Security

Compare Ostorlab, XBOW, Aikido, Intruder, Escape and Penti for SOC 2 AI pentesting, including testing coverage, explo...

Security

Compare Apktool, JADX, Ghidra, Frida, Objection and LLDB for manual tests with Ostorlab’s automated Android and iOS m...

Security

A technical post-mortem on an AI agent that wandered outside its testing scope during an authorized API assessment, w...

Security

Learn how B2B SaaS startups bypass the 4-week consultancy delay to generate audit-ready SOC 2 pentest reports and Let...

Security

A technical deep-dive into how Ostorlab Neutron achieved 100% vulnerability detection and a 96.75% verified exploit s...

Product

Compare on-premises application security testing platforms in 2026, including Ostorlab, Invicti, Burp Suite DAST, HCL...

Security

Ostorlab has reached 96.7% on CyberGym, moving ahead of the public leaderboard entries for Microsoft MDASH at 91.0% a...

Product

Compare leading External Attack Surface Management platforms in 2026, including Ostorlab, Microsoft Defender EASM, Co...

Product

Compare leading web application security testing tools in 2026, including Ostorlab, Burp Suite DAST, Invicti, Rapid7 ...

Product

An evidence-led technical comparison of enterprise mobile app vetting platforms in 2026, evaluating Ostorlab, NowSecu...

Product

Compare leading AI pentesting platforms in 2026 by asset coverage, autonomous exploitation, attack chaining, evidence...

Security

Compare traditional pentesting, PTaaS, and autonomous agentic AI testing: discover where autonomous agents deliver an...

Product

Multi-Asset Deep Agentic Scan assesses related mobile, web, API, network, source-code, and documentation assets in on...

Security

Detection and enforcement are different security properties. Across five production banking apps protected by four co...

Security

A comprehensive guide on what penetration testing is, how much it costs for startups in 2026, the 5-step testing proc...

Product

Ostorlab now supports MCP, giving AI assistants and agents permission-controlled access to security data and workflows.

Product

Introducing Risk Reruns for Agentic Deep Scans—rerun specific risk investigations with customized effort levels, AI m...

Security

AI can produce a convincing exploit story in seconds. Runtime proof, negative controls, and human review determine wh...

Security

SOC 2 doesn't name a required testing method, so auditors judge evidence, not tools. Here's what an AI-conducted pene...

Product

Agentic Scan Knowledge gives Ostorlab security agents persistent application context, allowing every scan to build on...

Product

Ostorlab Mobile Shielding Scan tests Android and iOS protections against real bypasses, including root detection, ant...

Product

Announcing the general availability of the Ostorlab On-Premises Vulnerability Scanner, designed to identify and conte...

Security

Ostorlab vs Aikido: AppSec Comparison for Web, Mobile, API, and Source Code

Security

A technical correction to Appknox's "Top 10 MAST Tools in 2026" comparison, highlighting the difference between stati...

Security

An architectural comparison of XBOW and Ostorlab across target scoping, mobile coverage, cross-asset exploit chaining...

Security

Discover how agentic AI catches business logic flaws rule-based scanners miss. See a real exploit chain escalating a ...

Security

A detailed comparison of Ostorlab and NowSecure across six key areas, highlighting why modern DevSecOps teams are rep...

Security

Compare the best source code scanning tools in 2026 across developer-first and enterprise platforms. Review Ostorlab,...

Product

Ostorlab Threat Center now brings EUVD intelligence alongside NVD data, giving security teams broader vulnerability v...

Security

A practical guide to designing AI-assisted security testing workflows that turn scoped evidence into reviewable findi...

Engineering

Learn what separates AI-powered scanning from AI pentesting and how Ostorlab Deep Agentic Scan follows evidence to va...

Engineering

Learn how source code security testing works, why traditional SAST creates false positives, and how agentic analysis ...

Security

A technical assessment of the latest version of GoPhish that examines how the platform handles trust: identity, untru...

Security

A technical comparison of Ostorlab and Quokka Q-mast Mobile Application Security Testing (MAST) tools, highlighting t...

Product

Source Code Scanning helps you identify security vulnerabilities directly in your source code before they reach produ...

Product

The latest Deep Agentic Scan release introduces faster mobile testing, improved reverse engineering, stronger vulnera...

Product

Ostorlab has launched Mobile Shielding Scan, an automated, AI-powered testing solution designed specifically for shie...

Engineering

Agentic harnesses change what an LLM can do in mobile app security testing. On its own, a model can name likely risks...

