AppSec
Bypassing Mobile App Shielding: Where Detection Ends and Enforcement Fails
Detection and enforcement are different security properties. Across five production banking apps protected by four commercial shielding products, the detection was sophisticated and the enforcement was fragile.
Wed 12 August 2026
The 2026 Guide to Penetration Testing for Startups (Costs, Process, and Vendor Selection)
A comprehensive guide on what penetration testing is, how much it costs for startups in 2026, the...
Sun 09 August 2026
AI Can Run the Attack. Can You Trust the Result?
AI can produce a convincing exploit story in seconds. Runtime proof, negative controls, and human...
Thu 06 August 2026
Ostorlab vs Aikido: Securing the Full Application Stack
Ostorlab vs Aikido: AppSec Comparison for Web, Mobile, API, and Source Code
Mon 03 August 2026
How AI Catches Complex Vulnerabilities: Inside Agentic Pentesting and Exploit Chaining
Discover how agentic AI catches business logic flaws rule-based scanners miss. See a real exploit chain escalating a fixed finding to tenant-wide compromise.
AI Pentesting Prompts That Produce Evidence, Not Just Findings
A practical guide to designing AI-assisted security testing workflows that turn scoped evidence into reviewable findings through structured outputs, validation gates, and controlled execution.
Latest posts
The App Was Never Opened
Agentic harnesses change what an LLM can do in mobile app security testing. On its own, a model can name likely risks such as insecure storage, exposed secrets, risky permissions, vulnerable SDKs, backend issues, and privacy exposure, but the app may remain untouched. With the right tools, context, memory, prompts, execution loops, and runtime feedback around it, the model can inspect the app package, observe behavior, follow traffic, connect signals, and leave behind evidence a security team can review. From permission analysis to GEF-powered native exploitation, the difference is visible in the trace: app evidence, tool output, runtime proof, and reproducible steps instead of report-shaped text.
Thu 25 June 2026
There Is No Magic Box: Why AI-Era AppSec Needs a Stack
Walk the floor of any major cybersecurity conference today and you will hear about the promise of autonomous AI-powered platforms. But AI-only testing doesn't scale. A resilient AppSec program requires a cost-aware, tiered stack combining rapid traditional scanners, private semantic reviews, and selective orchestration of frontier models.
Mon 22 June 2026
Introducing Ostorlab App Vetting for the Agentic Era
Ostorlab has launched App Vetting, a mobile application risk assessment solution that helps teams evaluate Android and iOS apps before approval. It combines static analysis, dynamic testing, and secure sandbox execution with continuous monitoring, weighted risk scoring, and agentic workflows to identify vulnerabilities, privacy risks, malware indicators, telemetry behavior, and trust issues while helping teams prioritize what matters most.
Tue 16 June 2026