# Offensive360

> Offensive360 provides application security testing and risk management tools for development, security and compliance teams. The company is O360 B.V., based in the Netherlands.

Canonical website: https://offensive360.com/
Product pages are the source of truth for product capabilities and availability. This optional reference helps readers locate those pages; it does not replace them.

## Products

- [SAST — Static Application Security Testing](https://offensive360.com/products/sast/): Source code analysis, vulnerability findings, data-flow analysis and remediation guidance. Language and framework coverage should be verified against the application being evaluated.
- [DAST — Dynamic Application Security Testing](https://offensive360.com/products/dast/): Testing for running web applications and APIs, with crawl coverage and request/response evidence. Authentication and test coverage depend on the target and configuration.
- [MAST — Mobile Application Security Testing](https://offensive360.com/products/mast/): Analysis of Android and iOS application packages for mobile security weaknesses. Confirm supported package formats and analysis modes during evaluation.
- [ASM — Attack Surface Management](https://offensive360.com/products/asm/): External asset discovery, exposure observations and scheduled change monitoring. Coverage depends on available discovery and intelligence sources.
- [AI Pentester](https://offensive360.com/products/ai-pentester/): Autonomous penetration testing of web applications and APIs by O360 AI. Engagements are scoped with enforced safety limits; findings are verified attack paths with bounded evidence, remediation guidance and a retest of fixes.
- [Autonomous Red Teaming](https://offensive360.com/products/autonomous-red-teaming/): Objective-driven adversary simulation by O360 AI: weaknesses chained into attack paths toward agreed objectives, under rules of engagement enforced at execution, with a tamper-evident transcript. Includes LLM application red teaming (prompt injection, jailbreak resistance, data leakage, unsafe tool use); human-led exercises are available on request.
- [GRC — Governance, Risk and Compliance](https://offensive360.com/products/grc/): Early-access platform for compliance programs, risk, policies, evidence, audits, incidents and vendor risk, with Arabic and English workflows.
- [Software Supply Chain Security](https://offensive360.com/software-supply-chain-security/): Dependency vulnerability assessment and a practical workflow for inventory, advisory review, remediation and retesting. Confirm additional malware, license and provenance requirements separately.

- [Container image, SBOM and Kubernetes manifest scanning](https://offensive360.com/products/container-security/): Static uploaded-artifact assessment in the cloud demo. Does not connect to live clusters, pull referenced images or execute uploaded containers.

- LLM application security testing — prompt injection, jailbreak resistance, data leakage and unsafe tool use — is available in [DAST](https://offensive360.com/products/dast/) (OWASP LLM Top 10) and the [Autonomous Red Teaming](https://offensive360.com/products/autonomous-red-teaming/) module.
- [Security services](https://offensive360.com/services/): Managed engagements with the Offensive360 team - penetration testing, red teaming, threat modeling and application security program support.

## Evaluation and deployment

- [Platform overview](https://offensive360.com/platform/)
- [Cloud, on-premise and air-gapped deployment](https://offensive360.com/deployment/): Evaluate data residency, network requirements, product availability and offline operation. OVA and Azure VHD options are available; confirm the configuration in the proposal.
- [Application security evaluation guide](https://offensive360.com/guides/application-security-evaluation/): A browser-only evaluation planner, downloadable checklist and practical guide covering scope, safe controls, findings, remediation and deployment acceptance.
- [Pricing and product scope](https://offensive360.com/pricing/): Discuss an annual license and the products, deployment and support included in the proposal. Do not assume identical capabilities across deployments or that all products are included in every plan.
- [Integrations](https://offensive360.com/integrations/)
- [Book a demo](https://offensive360.com/demo/): Free 30-minute product walkthrough. Select your product interest and deployment requirements.
- [Trust and security](https://offensive360.com/security/)
- [Product updates](https://offensive360.com/changelog/)

## Regional and industry information

- [Government and defense](https://offensive360.com/solutions/government/)
- [Financial services](https://offensive360.com/solutions/financial-services/)
- [Healthcare](https://offensive360.com/solutions/healthcare/)
- [GRC for Saudi Arabia — English](https://offensive360.com/grc/saudi-arabia/)
- [GRC for Saudi Arabia — Arabic](https://offensive360.com/ar/grc/)

## Arabic (العربية)

The platform, dashboards, reports and these pages are available in Arabic with native right-to-left layouts.

- [Arabic home](https://offensive360.com/ar/)
- [Arabic product pages](https://offensive360.com/ar/products/sast/): SAST, DAST, MAST, ASM, AI Pentester, Autonomous Red Teaming, GRC and container security, mirrored under /ar/products/.
- [Arabic GRC](https://offensive360.com/ar/grc/) and [Arabic compliance](https://offensive360.com/ar/compliance/): NCA ECC, SAMA CSF and regional framework coverage.

## Research and learning

- [Security blog](https://offensive360.com/blog/)
- [PHP2Shell: CVE-2026-109618 and CVE-2026-109619](https://offensive360.com/blog/php2shell-cve-2026-109618-109619/): Offensive360 write-up of the critical unauthenticated remote code execution flaws in the PHP runtime (CVSS v4.0 9.2, fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35): affected server APIs, end-of-life branches, interim hardening, detection and post-patch verification.
- [Vulnerability knowledge base](https://offensive360.com/knowledge-base/)
- [Security research and CVEs](https://offensive360.com/zerodays/)
- [Secure coding academy](https://offensive360.com/academy/)
- [AppSec glossary](https://offensive360.com/glossary/)
- [Product comparisons](https://offensive360.com/compare/)
- [Security headers checker](https://offensive360.com/tools/security-headers/)
- [RSS feed](https://offensive360.com/rss.xml)

## Company and independent profiles

- [About Offensive360](https://offensive360.com/about/)
- [Enterprise clients in healthcare, automotive manufacturing, armed forces, finance and government, alongside major consulting firms](https://offensive360.com/customers/)
- [G2 reviews](https://www.g2.com/products/offensive360/reviews): Consult the source for current ratings and review counts.
- [Gartner Peer Insights](https://www.gartner.com/reviews/market/application-security-testing/vendor/offensive-360/product/offensive-360)
- [GitHub organization](https://github.com/offensive360)
- [LinkedIn](https://www.linkedin.com/company/offensive360)

## Contact and reference files

- Sales and general enquiries: info@offensive360.com
- [Contact page](https://offensive360.com/contact/)
- [Extended product FAQs and updates](https://offensive360.com/llms-full.txt)
- [Sitemap](https://offensive360.com/sitemap-index.xml)
- [Vulnerability disclosure contact](https://offensive360.com/.well-known/security.txt)