder, Escape and Penti for SOC 2 pentests on exploit evidence, human review, samp...

Security

Manual app pentests cost $3,000–$50,000+ in 2026; published AI pentests run $499 to about $8,000. What drives price, ...

Security

Compare Apktool, JADX, Ghidra, Frida, Objection and LLDB for manual tests with Ostorlab’s automated Android and iOS m...

Product

How Ostorlab's Deep Agentic Scan uncovers and empirically proves complex vulnerabilities across web, mobile, and sour...

Security

Static analysis flags possible bugs but cannot prove them. Runtime validation proved a Langflow authenticated RCE and...

Security

See how Ostorlab's Agentic Deep Scan chained a Medium-severity OpenAPI disclosure and an SSRF vulnerability to bypass...

Security

The best API security testing tools in 2026: StackHawk, 42Crunch, Escape, and Ostorlab compared on DAST, BOLA/BFLA te...

Security

A technical post-mortem on an AI agent that wandered outside its testing scope during an authorized API assessment, w...

Security

Learn how B2B SaaS startups bypass the 4-week consultancy delay to generate audit-ready SOC 2 pentest reports and Let...

Security

A technical deep-dive into how Ostorlab Neutron reached a 97.1% verified exploit solve rate (1,463/1,507 tasks) and l...

Product

Compare Ostorlab, Invicti, Burp Suite DAST, HCL AppScan and Fortify for on-premises AppSec testing: deployment model,...

Security

Ostorlab Neutron reached a 97.1% verified exploit solve rate on CyberGym, producing working differential proofs of co...

Product

Compare 7 external attack surface management platforms, such as Ostorlab, Defender EASM, Cortex Xpanse and CyCognito,...

Product

Compare Ostorlab, Burp Suite DAST, Invicti, InsightAppSec, AppScan, XBOW and OWASP ZAP, plus when DAST is enough and ...

Product

Compare Ostorlab, NowSecure, Quokka, Zimperium, Appknox and Data Theorem for Android and iOS app vetting: operating m...

Product

Compare leading AI pentesting platforms in 2026 by asset coverage, autonomous exploitation, attack chaining, evidence...

Security

Compare traditional pentests, PTaaS and autonomous AI testing: where agents win on coverage and evidence, where human...

Product

Multi-Asset Deep Agentic Scan assesses related mobile, web, API, network, source-code, and documentation assets in on...

Security

Detection and enforcement are different security properties. Across five production banking apps protected by four co...

Security

A comprehensive guide on what penetration testing is, how much it costs for startups in 2026, the 5-step testing proc...

Product

Ostorlab now supports MCP, giving AI assistants and agents permission-controlled access to security data and workflows.

Product

Introducing Risk Reruns for Agentic Deep Scans—rerun specific risk investigations with customized effort levels, AI m...

Security

AI can produce a convincing exploit story in seconds. Runtime proof, negative controls, and human review determine wh...

Security

SOC 2 doesn't name a required testing method, so auditors judge evidence, not tools. Here's what an AI-conducted pene...

Product

Agentic Scan Knowledge gives Ostorlab security agents persistent application context, allowing every scan to build on...

Product

Ostorlab Mobile Shielding Scan tests Android and iOS protections against real bypasses, including root detection, ant...

Product

Announcing the general availability of the Ostorlab On-Premises Vulnerability Scanner, designed to identify and conte...

Security

Ostorlab vs Aikido on SAST, web and API pentesting, mobile binary testing, cloud posture, BYOK and remediation, with ...

Security

Ostorlab responds to the Appknox 'Top 10 MAST Tools' list: what it got wrong, KnoxIQ vs Agentic Deep Scan, full-stack...

Security

XBOW and Ostorlab compared on target scoping, mobile and API coverage, cross-asset exploit chaining, CI/CD testing, e...

Security

Discover how agentic AI catches business logic flaws rule-based scanners miss. See a real exploit chain escalating a ...

