Neutron, our AI engine, scored 97.1% on UC Berkeley's CyberGym benchmark. Learn more

Blog

Ostorlab Blog

Vulnerability research, CVE deep dives and engineering write-ups from the Ostorlab team on AI pentesting and mobile, web and API security testing.

Featured Stories See all articles →

Security

Mobile Operational Resilience Under DORA: The simplest drill library for BFSI journeys

A mobile-first guide to DORA compliance for BFSI teams. Learn how to define your scope, simplify your release process, and avoid the traps that create unnecessary compliance work.

Bilal Harras
Mar 24, 2026

Product

Ostorlab Launches Agentic Deep Scan: The next-generation vulnerability scanner

Ostorlab has launched Agentic Deep Scan, a next-generation vulnerability scanner that validates r...

Mar 19, 2026

Security

CVE-2025-68461: Roundcube SVG Animate XSS Bypass

CVE-2025-68461 (CVSS 7.2) lets SVG animate tags slip past the Roundcube sanitizer via namespace p...

Mar 17, 2026

Security

GHSA-cr3w-cw5w-h3fj: 1-Click RCE in Saltcorn

Analysis of GHSA-cr3w-cw5w-h3fj, a CVSS 9.7 critical XSS-to-RCE vulnerability in Saltcorn (≤ 1.5....

Mar 11, 2026

Read by Topic

Latest from Engineering, Product & Security
Engineering
View all Engineering →

The True Cost of False Positives: Calculating the Engineering Tax of Noisy Scanners

False positives are an engineering-capacity problem, not only a scanner-quality problem. Learn how to measu...

Sep 28, 2026

When Does an AI Scanner Become an AI Pentest?

Learn what separates AI-powered scanning from AI pentesting and how Ostorlab Deep Agentic Scan follows evid...

Jul 22, 2026

Source Code Security: From Signal to Validated Risk | Ostorlab

Learn how source code security testing works, why traditional SAST creates false positives, and how agentic...

Jul 16, 2026
Product
View all Product →

Snyk and Checkmarx Alternatives: Ostorlab vs Snyk Code, Checkmarx One and GitHub Advanced Security (2026)

The best Snyk Code, Checkmarx One and GitHub Advanced Security alternatives for SAST in 2026, and how Ostor...

Oct 07, 2026

We Built an AI Agent for Our Own Backlog. Now It's Yours.

How a small agent that turned bug tickets into pull requests became Ostorlab's ticket agent: an AI teammate...

Oct 06, 2026

Who Should Use Ostorlab? Best-Fit Teams, Use Cases, and When to Choose Something Else

Ostorlab fits teams testing connected mobile, web, API, and code assets on every release. Where it fits, wh...

Sep 28, 2026
Security
View all Security →

Ostorlab vs MobSF: Analyst-Driven vs AI-Driven Mobile Security Testing (2026)

Ostorlab vs MobSF (Mobile Security Framework) for mobile app security testing: static and dynamic analysis,...

Oct 07, 2026

Ostorlab vs Oversecured: Mobile App Security Testing Compared (2026)

Ostorlab vs Oversecured for mobile app security testing: iOS and Android coverage, exploit proof, authentic...

Oct 07, 2026

Ostorlab vs. Pentesting Firms: 2026 Cost & Depth Comparison

Ostorlab vs. pentesting firms: cost, testing frequency, depth and remediation, and when to use AI pentests,...

Sep 25, 2026

Changelog

View all changes

October 2026: From Security Findings to Tested Fixes

 Oct 17, 2026

New Dashboard UI, On-Premises Scanner, Agentic Scan Knowledge, Multi-Asset Scanning, Linear & MCP Integrations, and New Model Support

 Sep 02, 2026

App Vetting, Scan Coverage Heatmap, Mobile Shielding Scan, Deep Agentic Scan Improvements, Cyber Models & Source Code Scanning

 Jul 07, 2026

Single Vulnerability Assessment (SVA), Dig Deeper, Scan Report PDF Design Improvement & Multilanguage Support

 Jun 01, 2026