# Ostorlab
> Agentic penetration testing for your mobile app and everything behind it: its APIs, web back end and code.

Ostorlab does agentic penetration testing: its AI agents test Android and iOS apps together with the APIs, web back ends and code behind them, and prove each finding with a working exploit. It is mobile-first and also covers web apps and APIs on their own. We combine static analysis (SAST), dynamic testing (DAST), API/backend analysis, and SCA/SBOM to find vulnerabilities across applications and the systems they depend on, with an emphasis on exploitability and verification. Built for continuous security testing, Ostorlab helps teams triage, remediate, and retest findings efficiently.
Agentic Deep Scan (Agentic Deep Scanner) is Ostorlab’s next-generation, agent-driven scanner that simulates real-world attacks to uncover truly exploitable vulnerabilities across applications and their dependent APIs (and for web, also third-party integrations). It focuses on workflow/business-logic flaws, authorization issues (BOLA/BFLA/IDOR-style), and attack chains that depend on runtime behavior, producing proof-grade evidence (e.g., logs/screenshots/reproducing steps), prioritizing exploitability-first findings, and offering verification retesting after fixes; it also supports authenticated flows (including 2FA/OTP on mobile and SSO/MFA setup on web) and includes BYOK (Bring Your Own AI Key) controls with per-scan guardrails.

Cross-asset attack-path testing (Multi-Asset Deep Agentic Scan) tests a mobile app together with its APIs, web back end, source code and supporting files, such as API schemas and architecture documents, in one scan. The agent follows weaknesses across the boundaries between those assets, for example a token left in a repository, accepted by an API and used from a mobile app, which single-surface scans report as three clean results. Findings are validated with proof-of-concept exploits and delivered in one consolidated report. A scan can include at most one mobile app and any number of web apps, APIs, networks, repositories, archives and files.

## Main Pages
- [Home](/) - Ostorlab homepage and platform overview
- [Pricing Plans](/plans) - Flexible pricing plans for businesses of all sizes
- [Request a Demo](/demo) - Request a personalized demonstration of the Ostorlab platform
- [Contact Us](/contact) - Get in touch with the Ostorlab team

## Products & Capabilities

**Mobile App Security**
- [Mobile App Security](/product/mobile) - Comprehensive dynamic and static analysis for iOS and Android
- [Agentic Deep Scan](/product/mobile_agentic_deep_scan) - Advanced, AI-driven exploration of application flows
- [SAST (Static Analysis)](/product/mobilesast) - Identify vulnerabilities in source code and binaries
- [DAST / Monkey Testing](/product/mobiledast) - Dynamic analysis and intelligent fuzzing
- [SCA / SBOM](/product/sca_sbom) - Software Composition Analysis and Software Bill of Materials generation
- [Secrets Detection](/product/secrets_scanning) - Identify exposed API keys, tokens, and hardcoded secrets
- [Autofix](/product/autofix) - Accelerate remediation with clear, actionable fix tasks and retesting loops
- [Malware & Resilience](/product/malware) - Detect malicious dependencies, hostile runtime behavior, and validate anti-tampering
- [Authentication / 2FA / OTP](/product/webauthentication) - Validate multi-factor authentication, step-up flows, and session logic
- [API & Backend Communication](/product/backend_api_network) - Deep inspection of backend communication and APIs
- [Privacy Compliance](/product/privacy_compliance) - Validate adherence to GDPR, CCPA, and HIPAA standards

**Web App Security**
- [Web App Security](/product/web) - Advanced web application and API security testing
- [Agentic Deep Scan](/product/web_agentic_deep_scan) - Advanced AI-driven web application exploration
- [DAST / Crawling](/product/webdast) - Comprehensive dynamic web application testing and crawling
- [Secrets Detection](/product/websecrets) - Identify exposed API keys and secrets in web applications
- [SBOM / SCA](/product/sbom) - Web application software composition analysis
- [Malware Detection](/product/malware) - Identify malicious scripts and dependencies
- [Authentication / 2FA / OTP](/product/webauthentication) - Validate multi-factor authentication and OTP flows
- [API Security](/product/web_api) - Thorough web API vulnerability scanning

**Cross-Asset Attack Paths**
- [Attack Path Testing (Multi-Asset Scan)](/product/multi-asset) - Test the mobile app, APIs, web back end and code together, and prove attack paths that cross them
- [Multi-Asset Scan documentation](https://docs.ostorlab.co/tutorials/multi_asset_scan.html) - How to run a multi-asset scan and which assets it supports

**Attack Surface Discovery**
- [Scanning / Monitoring / KEV](/product/attacksurface_monitoring) - Continuous scanning and monitoring for known exploited vulnerabilities
- [AI‑Triage / Asset Discovery](/product/attacksurface_discovery) - Automated, graph-based discovery of organizational assets

## Industry Solutions
- [Banking](/solutions/banking) - Secure banking applications against fraud and vulnerabilities
- [Mobile Gaming](/solutions/mobile_gaming) - Protect mobile games from cheats, ATO, wallet fraud, and clones
- [Healthcare](/solutions/healthcare) - Ensure HIPAA compliance and secure sensitive medical data
- [High Tech](/solutions/high_tech) - Scale application security for complex, fast-moving tech organizations

## Resources & Databases
- [Case Studies](/case-studies) - Real-world success stories and metrics of companies using Ostorlab