Product

Ostorlab has launched Cyber Models, a managed, prepaid AI infrastructure tier for Deep Agentic Scans. It gives securi...

Security

Walk the floor of any major cybersecurity conference today and you will hear about the promise of autonomous AI-power...

Security

This comprehensive guide covers the architecture, risk methodologies, and deployment frameworks required to architect...

Product

Ostorlab has launched App Vetting, a mobile application risk assessment solution that helps teams evaluate Android an...

Engineering

We built an AI-powered pull request reviewer, shut it down after hallucinations and false positives eroded developer ...

Product

Ostorlab is launching a powerful, highly targeted AI orchestration engine accessible through two distinct UI workflow...

Security

A technical breakdown of CVE-2026-42208, a CVSS 9.3 critical unauthenticated SQL Injection vulnerability in the LiteL...

Security

A technical breakdown of DirtyFrag, a pair of Linux kernel local privilege escalation vulnerabilities (CVE-2026-43284...

Security

A technical breakdown of CVE-2026-44109, a CVSS 9.2 Critical authentication bypass vulnerability in OpenClaw (< 2026....

Security

A deep dive into a critical Server-Side Request Forgery (SSRF) vulnerability in Chatwoot's upload endpoint (≤ v4.12.1...

Security

A DORA compliance checklist helps banking and fintech organizations evaluate operational resilience across core areas...

Security

A static analysis of TV_V_23.apk, a multi-stage Android banking malware platform attributed with high confidence to t...

Security

This guide covers the security testing tools, platform-specific risks, and the most common gaps security teams encoun...

Security

A deep dive into Android intent redirection vulnerabilities, showing how exported “proxy” components can be abused to...

Product

Find a vulnerability scanner for HarmonyOS apps and Huawei AppGallery releases: Ostorlab adds automated, repeatable s...

Security

Mobile game security testing prevents cheating, hacks, and revenue loss by securing client, network, and backend laye...

Security

A technical guide to mobile application security testing best practices for high-tech teams shipping iOS and Android ...

Security

This comprehensive guide explores the critical role of application security testing in modern healthcare. It covers t...

Security

Protecting mobile banking apps requires more than securing the client alone. This guide explores the risks across dev...

Security

A technical breakdown of CVE-2026-26720, a CVSS 9.8 Critical authenticated Remote Code Execution vulnerability in Twe...

Security

A deep dive into DORA-focused third‑party risk for mobile AppSec, showing why embedded SDKs and runtime providers dem...

Security

Mobile application shielding protects apps on untrusted devices by preventing reverse engineering, tampering, debuggi...

Security

A deep dive into two critical vulnerabilities uncovered in Roundcube Webmail (< 1.6.14, 1.5.14, 1.7 RC4) during a sou...

Product

Ostorlab now integrates with Harness CI to run automated mobile application security scans inside CI pipelines. Using...

Security

A technical breakdown of CVE-2026-27971, a CVSS 9.2 critical unauthenticated remote code execution vulnerability in Q...

Product

Modern applications are more secure than ever, but that security introduces a major challenge. With the widespread ad...

Product

Ostorlab now integrates with Bitrise to run automated mobile application security scans inside CI workflows. Using a ...

Security

A technical breakdown of CVE-2026-2599, a CVSS 9.8 Critical unauthenticated PHP Object Injection vulnerability in the...

Security

A mobile-first guide to DORA compliance for BFSI teams. Learn how to define your scope, simplify your release process...

Product

Ostorlab has launched Agentic Deep Scan, a next-generation vulnerability scanner that validates real-world risks in i...

Security

A technical breakdown of CVE-2025-68461, a CVSS 7.2 high stored Cross-Site Scripting vulnerability in Roundcube Webma...

Security

Analysis of GHSA-cr3w-cw5w-h3fj, a CVSS 9.7 critical XSS-to-RCE vulnerability in Saltcorn (≤ 1.5.0-beta.19). Two chai...

Security

A mobile-first guide to DORA regulation and DORA compliance for BFSI teams. Learn how to define your scope, simplify ...

Security

A technical breakdown of CVE-2026-26019, a CVSS 4.1 medium Server-Side Request Forgery vulnerability in the LangChain...

Security

A mobile-first guide to DORA regulation and DORA compliance for BFSI teams. Learn how to define your scope, simplify ...

Security

We work with mobile apps every day, and over time we’ve found a list of open-source tools that consistently make our ...

