Neutron, our AI engine, scored 96.75% on UC Berkeley's CyberGym benchmark. Learn more

Blog

Ostorlab Blog

Vulnerability research, CVE deep dives and engineering write-ups from the Ostorlab team on AI pentesting and mobile, web and API security testing.

Featured Stories See all articles →

Product

Detection of Apple's Privacy Manifest, liblzma backdoor, and Attack Surface fixes.

This update introduces fixes for the Attack Surface, detection for the liblzma backdoor, and a public store for agents.

Ostorlab Team
Apr 01, 2024

Product

Discovering & Monitoring Mobile Applications Attack Surface with Ostorlab

The article introduces Ostorlab Attack Surface Discovery as a solution for discovering and contin...

Mar 26, 2024

Product

Addition of CSS Injection Detection, ARM64 support, and migration of Agent's Docker Images.

This update introduces fixes for the Attack Surface, migration of Agent's Docker Images to Docker...

Mar 25, 2024

Security

Security Landscape of Mobile Banking Applications in North America

This article examines the security of mobile banking applications in North America, uncovering wi...

Mar 19, 2024

Read by Topic

Latest from Engineering, Product & Security
Engineering
View all Engineering →

The True Cost of False Positives: Calculating the Engineering Tax of Noisy Scanners

False positives are an engineering-capacity problem, not only a scanner-quality problem. Learn how to measu...

Sep 28, 2026

When Does an AI Scanner Become an AI Pentest?

Learn what separates AI-powered scanning from AI pentesting and how Ostorlab Deep Agentic Scan follows evid...

Jul 22, 2026

Source Code Security: From Signal to Validated Risk | Ostorlab

Learn how source code security testing works, why traditional SAST creates false positives, and how agentic...

Jul 16, 2026
Product
View all Product →

Who Should Use Ostorlab? Best-Fit Teams, Use Cases, and When to Choose Something Else

Ostorlab fits teams testing connected mobile, web, API, and code assets on every release. Where it fits, wh...

Sep 28, 2026

How Deep Agentic Scan Catches Tricky Real-World Vulnerabilities

How Ostorlab's Deep Agentic Scan uncovers and empirically proves complex vulnerabilities across web, mobile...

Sep 23, 2026

Best On-Premises AppSec Testing Platforms (2026)

Compare Ostorlab, Invicti, Burp Suite DAST, HCL AppScan and Fortify for on-premises AppSec testing: deploym...

Sep 15, 2026
Security
View all Security →

Ostorlab vs. Pentesting Firms: 2026 Cost & Depth Comparison

Ostorlab vs. pentesting firms: cost, testing frequency, depth and remediation, and when to use AI pentests,...

Sep 25, 2026

Why API Security Testing Misses Cross-Asset Attack Chains

API-only scanners miss attack chains that start with secrets or routes in mobile apps, web bundles, or code...

Sep 25, 2026

AI Pentesting for SOC 2: 6 Providers Compared

Compare Ostorlab, XBOW, Aikido, Intruder, Escape and Penti for SOC 2 pentests on exploit evidence, human re...

Sep 25, 2026

Changelog

View all changes

New Dashboard UI, On-Premises Scanner, Agentic Scan Knowledge, Multi-Asset Scanning, Linear & MCP Integrations, and New Model Support

 Sep 02, 2026

App Vetting, Scan Coverage Heatmap, Mobile Shielding Scan, Deep Agentic Scan Improvements, Cyber Models & Source Code Scanning

 Jul 07, 2026

Single Vulnerability Assessment (SVA), Dig Deeper, Scan Report PDF Design Improvement & Multilanguage Support

 Jun 01, 2026

Deep Agentic Scan (BYOK), New CI Integrations, Scan Filters & Performance

 Mar 27, 2026