Neutron, our AI engine, scored 96.75% on UC Berkeley's CyberGym benchmark. Learn more

Blog

Ostorlab Blog

Vulnerability research, CVE deep dives and engineering write-ups from the Ostorlab team on AI pentesting and mobile, web and API security testing.

Featured Stories See all articles →

Security

Ostorlab Neutron on UC Berkeley CyberGym: 96.75% Verified Exploitation (1,458/1,507 Tasks)

A technical deep-dive into how Ostorlab Neutron reached a 96.75% verified exploit solved rate (1,458/1,507 tasks) and localized the flaw in all 1,507 tasks on UC Berkeley's CyberGym benchmark, combining pure source reverse engineering with deterministic protocol modeling.

Sohaib Harraoui
Sep 15, 2026

Product

Who Should Use Ostorlab? Best-Fit Teams, Use Cases, and When to Choose Something Else

Ostorlab fits teams testing connected mobile, web, API, and code assets on every release. Where i...

Sep 28, 2026

Security

Ostorlab vs. Pentesting Firms: 2026 Cost & Depth Comparison

Ostorlab vs. pentesting firms: cost, testing frequency, depth and remediation, and when to use AI...

Sep 25, 2026

Security

Why API Security Testing Misses Cross-Asset Attack Chains

API-only scanners miss attack chains that start with secrets or routes in mobile apps, web bundle...

Sep 25, 2026

Read by Topic

Latest from Engineering, Product & Security
Engineering
View all Engineering →

When Does an AI Scanner Become an AI Pentest?

Learn what separates AI-powered scanning from AI pentesting and how Ostorlab Deep Agentic Scan follows evid...

Jul 22, 2026

Source Code Security: From Signal to Validated Risk | Ostorlab

Learn how source code security testing works, why traditional SAST creates false positives, and how agentic...

Jul 16, 2026

The App Was Never Opened

Agentic harnesses change what an LLM can do in mobile app security testing. On its own, a model can name li...

Jun 25, 2026
Product
View all Product →

Who Should Use Ostorlab? Best-Fit Teams, Use Cases, and When to Choose Something Else

Ostorlab fits teams testing connected mobile, web, API, and code assets on every release. Where it fits, wh...

Sep 28, 2026

How Deep Agentic Scan Catches Tricky Real-World Vulnerabilities

How Ostorlab's Deep Agentic Scan uncovers and empirically proves complex vulnerabilities across web, mobile...

Sep 23, 2026

Best On-Premises AppSec Testing Platforms (2026)

Compare Ostorlab, Invicti, Burp Suite DAST, HCL AppScan and Fortify for on-premises AppSec testing: deploym...

Sep 15, 2026
Security
View all Security →

Ostorlab vs. Pentesting Firms: 2026 Cost & Depth Comparison

Ostorlab vs. pentesting firms: cost, testing frequency, depth and remediation, and when to use AI pentests,...

Sep 25, 2026

Why API Security Testing Misses Cross-Asset Attack Chains

API-only scanners miss attack chains that start with secrets or routes in mobile apps, web bundles, or code...

Sep 25, 2026

AI Pentesting for SOC 2: 6 Providers Compared

Compare Ostorlab, XBOW, Aikido, Intruder, Escape and Penti for SOC 2 pentests on exploit evidence, human re...

Sep 25, 2026

Changelog

View all changes

New Dashboard UI, On-Premises Scanner, Agentic Scan Knowledge, Multi-Asset Scanning, Linear & MCP Integrations, and New Model Support

 Sep 02, 2026

App Vetting, Scan Coverage Heatmap, Mobile Shielding Scan, Deep Agentic Scan Improvements, Cyber Models & Source Code Scanning

 Jul 07, 2026

Single Vulnerability Assessment (SVA), Dig Deeper, Scan Report PDF Design Improvement & Multilanguage Support

 Jun 01, 2026

Deep Agentic Scan (BYOK), New CI Integrations, Scan Filters & Performance

 Mar 27, 2026