Security

A technical breakdown of CVE-2025-64712, a CVSS 9.8 critical path traversal remote code execution vulnerability in th...

Security

A technical breakdown of CVE-2026-1357, a CVSS 9.8 critical unauthenticated remote code execution vulnerability in th...

Security

This article lists eight (8) open-source AI pentest tools. It covers how autonomous agents are potentially changing t...

Product

2025 marked the turning point where AI in cybersecurity graduated from experimental prototypes to production-grade en...

Security

For years, Android’s openness was one of its biggest strengths. Anyone could build an app, share it, and sideload it ...

Security

An AI-assisted analysis uncovered a 30-year-old uninitialized buffer vulnerability in glibc's _nss_dns_getnetbyaddr_r...

Security

Ostorlab's Pentest Engine identified a JavaScript bridge exposure in an Android WebView, allowing unauthenticated nat...

Product

Compare the best MAST tools for Android and iOS in 2026, including Ostorlab, NowSecure, Appknox, Data Theorem, Quokka...

Security

What Android’s FLAG_SECURE does, how it prevents screenshots and screen recordings of sensitive app content, how to i...

Security

Ostorlab's AI Pentest Engine systematically uncovered a critical Broken Function-Level Authorization (BFLA) vulnerabi...

Security

Methodical analysis beats blind fuzzing as Ostorlab's AI engine discovers cross-version password reset weakness and a...

Security

How a second-order client-side data exfiltration chain was discovered in a modern SPA, transforming a simple open red...

Security

Ostorlab’s reasoning-driven AI engine breaks past rule-based limits to surface previously unknown and hard-to-detect ...

Security

The first open-source benchmark suite featuring 93 realistic vulnerable mobile apps that mirror actual CVE and bug bo...

Security

Large-scale security analysis of 500+ top mobile banking apps reveals widespread vulnerabilities, decade-old codebase...

Security

Precision beats payload spray using Ostorlab's AI engine to systematically land RCE on Titiler and proves exfiltratio...

Security

This article showcases Ostorlab's AI Pentest Engine's process for analyzing an Android application for Intent Redirec...

Security

This article presents a thorough, hands-on analysis and real-world exploitation of a hardcoded GCP service account wi...

Security

This technical analysis reveals how sophisticated attack chains—combining path traversal, symbolic link manipulation,...

Security

This article presents a thorough, hands-on analysis and proof of concept for exploiting an OOB XXE vulnerability CVE-...

Product

Ostorlab’s AI Monkey Tester transforms mobile app security testing by using natural language prompts and generative A...

Security

This article presents a thorough, hands-on analysis and proof of concept for exploiting the stored XSS vulnerability ...

Product

Ostorlab's Privacy Scan automatically detects mismatches between what your app's privacy policy says and what it actu...

Product

The Ostorlab Security Scanner GitHub Integration enhances mobile app development workflows by embedding automated sec...

Product

This article announces the new integration between Ostorlab and Vanta, explains how it works, outlines the setup proc...

Security

This research introduces a pioneering dual approach that combines signature-based matching (DalvikFLIRT) with LLM-pow...

Product

This article outlines our journey in implementing ostorlab copilot, the challenges we encountered, and the lessons we...

Product

This article announces Ostorlab's vulnerability ticketing system V2 and how it automates and streamlines the entire p...

Product

This article explores AI-automated attack surface management, its impact on cybersecurity, and how it automates asset...

Security

A technical analysis of a vulnerability in CyberPanel, a Pre-Auth Root RCE, including confirmed exploitation paths, i...

Security

This article is an in-depth look at the most common GraphQL vulnerabilities, why they occur, and how they can be mitigated.

Security

This article assesses the large-scale exposure of systems to multiple CVEs affecting the CUPS printing service, which...

Engineering

The Threat Center provides essential updates for organizations to stay informed about security threats, offering acti...

Security

An in-depth look at the CVE-2024-47374 vulnerability affecting LiteSpeed Cache plugin for WordPress, its impact, and ...

Security

The article delves into the technical details of this CVE, its potential impact, and the methods used to detect and e...

Security

The article uncovers an Arbitrary File Read vulnerability in VigorConnect that lets attackers access sensitive files....

Engineering

OXO Titan UI encapsulates OXO's capabilities within an accessible interface, democratizing advanced security scanning...

Security

Discover the comprehensive techniques that are commonly used to bypass 403 errors. Learn about the various methods us...