Security

Ostorlab vs NowSecure in six areas: cost and scale, CI/CD integration, business-logic coverage, framework support, ta...

Security

The best SAST and source code scanning tools in 2026, Ostorlab, GitHub Code Security (CodeQL), Semgrep, Snyk Code, Ch...

Product

Ostorlab Threat Center now brings EUVD intelligence alongside NVD data, giving security teams broader vulnerability v...

Security

A practical guide to designing AI-assisted security testing workflows that turn scoped evidence into reviewable findi...

Engineering

Learn what separates AI-powered scanning from AI pentesting and how Ostorlab Deep Agentic Scan follows evidence to va...

Engineering

Learn how source code security testing works, why traditional SAST creates false positives, and how agentic analysis ...

Security

A technical assessment of the latest version of GoPhish that examines how the platform handles trust: identity, untru...

Security

Ostorlab vs Quokka Q-mast for mobile DAST: authenticated flows, TLS pinning bypass, PCAP evidence, geo-restricted app...

Product

Source Code Scanning helps you identify security vulnerabilities directly in your source code before they reach produ...

Product

The latest Deep Agentic Scan release introduces faster mobile testing, improved reverse engineering, stronger vulnera...

Product

Ostorlab has launched Mobile Shielding Scan, an automated, AI-powered testing solution designed specifically for shie...

Engineering

Agentic harnesses change what an LLM can do in mobile app security testing. On its own, a model can name likely risks...

Product

Ostorlab has launched Cyber Models, a managed, prepaid AI infrastructure tier for Agentic Deep Scans. It gives securi...

Security

Walk the floor of any major cybersecurity conference today and you will hear about the promise of autonomous AI-power...

Security

This comprehensive guide covers the architecture, risk methodologies, and deployment frameworks required to architect...

Product

Ostorlab has launched App Vetting, a mobile application risk assessment solution that helps teams evaluate Android an...

Engineering

We built an AI-powered pull request reviewer, shut it down after hallucinations and false positives eroded developer ...

Product

Ostorlab is launching a powerful, highly targeted AI orchestration engine accessible through two distinct UI workflow...

Security

A technical breakdown of CVE-2026-42208, a CVSS 9.3 critical unauthenticated SQL Injection vulnerability in the LiteL...

Security

A technical breakdown of DirtyFrag, a pair of Linux kernel local privilege escalation vulnerabilities (CVE-2026-43284...

Security

A technical breakdown of CVE-2026-44109, a CVSS 9.2 Critical authentication bypass vulnerability in OpenClaw (< 2026....

Security

A deep dive into a critical Server-Side Request Forgery (SSRF) vulnerability in Chatwoot's upload endpoint (≤ v4.12.1...

Security

A DORA compliance checklist helps banking and fintech organizations evaluate operational resilience across core areas...

Security

Static analysis of TV_V_23.apk, BeatBanker/BTMOB Android banking malware disguised as a flashlight app: four-stage ch...

Security

How HarmonyOS Next security testing differs from Android: ArkTS, DSoftBus, testing tools, SafetyDetect, ArkGuard, com...

Security

How intent redirection lets attackers reach unexported Android components, leak data via setResult() and abuse Pendin...

Product

Find a vulnerability scanner for HarmonyOS apps and Huawei AppGallery releases: Ostorlab adds automated, repeatable s...

Security

Mobile game security testing prevents cheating, hacks, and revenue loss by securing client, network, and backend laye...

Security

Mobile AppSec testing for teams shipping iOS and Android fast: MAST vs SAST vs DAST, a testing checklist, CI/CD patte...

Security

How to security test patient portals, medical apps, APIs and SaMD: ePHI risks, HIPAA and GDPR duties, SDLC testing, c...

Security

Protecting mobile banking apps requires more than securing the client alone. This guide explores the risks across dev...

Security

A technical breakdown of CVE-2026-26720, a CVSS 9.8 Critical authenticated Remote Code Execution vulnerability in Twe...

