Ostorlab outperforms Mythos, Microsoft, and Wiz. Our CyberGym benchmark results, at a fraction of the cost. Learn more

Blog

Ostorlab Blog

Vulnerability research, CVE deep dives and engineering write-ups from the Ostorlab team on AI pentesting and mobile, web and API security testing.

Featured Stories See all articles →

Security

Bypassing Mobile App Shielding: Where Detection Ends and Enforcement Fails

Detection and enforcement are different security properties. Across five production banking apps protected by four commercial shielding products, the detection was sophisticated and the enforcement was fragile.

Mohammed Lachhab
Aug 12, 2026

Security

The 2026 Guide to Penetration Testing for Startups (Costs, Process, and Vendor Selection)

A comprehensive guide on what penetration testing is, how much it costs for startups in 2026, the...

Aug 09, 2026

Product

Introducing the Ostorlab Platform MCP Server

Ostorlab now supports MCP, giving AI assistants and agents permission-controlled access to securi...

Aug 08, 2026

Product

Introducing Risk Reruns: Granular Control for Agentic Deep Scans

Introducing Risk Reruns for Agentic Deep Scans—rerun specific risk investigations with customized...

Aug 07, 2026

Read by Topic

Latest from Engineering, Product & Security
Engineering
View all Engineering →

When Does an AI Scanner Become an AI Pentest?

Learn what separates AI-powered scanning from AI pentesting and how Ostorlab Deep Agentic Scan follows evid...

Jul 22, 2026

Source Code Security: From Signal to Validated Risk | Ostorlab

Learn how source code security testing works, why traditional SAST creates false positives, and how agentic...

Jul 16, 2026

The App Was Never Opened

Agentic harnesses change what an LLM can do in mobile app security testing. On its own, a model can name li...

Jun 25, 2026
Product
View all Product →

Best On-Premises AppSec Testing Platforms (2026)

Compare Ostorlab, Invicti, Burp Suite DAST, HCL AppScan and Fortify for on-premises AppSec testing: deploym...

Sep 15, 2026

Best EASM Platforms in 2026: 7 Tools Compared

Compare 7 external attack surface management platforms, such as Ostorlab, Defender EASM, Cortex Xpanse and ...

Sep 11, 2026

Best Web App Security Testing Tools in 2026

Compare Ostorlab, Burp Suite DAST, Invicti, InsightAppSec, AppScan, XBOW and OWASP ZAP, plus when DAST is e...

Sep 11, 2026
Security
View all Security →

AI Pentesting for SOC 2: 6 Providers Compared

Compare Ostorlab, XBOW, Aikido, Intruder, Escape and Penti for SOC 2 pentests on exploit evidence, human re...

Sep 25, 2026

Best Tools for Testing Mobile App Shielding Bypass

Compare Apktool, JADX, Ghidra, Frida, Objection and LLDB for manual tests with Ostorlab’s automated Android...

Sep 23, 2026

Post-Mortem: Why Autonomous AI Agents Escape Scope and How to Contain Them

A technical post-mortem on an AI agent that wandered outside its testing scope during an authorized API ass...

Sep 18, 2026

Changelog

View all changes

New Dashboard UI, On-Premises Scanner, Agentic Scan Knowledge, Multi-Asset Scanning, Linear & MCP Integrations, and New Model Support

 Sep 02, 2026

App Vetting, Scan Coverage Heatmap, Mobile Shielding Scan, Deep Agentic Scan Improvements, Cyber Models & Source Code Scanning

 Jul 07, 2026

Single Vulnerability Assessment (SVA), Dig Deeper, Scan Report PDF Design Improvement & Multilanguage Support

 Jun 01, 2026

Deep Agentic Scan (BYOK), New CI Integrations, Scan Filters & Performance

 Mar 27, 2026