Product

Introducing the AI-powered Monkey Tester in the Ostorlab mobile vulnerability scanner, significantly boosting test co...

Security

CVE-2024-5315, an actively exploited Dolibarr SQL Injection with in incorrect patched-in version.

Security

E.V.A Information Security uncovered critical vulnerabilities in CocoaPods, leading to immediate patches, and develop...

Engineering

OXO version 1.0, is 10x times faster, supports ARM64 architectures, and is packed with improved capabilities like sca...

Engineering

This article offers a guide to Privacy Manifest files in Apple's ecosystem, stressing their importance for transparen...

Engineering

The article introduces a new method for detecting PostMessage Cross-Site Scripting (XSS) vulnerabilities using JavaSc...

Security

New vulnerabilities added to Ostorlab known exploited vulnerabilities catalog

Product

The article introduces Ostorlab Attack Surface Discovery as a solution for discovering and continuously monitoring mo...

Security

This article examines the security of mobile banking applications in North America, uncovering widespread vulnerabili...

Engineering

Article on Swift Dynamic Instrumentation. The article explains the steps to perform dynamic analysis of Swift-based a...

Security

New vulnerabilities added to Ostorlab known exploited vulnerabilities catalog

Security

New vulnerabilities added to Ostorlab known exploited vulnerabilities catalog

Security

The article delves into dependency confusion vulnerabilities and introduces a novel detection and exploitation techni...

Security

In this article we will Discover essential tools and empirical insights for identifying critical, high-severity, and ...

Product

As 2023 has concluded, it's time to reflect and prepare for an optimistic 2024.

Security

Release of new OWASP Mobile Top 10 with improvements, updates and a behind the scenes.

Product

Ostorlab clinches the top spot in the Swiss Cyber defense Security Challenge, showcasing their commitment to advancin...

Security

This article delves into the exploitation of OAuth account takeover using app impersonation through custom scheme hij...

Security

Recent in-depth investigations reveal serious vulnerabilities discovered in widely-used zip packages in Flutter and S...

Security

Ostorlab has open-sourced two Flutter applications, designed to be intentionally insecure for testing and educational...

Security

This article is a technical deep dive, showing how a 100M+ installation image application can expose its user’s image...

Product

The new release brings a new AI Engine for improved recommendations, powerful new additions to Flutter detection and ...

Security

In this Article, we define a secure implementation of mobile biometric authentication and provide detailed implementa...

Security

Article on Static and Dynamic analysis techniques for Reverse engineering Flutter Applications. The article goes over...

Engineering

In this article, we look at different ways to improve the performance of Python which is an interpreted language.

Product

An overview of all the new features of the Ostorlab platform and its detection capabilities.

Security

In This article, we analyze the GodFather Android malware, which continues to appear in various formats and primarily...

Product

Ostorlab has successfully completed its SOC2 Type 2 audit, demonstrating its commitment to security and data protection.

Engineering

Ostorlab's Fix it! practice is one of our most successful engineering practices helping us eradicate bugs and kill te...

Product

Ostorlab’s new features are laser-focused on helping teams understand, track and search their attack surface, what at...

Product

Ostorlab has been selected as one of the top 10 vulnerability management innovators of 2023 by GRC Viewpoint.

Product

2022 is a year that brings with it many global challenges, including war, economic uncertainty, and rising inflation ...

Product

This article will cover the main challenges when implementing a CI/CD pipeline for mobile applications. We will also ...

Security

CVE-2022-42889 is a vulnerability in the Apache Commons Text Library caused by string interpolation abusing powerful ...

Product

As a reflection of the many new capabilities and changes we have made, we have released a new dashboard providing bet...

Product

The Mobile Application Security Verification Standard is an important step toward building secure Mobile Applications...

Engineering

Tips and tricks to make your life easier when developing & debugging OXO Agents.

Product

Largest release with improvements to Attack Surface, Open-Source, Mobile and Web scanning and much much more.

Engineering

This article talks about how OXO works under the hood.

Security

Attack Surface is not just about open ports and services; this article covers key insights beyond the standard techni...

Security

Attack surface mapping has become the number one headache of CISO's of most large organization, this article goes ove...

Engineering

This article talks about the experience of Rabson Phiri who works as a Software Engineer at Ostorlab.

Product

This article provides a comprehensive view of the security mobile security scanning solutions, while at the same time...

Product

This is a major release open-sourcing Ostorlab and announcing tons of new features and capabilities.

