Neutron, our AI engine, scored 97.1% on UC Berkeley's CyberGym benchmark. Learn more

Blog

Ostorlab Blog

Vulnerability research, CVE deep dives and engineering write-ups from the Ostorlab team on AI pentesting and mobile, web and API security testing.

Featured Stories See all articles →

Security

Post-Mortem: Why Autonomous AI Agents Escape Scope and How to Contain Them

A technical post-mortem on an AI agent that wandered outside its testing scope during an authorized API assessment, what caused it, and how we contain autonomous agents.

Bilal Harras
Sep 18, 2026

Security

The Fastest Way to Get an Audit-Ready Pentest Report for SOC 2 Compliance

Learn how B2B SaaS startups bypass the 4-week consultancy delay to generate audit-ready SOC 2 pen...

Sep 16, 2026

Security

Ostorlab Neutron on UC Berkeley CyberGym: 97.1% Verified Exploitation (1,463/1,507 Tasks)

A technical deep-dive into how Ostorlab Neutron reached a 97.1% verified exploit solve rate (1,46...

Sep 15, 2026

Product

Best On-Premises AppSec Testing Platforms (2026)

Compare Ostorlab, Invicti, Burp Suite DAST, HCL AppScan and Fortify for on-premises AppSec testin...

Sep 15, 2026

Read by Topic

Latest from Engineering, Product & Security
Engineering
View all Engineering →

The True Cost of False Positives: Calculating the Engineering Tax of Noisy Scanners

False positives are an engineering-capacity problem, not only a scanner-quality problem. Learn how to measu...

Sep 28, 2026

When Does an AI Scanner Become an AI Pentest?

Learn what separates AI-powered scanning from AI pentesting and how Ostorlab Deep Agentic Scan follows evid...

Jul 22, 2026

Source Code Security: From Signal to Validated Risk | Ostorlab

Learn how source code security testing works, why traditional SAST creates false positives, and how agentic...

Jul 16, 2026
Product
View all Product →

Ostorlab vs. Manual Pentesting: More Critical Findings, Less Time, Lower Cost

Ostorlab reports more critical findings, shorter testing time, and assessment costs of one-tenth to one-for...

Oct 28, 2026

How to Vet a Third-Party Mobile App Before You Allow It in Your Company

A five-step mobile app vetting checklist for security teams (permissions, trackers, malware, data flows, st...

Oct 27, 2026

Precheck: Know Your Mobile Scan Will Work Before It Runs for Hours

Precheck verifies that a mobile app installs, launches, logs in and runs its UI prompts on a real device. W...

Oct 27, 2026
Security
View all Security →

Ostorlab vs MobSF: Analyst-Driven vs AI-Driven Mobile Security Testing (2026)

Ostorlab vs MobSF (Mobile Security Framework) for mobile app security testing: static and dynamic analysis,...

Oct 07, 2026

Ostorlab vs Oversecured: Mobile App Security Testing Compared (2026)

Ostorlab vs Oversecured for mobile app security testing: iOS and Android coverage, exploit proof, authentic...

Oct 07, 2026

Ostorlab vs. Pentesting Firms: 2026 Cost & Depth Comparison

Ostorlab vs. pentesting firms: cost, testing frequency, depth and remediation, and when to use AI pentests,...

Sep 25, 2026

Changelog

View all changes

Late October 2026: Cloud Inventory, Scheduled Testing and Investigation Replay

 Oct 31, 2026

October 2026: From Security Findings to Tested Fixes

 Oct 17, 2026

New Dashboard UI, On-Premises Scanner, Agentic Scan Knowledge, Multi-Asset Scanning, Linear & MCP Integrations, and New Model Support

 Sep 02, 2026

App Vetting, Scan Coverage Heatmap, Mobile Shielding Scan, Deep Agentic Scan Improvements, Cyber Models & Source Code Scanning

 Jul 07, 2026