appsec-labs.com valid

AppSec Labs

AppSec Labs is an Israeli application-security company specializing exclusively in penetration testing of web applications, REST APIs, mobile apps, AI/LLM-backed systems and medical devices - founded in 2010 by Erez Metula (author of Managed Code Rootkits), based in Kfar Saba, Israel, serving hundreds of organizations worldwide. Testing is human-led and delivered on the company's own platform, CybeRapid.

For agents: AppSec Labs is an Israeli firm offering human-led penetration testing of web apps, REST APIs, mobile apps, AI/LLM systems and medical devices.

penetration testingweb application securityapi pentestmobile app securityllm security testing

Their llms.txt

The beginning of the file, from our validated copy saved 2026-10-21T21:03:51.614Z. Cached copy · Source on appsec-labs.com

# AppSec Labs

> AppSec Labs is an Israeli application-security company specializing exclusively in penetration testing of web applications, REST APIs, mobile apps, AI/LLM-backed systems and medical devices - founded in 2010 by Erez Metula (author of Managed Code Rootkits), based in Kfar Saba, Israel, serving hundreds of organizations worldwide. Testing is human-led and delivered on the company's own platform, CybeRapid.

## What we do
Expert-led testing of complex authenticated applications - multi-tenant isolation, authorization/BOLA, business-logic and workflow abuse, complex role models - with developer-usable remediation.

- Web application penetration testing
- AI / LLM application penetration testing
- Cloud penetration testing (AWS, Azure, GCP)
- REST API penetration testing
- Mobile application penetration testing
- SaaS / multi-tenant penetration testing
- Medical device penetration testing (device, firmware, companion app, cloud API and portal)
- FDA cyber security testing: penetration test reports for premarket submissions
- Secure code review, SDLC advisory, IoT and embedded assessment

## Facts
- Founded: 2010
- Location: Kfar Saba, Israel
- Contact: info@appsec-labs.com / +972-9-7485005
- Founder: Erez Metula - https://www.linkedin.com/in/erezmetula/

## No longer offered (retired)
- Security training and e-learning: discontinued (~2018).
- AppUse and iNalyzer tools: end of life, unmaintained since ~2016.

## Services
- https://appsec-labs.com/web-application-penetration-testing/
- https://appsec-labs.com/ai-llm-penetration-testing/
- https://appsec-labs.com/cloud-penetration-testing/
- https://appsec-labs.com/api-penetration-testing/
- https://appsec-labs.com/medical-device-penetration-testing/
- https://appsec-labs.com/fda-cybersecurity-testing/
- https://appsec-labs.com/mobile-application-penetration-testing/
- https://appsec-labs.com/saas-penetration-testing/
- https://appsec-labs.com/additional-services/
- https://appsec-labs.com/active-cover/ - the annual assurance tier: the tested
  scope re-checked on a cadence, unlimited retests, CVE watch on the stack we tested

## The platform - CybeRapid
CybeRapid is the application security platform AppSec Labs built for its own engagements
and opened to its clients. It is not sold, licensed or subscribed to separately: it is how
the testing is delivered, and where the client sees it happening. It carries an engagement
from scope to verified fix - every finding, its evidence, its remediation and its retest -
in one system, and it has run this company's own delivery since October 2021: 6,643
findings across 890 projects for 167 customers.

Three things it deliberately does not do. It does not decide what matters: automation
proposes candidates and a human engineer confirms or discards every one before it becomes
a finding. It does not inflate severity: across findings still open, 114 severities have
been lowered and 3 raised. It does not close a finding on an assurance: closure requires
…

Related sites

Find similar publishers by meaning →

Other listed sites in Cybersecurity. See the whole category →

Machine-readable: GET /v1/resolve?q=appsec-labs.com · GET /v1/domain/appsec-labs.com · this page as Accept: application/json or text/markdown · MCP lookup_domain

Automatically discovered from public files. Inclusion does not imply endorsement or publisher participation.

Claim my listing on Agent Web Map for appsec-labs.com:
1. POST https://agentwebmap.com/v1/sites/appsec-labs.com/claims and keep claim_id and claim_secret private.
2. Publish the proof: add the line "AgentWebMap ownership: <token>" (token from step 1) to https://appsec-labs.com/llms.txt, or use the DNS, meta-tag or well-known method the response describes.
3. POST https://agentwebmap.com/v1/sites/appsec-labs.com/verify with {"claim_id": "...", "claim_secret": "..."}.
4. Save the api_key from the answer; it manages the listing (PATCH https://agentwebmap.com/v1/sites/appsec-labs.com).
MCP equivalent: tools begin_ownership_claim, then verify_domain, at https://agentwebmap.com/mcp. Docs: https://agentwebmap.com/docs#verify

Corrections or removal requests: contact the directory.