Security

What is the impact of Log4j vulnerability on mobile applications

Product

Wanna learn a bit more about Ostorlab? We answered Aviva Zack’s questions for Safety Detective about the Company, our...

Product

Vulnerability management is a hard journey, the help enable fixing of vulnerabilities urgently, diligently and effici...

Product

Vulnerability management is a hard journey, the help enable fixing of vulnerabilities urgently, diligently and effici...

Product

Ostorlab released the UI call coverage in the analysis environment to show the UI flow exercised during the dynamic s...

Product

Health Tech, Compromises and attacks, Instrumentation, Black Hat conferences, eBPF and more….

Security

This article is about bypassing SSL pinning without needing to. Sounds confusing? We will go over the theory, build a...

Security

This article is about WebViews and the security notions we need to have in mind when using these component in both An...

Security

Dependency Confusion is a new attack with high severity impact. This article is an overview of the vulnerability as w...

Security

The following article is a technical deep dive into how genetic algorithms can be leveraged to create superhuman XSS ...

Security

This weeks is marked by multiple high profile data breaches affecting Cashalo, Npower, Kia, T-Mobile and Clubhouse.

Product

Ostorlab is adding Web Security Scanner to its arsenal with novel approaches to vulnerability discovery.

Product

New Analysis Environment with access to disassembly, decompiled source, call trace, function tagging and many other features.

Security

Hardcoded secrets are easy to find and might open a gate to sensitive data or privileged access. This makes them a gr...

Security

The article introduces the term Autonomous Security in the context of security scanning and defines 5 tiers of maturity.

Product

Whether we are developing a mobile application or assessing its security, we need to continuously review it with ever...

Product

Ostorlab now supports creating scans directly from Android Play Store and iOS App Store

Security

Mobile security testing of Covid-19 Contact Tracing Application BeAware

Security

Mobile security testing of Covid-19 Contact Tracing Application Wiqaytna

Security

Mobile applications assessments, automation of 3rd party dependency review

Product

Xamarin decompilation, deprecated TLS protocols, hardcoded secrets and even more, Owasp top 10

Engineering

Overview of the detection capabilities provided by Ostorlab

Product

Better management of scan lifecycle, export scan results and subscriptions

Product

Announcement on changes in the management of scan accessibility

Product

Ostorlab Mobile Security Scanner Release of a new portal to track scans progress and access scan history.

Engineering

How to debug Nuxt.js application on Webstorm

Engineering

We took Cloud Run for a Test Drive, these are we what learnt.

Security

This article describes the usage of Ostorlab Insecure Application.

Security

How to perform security checks of an iOS application file on a non-jailbroken iPhone from a Linux Machine.

Product

In a mission to build the best security scanning technologies, Ostorlab team is proud to announce that the community ...

Security

Use the start of the year to contemplate how the previous year went, and prepare for the upcoming is an important exe...

Security

XSS are still by far the most common type of vulnerabilities, this article presents strategies to automate the search...

Security

This article is about how to manage AWS access keys when using AWS services in your mobile application.

Engineering

dynamic analysis

Product

The last few months, Ostorlab team has been hard at work adding exciting new features. Some of these have already hit...

Security

I will be sharing through a series of blog posts our past experimentations with the use of reinforcement learning for...

Security

the Attack Surface of mobile applications.

Security

Ostorlab is a community effort to build a mobile application vulnerability scanner to help developers build secure mo...

Security

We have been for the last few months hard at work developing a new scan engine to identify new classes of vulnerabili...

Security

Hybrid frameworks like Cordova offers the advantage of building one app for multiple platform (support for Android, i...

Security

Before we get into SQL injections and what might go wrong, we'll start by covering some technical information on Cont...

Engineering

For an Android developer, it has become standard practice to use external libraries to easily extend the functionalit...

Security

Google will start identifying security weaknesses in Apps pushed to the Play Store...

Engineering

At Ostorlab we scan hundreds of Mobile Applications each day, each scan is very resource intensive but at the same ti...

Security

In Android, the permission system was one of the major security concerns of the platform for many reasons...

Security

Learn how SSL pinning works on Android, what threats it helps mitigate, where it can break, and how to implement it s...

Security

Apparently Facebook is crashing their apps intentionally in order to test users reaction and evaluate their adherence...

Security

The last years have come with meaningful changes in the way IT professionals operate and the way we approach security...

Product

We are pleased to release the Beta version of our online mobile application security scanner.

Security

This article will reference the best current resources on SSL/TLS.