What do you need to run a scan?

At a minimum, you can search for your application on the App Store or Google Play and run a free, fast scan on ostorlab.co with no login required. Or provide the mobile artifact (APK, AAB or IPA). For deeper coverage of authenticated flows, add test credentials before running a full scan.

Can Ostorlab test behind login, one-time codes and MFA?

Yes. Add test accounts and a way to receive one-time codes, for example by SMS, TOTP or email, in the scan setup. Ostorlab then logs in and tests the authenticated flows. Our team can help you set this up for your app.

What is in scope, and what isn't?

In scope: the Android, iOS or HarmonyOS app you provide, from the store or as an APK, AAB, non-encrypted IPA or TestFlight build, how it behaves at runtime, and the backend APIs it calls. Depth depends on the scan: a Fast Scan covers static analysis and dependencies, a Full Scan adds dynamic testing and backend API testing, and an Agentic Deep Scan adds business logic testing, vulnerability chaining and proof-of-concept exploits. Runtime protections can limit dynamic testing, so we recommend scanning with protections enabled, then disabled. Backends that aren't internet-facing need our scanner IP addresses allowlisted, or an on-premises scanner. Ostorlab is not a compliance certification, and it does not replace manual testing for the scope that needs human judgment.

Each finding comes with a risk rating and technical evidence in the Ostorlab platform, and can be sent as a ticket to Jira, ServiceNow and other ticketing systems. You can export any scan as a PDF: a full technical report, an executive summary, or a standards report that maps findings to standards such as OWASP MASVS. Agentic Deep Scans also show the steps the AI agent took to validate each finding, and a coverage heatmap of which areas were tested in depth and where coverage was limited. Once a fix ships, you can re-test a single finding from its ticket without a full rescan.

We don't have a mobile app. Can you test just our web app and APIs?

Yes. Ostorlab tests web applications and APIs on their own, with no mobile app needed. Provide the URLs or API endpoints and test accounts, and optionally a GraphQL, OpenAPI or WSDL schema file. See web app and API security testing.

Does Ostorlab replace our manual penetration test?

No. Ostorlab tests every release automatically, so issues are found between manual tests, and it can reduce the manual pentest effort you need. Keep manual testing for the scope that needs human judgment.

How does Ostorlab reduce false positives?

Findings are validated and backed by technical evidence, which keeps false positives under 5%. Confirmed findings get a standard risk rating (critical, high, medium, low), and potential findings are kept separate and clearly marked. When a finding is marked as a false positive, we track it so it doesn't resurface in future scans.

Where is our data stored?

Ostorlab has a SOC 2 Type II report for the Security criteria, covering 18 Nov 2024 – 18 Apr 2025 (the audit for the current period is in progress). On the Enterprise plan you can choose data residency in the United States, the European Union, the GCC or Asia-Pacific, or run scans on-premises. Details are in the Trust Center.

Do you support Android, iOS and HarmonyOS?

Yes, Ostorlab scans Android, iOS and HarmonyOS applications, including APK and TestFlight builds.

How do results integrate with our workflow?

Ostorlab groups vulnerabilities into tickets that can be assigned in the platform or sent to Jira, ServiceNow and other ticketing systems.

How long until we see findings?

Fast scans usually finish in 1 to 5 minutes and full scans in 15 to 45 minutes. An AI-agent pentest goes deeper and typically takes a few hours, depending on the app.

Every release of your banking app, pentested.

For banks and fintechs whose app is the main channel. Ostorlab logs in, tests the build your customers download, and follows it into the APIs that move money, on every release.

Gets in: login, one-time codes and multi-factor
Gets past: the store build, with TLS pinning and obfuscation
Goes through: the APIs and business logic behind accounts and payments
Proves: a working exploit you can replay for each AI-agent finding

Book a demo Read the Banking Report 2025

Trusted by banks and fintechs, including

4.8/5 on Gartner Peer Insights SOC 2 Type II report (Security)

Ostorlab research

Banking Report 2025: Security at the Core of Mobile Finance

We analyzed more than 500 top mobile banking apps, in the second edition of our study. The report looks at decade-old codebases, backend centralization and the security flaws that keep showing up in production apps.

50%+of apps had hardcoded secrets such as API keys, tokens or credentials
46%of apps use outdated libraries
20%of apps still use cleartext HTTP

Figures from the Ostorlab Banking Report 2025, a study of 500+ top mobile banking apps.

Read the banking report

Attack surface

Where banking apps get attacked

Attackers go after the flows where identity and money move. Here is what Ostorlab tests in each one, on every release.

