Ostorlab

7.3easy start · #1 of 21
in Mobile Application Security Testing Software

Free to practise onyes
Free trialnot on record
Well documentedyes
Runs where you workyes

Runs on Android, api, iOS, Web. Paid plans from $299/mo.

Ostorlab is ranked #1 of 21 in mobile application security testing software on The Geeks Club. It runs on Android, API, iOS, Web. There is a free plan. Paid plans start at $299/mo.

Ostorlab plans and pricing

All plans

Community Free unlimited mobile app scans · attack surface discovery · remediation and ticketing ostorlab.co · 30 Sept 2026

AppSec Web/API $299/mo billed yearly up to 3 Web/API targets · up to 3 source code repositories · 20 AI Security Credits/month blog.ostorlab.co · 30 Sept 2026

Agentic Pentest Core $499 once one-time assessment 50 tokens · high-confidence risk detection · multi-asset assessment · retest window included ostorlab.co · 30 Sept 2026

AppSec Mobile $599/mo billed annually 1 mobile app · up to 3 Web/API targets · up to 3 source code repositories · 20 AI Security Credits/month ostorlab.co · 30 Sept 2026

Enterprise Not published custom annual agreement configurable application coverage · annual pooled AI Security Credits ostorlab.co · 30 Sept 2026

Compared on mobile application security testing software

Free plan: Yes
Mobile platforms: both
Static binary analysis: Yes
Dynamic app analysis: Yes
Sensitive-data flow: Yes
Deployment model: cloud

Best Ostorlab alternatives

See all 20

Quixxi Scan 0 of 4 in the starter kit Lesson 27.3 AppSweep 0 of 4 in the starter kit Lesson 37.2 Cellebrite Inseyets 0 of 4 in the starter kit Lesson 47.1 Reversense Security 0 of 4 in the starter kit Lesson 57.1 Appknox 0 of 4 in the starter kit Lesson 66.8 Oversecured 0 of 4 in the starter kit Lesson 76.8

The record

Product: Ostorlab provides agentic penetration testing for mobile apps, web apps, APIs, and connected source code.
Authenticated testing: Its agents can handle logins, one-time codes, and multi-factor authentication to test logged-in workflows.
Exploit evidence: AI-agent findings include a working proof-of-concept exploit that can be replayed.
Attack paths: Ostorlab tests connected apps, APIs, web back ends, and source code together to identify exploit paths across assets.
Analysis: The platform combines static, dynamic, runtime, and behavioral analysis, plus dependency and source repository scanning.
Integrations: Listed integrations include GitHub Actions, GitLab CI, Bitbucket, Jenkins, CircleCI, Azure DevOps, Jira, ServiceNow, Slack, and SAML SSO.
Enterprise security: Enterprise lists SSO/SAML, role-based access control, audit logs, bring-your-own AI key, data residency in the US, EU, GCC, or APAC, and on-premises deployment as an add-on.
Security report: The site links to a SOC 2 Type II report through its Trust Center.
Supported mobile platforms: Ostorlab lists Android, iOS, and HarmonyOS mobile app testing.
Input formats: Supported scan inputs include Android APK, XAPK, and AAB files and non-encrypted iOS IPA files, as well as store and TestFlight scans.
Plan limit: AppSec Mobile covers one mobile app, up to three Web/API targets, and up to three source code repositories.
Credit usage: Routine workspace testing continues when AI Security Credits run out, while advanced AI actions require more credits.
Who it serves: The site describes the product as built for teams securing mobile products, including mobile engineering and AppSec teams.
Support: Enterprise support options include Standard, 24/5 Priority, or a dedicated technical account manager with a 24/7 SLA.
Price from: $299/mo

Where it ranks on The Geeks Club

Best Mobile Application Security Testing Software in 2026#1 of 21

Is Ostorlab yours?

Claim it for free: prove the domain, then correct facts, plans and screenshots. An editor reviews every change.

Claim it free Promote Ostorlab

Sources

ostorlab.co· checked 30 Sept 2026
ostorlab.co/plans· checked 30 Sept 2026
blog.ostorlab.co/who-should-use-ostorlab.html· checked 30 Sept 2026