Security

Manage DORA third-party risk in mobile apps with per-release SDK inventories and diffs, approval and ban rules, patch...

Security

App shielding explained: how mobile application shielding prevents reverse engineering and tampering on untrusted dev...

Security

A deep dive into two critical vulnerabilities uncovered in Roundcube Webmail (< 1.6.14, 1.5.14, 1.7 RC4) during a sou...

Product

Ostorlab now integrates with Harness CI to run automated mobile application security scans inside CI pipelines. Using...

Security

A technical breakdown of CVE-2026-27971, a CVSS 9.2 critical unauthenticated remote code execution vulnerability in Q...

Product

Why scanners stop at the login page and how Ostorlab automates testing behind SMS, email and TOTP 2FA, with a manual ...

Product

Ostorlab now integrates with Bitrise to run automated mobile application security scans inside CI workflows. Using a ...

Security

A technical breakdown of CVE-2026-2599, a CVSS 9.8 Critical unauthenticated PHP Object Injection vulnerability in the...

Security

A mobile-first guide to DORA compliance for BFSI teams. Learn how to define your scope, simplify your release process...

Product

Ostorlab has launched Agentic Deep Scan, a next-generation vulnerability scanner that validates real-world risks in i...

Security

CVE-2025-68461 (CVSS 7.2) lets SVG animate tags slip past the Roundcube sanitizer via namespace prefixes. PoC, patch ...

Security

Analysis of GHSA-cr3w-cw5w-h3fj, a CVSS 9.7 critical XSS-to-RCE vulnerability in Saltcorn (≤ 1.5.0-beta.19). Two chai...

Security

A mobile-first guide to DORA regulation and DORA compliance for BFSI teams. Learn how to define your scope, simplify ...

Security

A technical breakdown of CVE-2026-26019, a CVSS 4.1 medium Server-Side Request Forgery vulnerability in the LangChain...

Security

A mobile-first guide to DORA regulation and DORA compliance for BFSI teams. Learn how to define your scope, simplify ...

Security

The 10 tools our team uses to pentest mobile apps, from Frida, Ghidra and Jadx to mitmproxy and Nuclei, with best use...

Security

A technical breakdown of CVE-2025-64712, a CVSS 9.8 critical path traversal remote code execution vulnerability in th...

Security

A technical breakdown of CVE-2026-1357, a CVSS 9.8 critical unauthenticated remote code execution vulnerability in th...

Security

PentestGPT, PentAGI, HexStrike AI, Strix, CAI, Nebula, NeuroSploit, Deadend CLI and RedAmon compared: key features of...

Product

2025 marked the turning point where AI in cybersecurity graduated from experimental prototypes to production-grade en...

Security

From 2026, certified Android devices can block apps from unverified developers. What changes for sideloading, who is ...

Security

An AI-assisted analysis uncovered a 30-year-old uninitialized buffer vulnerability in glibc's _nss_dns_getnetbyaddr_r...

Security

Case study: Ostorlab's AI pentest engine finds an Android WebView JavaScript bridge reachable via deep links and chai...

Product

Compare Ostorlab, NowSecure, Appknox, Data Theorem, Quokka, Zimperium and MobSF for Android and iOS, with a feature m...

Security

How Android's FLAG_SECURE blocks screenshots, screen recording and recent-apps previews, with code samples, use cases...

Security

Ostorlab's AI Pentest Engine systematically uncovered a critical Broken Function-Level Authorization (BFLA) vulnerabi...

Security

Methodical analysis beats blind fuzzing as Ostorlab's AI engine discovers cross-version password reset weakness and a...

Security

How a second-order client-side data exfiltration chain was discovered in a modern SPA, transforming a simple open red...

Security

Ostorlab’s reasoning-driven AI engine breaks past rule-based limits to surface previously unknown and hard-to-detect ...

Security

The first open-source benchmark suite featuring 93 realistic vulnerable mobile apps that mirror actual CVE and bug bo...

