Embedding Security into the Mobile Development Lifecycle with Ostorlab
RSA Security embeds security testing into every step of mobile development through its Secure Development Lifecycle. Security starts at design, continues through development and release, and stays active after the app goes live. Ostorlab runs SAST and DAST on every iOS and Android release as part of RSA’s formal security sign-off, and Threat Center helps RSA spot new vulnerabilities as soon as they affect its mobile apps.
As RSA’s mobile apps grew, the team needed a clear view of security risks on every release. They also needed a way to know when new vulnerabilities affected their apps without waiting for the next scan. Point-in-time testing could miss issues between releases, and new CVEs could stay unnoticed for too long.
Shifting security testing left
Rather than treating security as a last-minute check, RSA builds it into every stage of its SDL: threat modeling at design, SAST and SCA on every pull request, and Ostorlab SAST and DAST before each release. This helps the team catch problems before they reach users and keeps release cycles smoother.
“Shifting security testing left and using Ostorlab throughout development helps us find and fix mobile security issues early. It reduces last-minute surprises and gives us steady visibility into new risks.”
— RSA Security
Before each iOS and Android release ships, RSA runs SAST and DAST with Ostorlab as part of release testing. Security sign-off is required before any release moves forward, so every release gets the same check.
- RSA has closed out all 145 findings Ostorlab has reported, with none currently open.
RSA uses Ostorlab Threat Center to get alerts when new CVEs affect its mobile apps. This gives the team early warning without waiting for the next testing cycle.
Early CVE visibility
Over a 30-day period, Ostorlab Threat Center flagged 89 newly disclosed CVEs as potentially affecting RSA's mobile assets, so the team could prioritize them right away.
Reduced exposure window
High-priority issues historically stayed exposed for an average of 342 days. Over a recent 30-day period, no high-priority issue was left exposed.
Proactive alerts from Ostorlab are highly valuable, as they enable us to quickly understand when newly disclosed vulnerabilities impact our mobile assets without waiting for the next testing cycle. This early visibility allows us to prioritize remediation, reduce exposure time, and maintain strong security posture with minimal disruption to delivery velocity.
— RSA Security
Today, RSA triggers Ostorlab mobile security testing manually at release. The next step is to automate it within CI/CD so coverage happens on every build, not just at release.
For RSA, that means:
- Clear mobile findings that developers can act on easily
- Continuous coverage across every build
- Low noise so teams are not overwhelmed by false positives
- Fast feedback so issues can be fixed early
The goal is for MAST to behave the way SAST and SCA already do at RSA, running automatically on every build, consistently, without manual intervention.
Security requirements and threat modeling embedded at the feature design stage
SAST and SCA run automatically on every pull request in RSA’s CI pipeline
Ostorlab SAST and DAST run manually during release testing
Security sign-off required as a formal release gate
Post-release monitoring maintained through RSA's vulnerability disclosure process
Proactive Ostorlab Threat Center alerts surface newly disclosed vulnerabilities affecting production assets immediately
RSA's approach shows how a mature SDL framework, release-gated mobile security testing, and continuous CVE monitoring can work together. With Ostorlab embedded into the release process today and CI/CD automation as the next step, the team gains a consistent, scalable way to maintain security posture across every release.
Get Started
Learn how RSA embeds security across mobile delivery
Request a demo to see how Ostorlab can be embedded into your mobile release process for stronger security confidence.
Book a Demo