Security

Large-scale security analysis of 500+ top mobile banking apps reveals widespread vulnerabilities, decade-old codebase...

Security

Precision beats payload spray using Ostorlab's AI engine to systematically land RCE on Titiler and proves exfiltratio...

Security

This article showcases Ostorlab's AI Pentest Engine's process for analyzing an Android application for Intent Redirec...

Security

This article presents a thorough, hands-on analysis and real-world exploitation of a hardcoded GCP service account wi...

Security

This technical analysis reveals how sophisticated attack chains—combining path traversal, symbolic link manipulation,...

Security

This article presents a thorough, hands-on analysis and proof of concept for exploiting an OOB XXE vulnerability CVE-...

Product

Ostorlab’s AI Monkey Tester transforms mobile app security testing by using natural language prompts and generative A...

Security

This article presents a thorough, hands-on analysis and proof of concept for exploiting the stored XSS vulnerability ...

Product

Ostorlab's Privacy Scan automatically detects mismatches between what your app's privacy policy says and what it actu...

Product

The Ostorlab Security Scanner GitHub Integration enhances mobile app development workflows by embedding automated sec...

Product

This article announces the new integration between Ostorlab and Vanta, explains how it works, outlines the setup proc...

Security

This research introduces a pioneering dual approach that combines signature-based matching (DalvikFLIRT) with LLM-pow...

Product

This article outlines our journey in implementing ostorlab copilot, the challenges we encountered, and the lessons we...

Product

This article announces Ostorlab's vulnerability ticketing system V2 and how it automates and streamlines the entire p...

Product

This article explores AI-automated attack surface management, its impact on cybersecurity, and how it automates asset...

Security

A technical analysis of a vulnerability in CyberPanel, a Pre-Auth Root RCE, including confirmed exploitation paths, i...

Security

This article is an in-depth look at the most common GraphQL vulnerabilities, why they occur, and how they can be mitigated.

Security

This article assesses the large-scale exposure of systems to multiple CVEs affecting the CUPS printing service, which...

Engineering

The Threat Center provides essential updates for organizations to stay informed about security threats, offering acti...

Security

An in-depth look at the CVE-2024-47374 vulnerability affecting LiteSpeed Cache plugin for WordPress, its impact, and ...

Security

How CVE-2022-21445, an actively exploited Oracle ADF deserialization flaw, gives unauthenticated attackers remote cod...

Security

The article uncovers an Arbitrary File Read vulnerability in VigorConnect that lets attackers access sensitive files....

Engineering

OXO Titan UI encapsulates OXO's capabilities within an accessible interface, democratizing advanced security scanning...

Security

Bypass 403 Forbidden responses by altering host and proxy headers, HTTP methods, parameters and URL paths, or by chec...

Product

Introducing the AI-powered Monkey Tester in the Ostorlab mobile vulnerability scanner, significantly boosting test co...

Security

CVE-2024-5315, an actively exploited Dolibarr SQL Injection with in incorrect patched-in version.

Security

E.V.A Information Security uncovered critical vulnerabilities in CocoaPods, leading to immediate patches, and develop...

Engineering

OXO version 1.0, is 10x times faster, supports ARM64 architectures, and is packed with improved capabilities like sca...

Engineering

This article offers a guide to Privacy Manifest files in Apple's ecosystem, stressing their importance for transparen...

Engineering

The article introduces a new method for detecting PostMessage Cross-Site Scripting (XSS) vulnerabilities using JavaSc...

Security

New vulnerabilities added to Ostorlab known exploited vulnerabilities catalog

Product

The article introduces Ostorlab Attack Surface Discovery as a solution for discovering and continuously monitoring mo...

Security

This article examines the security of mobile banking applications in North America, uncovering widespread vulnerabili...

Engineering

Article on Swift Dynamic Instrumentation. The article explains the steps to perform dynamic analysis of Swift-based a...

Security

New vulnerabilities added to Ostorlab known exploited vulnerabilities catalog

Security

New vulnerabilities added to Ostorlab known exploited vulnerabilities catalog

Security

The article delves into dependency confusion vulnerabilities and introduces a novel detection and exploitation techni...

Security

In this article we will Discover essential tools and empirical insights for identifying critical, high-severity, and ...

Product

As 2023 has concluded, it's time to reflect and prepare for an optimistic 2024.

Security

Release of new OWASP Mobile Top 10 with improvements, updates and a behind the scenes.

Product

Ostorlab clinches the top spot in the Swiss Cyber defense Security Challenge, showcasing their commitment to advancin...

Security

How a malicious app can hijack a custom URL scheme to take over OAuth accounts, with Google, Facebook, Cognito and Ok...

Security

Recent in-depth investigations reveal serious vulnerabilities discovered in widely-used zip packages in Flutter and S...

Security

Ostorlab has open-sourced two Flutter applications, designed to be intentionally insecure for testing and educational...

Security

This article is a technical deep dive, showing how a 100M+ installation image application can expose its user’s image...

Product

The new release brings a new AI Engine for improved recommendations, powerful new additions to Flutter detection and ...

Security

In this Article, we define a secure implementation of mobile biometric authentication and provide detailed implementa...

Security

Article on Static and Dynamic analysis techniques for Reverse engineering Flutter Applications. The article goes over...

Engineering

In this article, we look at different ways to improve the performance of Python which is an interpreted language.

Product

An overview of all the new features of the Ostorlab platform and its detection capabilities.

Security

In This article, we analyze the GodFather Android malware, which continues to appear in various formats and primarily...

Product

Ostorlab has successfully completed its SOC2 Type 2 audit, demonstrating its commitment to security and data protection.

Engineering

Ostorlab's Fix it! practice is one of our most successful engineering practices helping us eradicate bugs and kill te...

Product

Ostorlab’s new features are laser-focused on helping teams understand, track and search their attack surface, what at...

Product

Ostorlab has been selected as one of the top 10 vulnerability management innovators of 2023 by GRC Viewpoint.

Product

2022 is a year that brings with it many global challenges, including war, economic uncertainty, and rising inflation ...

Product

This article will cover the main challenges when implementing a CI/CD pipeline for mobile applications. We will also ...

Security

CVE-2022-42889 is a vulnerability in the Apache Commons Text Library caused by string interpolation abusing powerful ...

Product

As a reflection of the many new capabilities and changes we have made, we have released a new dashboard providing bet...

Product

The Mobile Application Security Verification Standard is an important step toward building secure Mobile Applications...

Engineering

Tips and tricks to make your life easier when developing & debugging OXO Agents.

Product

Largest release with improvements to Attack Surface, Open-Source, Mobile and Web scanning and much much more.

Engineering

This article talks about how OXO works under the hood.

Security

Attack Surface is not just about open ports and services; this article covers key insights beyond the standard techni...

Security

Attack surface mapping has become the number one headache of CISO's of most large organization, this article goes ove...

Engineering

This article talks about the experience of Rabson Phiri who works as a Software Engineer at Ostorlab.

Product

This article provides a comprehensive view of the security mobile security scanning solutions, while at the same time...

Product

This is a major release open-sourcing Ostorlab and announcing tons of new features and capabilities.

Security

What is the impact of Log4j vulnerability on mobile applications

Product

Wanna learn a bit more about Ostorlab? We answered Aviva Zack’s questions for Safety Detective about the Company, our...

Product

Vulnerability management is a hard journey, the help enable fixing of vulnerabilities urgently, diligently and effici...

Product

Vulnerability management is a hard journey, the help enable fixing of vulnerabilities urgently, diligently and effici...

Product

Ostorlab released the UI call coverage in the analysis environment to show the UI flow exercised during the dynamic s...

Product

Health Tech, Compromises and attacks, Instrumentation, Black Hat conferences, eBPF and more….

Security

This article is about bypassing SSL pinning without needing to. Sounds confusing? We will go over the theory, build a...

Security

This article is about WebViews and the security notions we need to have in mind when using these component in both An...

Security

Dependency Confusion is a new attack with high severity impact. This article is an overview of the vulnerability as w...

Security

The following article is a technical deep dive into how genetic algorithms can be leveraged to create superhuman XSS ...

Security

This weeks is marked by multiple high profile data breaches affecting Cashalo, Npower, Kia, T-Mobile and Clubhouse.

Product

Ostorlab is adding Web Security Scanner to its arsenal with novel approaches to vulnerability discovery.

Product

New Analysis Environment with access to disassembly, decompiled source, call trace, function tagging and many other features.

Security

Hardcoded secrets are easy to find and might open a gate to sensitive data or privileged access. This makes them a gr...

Security

The article introduces the term Autonomous Security in the context of security scanning and defines 5 tiers of maturity.

Product

Whether we are developing a mobile application or assessing its security, we need to continuously review it with ever...

Product

Ostorlab now supports creating scans directly from Android Play Store and iOS App Store

Security

Mobile security testing of Covid-19 Contact Tracing Application BeAware

Security

Mobile security testing of Covid-19 Contact Tracing Application Wiqaytna

Security

Mobile applications assessments, automation of 3rd party dependency review

Product

Xamarin decompilation, deprecated TLS protocols, hardcoded secrets and even more, Owasp top 10

Engineering

Overview of the detection capabilities provided by Ostorlab

Product

Better management of scan lifecycle, export scan results and subscriptions

Product

Announcement on changes in the management of scan accessibility

Product

Ostorlab Mobile Security Scanner Release of a new portal to track scans progress and access scan history.

Engineering

How to debug Nuxt.js application on Webstorm

Engineering

We took Cloud Run for a Test Drive, these are we what learnt.

Security

This article describes the usage of Ostorlab Insecure Application.

Security

How to perform security checks of an iOS application file on a non-jailbroken iPhone from a Linux Machine.

Product

In a mission to build the best security scanning technologies, Ostorlab team is proud to announce that the community ...

Security

Use the start of the year to contemplate how the previous year went, and prepare for the upcoming is an important exe...

Security

XSS are still by far the most common type of vulnerabilities, this article presents strategies to automate the search...

Security

This article is about how to manage AWS access keys when using AWS services in your mobile application.

Engineering

dynamic analysis

Product

The last few months, Ostorlab team has been hard at work adding exciting new features. Some of these have already hit...

Security

I will be sharing through a series of blog posts our past experimentations with the use of reinforcement learning for...

Security

the Attack Surface of mobile applications.

Security

Ostorlab is a community effort to build a mobile application vulnerability scanner to help developers build secure mo...

Security

We have been for the last few months hard at work developing a new scan engine to identify new classes of vulnerabili...

Security

Hybrid frameworks like Cordova offers the advantage of building one app for multiple platform (support for Android, i...

Security

Before we get into SQL injections and what might go wrong, we'll start by covering some technical information on Cont...

Engineering

For an Android developer, it has become standard practice to use external libraries to easily extend the functionalit...

Security

Google will start identifying security weaknesses in Apps pushed to the Play Store...

Engineering

At Ostorlab we scan hundreds of Mobile Applications each day, each scan is very resource intensive but at the same ti...

Security

In Android, the permission system was one of the major security concerns of the platform for many reasons...

Security

Implement SSL pinning on Android with Network Security Config, OkHttp and Retrofit, then test it and rotate pins safe...

Security

Apparently Facebook is crashing their apps intentionally in order to test users reaction and evaluate their adherence...

Security

The last years have come with meaningful changes in the way IT professionals operate and the way we approach security...

Product

We are pleased to release the Beta version of our online mobile application security scanner.

Security

This article will reference the best current resources on SSL/TLS.