Login and MFA
The risk
Flawed login, one-time code and step-up logic opens the door to account takeover.
What Ostorlab tests
Logs in with your test accounts, including one-time codes by SMS, TOTP or email, and tests the authentication logic behind them.
Onboarding and KYC
The risk
Identity documents and selfies captured during onboarding can be left behind on the device.
What Ostorlab tests
Checks where document and selfie artifacts are written, cached or logged, and whether they are protected at rest.
Payments and transfers
The risk
The APIs behind transfers carry the business logic that moves money.
What Ostorlab tests
Intercepts the app's traffic, even with TLS pinning, and tests the APIs and business logic behind payments.
Beneficiary management
The risk
Adding or changing a payee is a common step before fraud.
What Ostorlab tests
Exercises payee flows in the running app and tests the API calls behind them for authorization and logic flaws.
Session handling
The risk
Tokens that leak into storage, logs or screenshots let an attacker reuse a customer's session.
What Ostorlab tests
Looks for session tokens and personal data in local storage, caches, logs and screenshots.
Account access
The risk
Hidden endpoints, client-side gates and unsafe deep links or WebViews can expose account data.
What Ostorlab tests
Finds bypassable client-side controls, hidden endpoints, and injection paths through WebViews and deep links.

Every finding comes with evidence your developers can act on

Decompiled source context
Shows where the risk originates, including third-party components
File system evidence
Shows what was written, where and when
Function invocation coverage
Shows that the affected code paths were actually reached
Replayable exploit
A working exploit you can replay for each AI-agent finding

Platform

Key capabilities for banks

The parts of the Ostorlab platform bank security teams ask about most. Each one has its own page with the details.

Compliance and vendor review

Evidence for your auditors and your vendor review

Ostorlab helps you test your app against the security expectations in the frameworks your auditors ask about, and gives you reports you can reuse as evidence from one release to the next.

Helps you test against and produce evidence for

Europe
Operational resilience, network security, data protection and strong customer authentication
- DORA
- NIS2
- GDPR
- PSD2 SCA
United Kingdom
Operational resilience for banks and payment firms
- FCA SYSC 15A
- PRA SS1/21
United States
Security testing, customer data protection and cybersecurity programs
- FFIEC
- GLBA
- NYDFS 23 NYCRR 500
Middle East
Central bank cybersecurity frameworks in Saudi Arabia, the UAE, Qatar and Bahrain
- SAMA Cyber Security Framework
- CBUAE
- QCB
- CBB (Bahrain)
Africa
Central bank and data protection rules in Morocco, Egypt, Nigeria, South Africa and Kenya
- Bank Al-Maghrib
- CBE (Egypt)
- CBN Cybersecurity Framework
- SARB / PA Joint Standard 2
- POPIA
- CBK Cybersecurity Guidance
Asia-Pacific
Technology risk and information security rules in Singapore, Hong Kong, India, Japan and Australia
- MAS TRM
- HKMA
- RBI
- FISC
- APRA CPS 234
Latin America
Cybersecurity and data protection rules in Brazil
- BCB
- LGPD
Global standards
Payment card data and mobile app security
- PCI DSS
- OWASP MASVS

Ostorlab's own security

Ostorlab has a SOC 2 Type II report for the Security criteria, covering 18 Nov 2024 – 18 Apr 2025 (the audit for the current period is in progress). Our controls, policies and document requests are in the Trust Center.

Visit the Trust Center

Data residency

On the Enterprise plan, choose where your data is hosted.

United States
European Union
GCC
Asia-Pacific

On-premises

Run scans from inside your network, so non-production apps and APIs never need to be exposed.

About on-premises scanning

Trusted by Security Teams Worldwide

Discover why industry experts love working with our platform

4.8 / 5

Very efficient team, the support engineers are very good and knowledgeable. The product is always evolving and they take customer input very seriously.

Senior AppSec EngineerBanking · 50M - 250M USD

A reliable product with unique features and a personalized approach to products.

IT Security & Risk Management AssociateSoftware · 30B+ USD

The platform helped us evaluate our internal mobile applications easily and efficiently. The onboarding was smooth and the UI dynamic automation is great.

Operations AssociateIT Services · 30B+ USD

The product meets our needs perfectly and is easy to set up and use. The team is very reactive.

Engineering ManagerIT Services · 50M - 250M USD

Very professional and technical. Five star. Excellent delivery.

Security ArchitectMedia · 250M - 500M USD

We selected Ostorlab as our sole partner in providing mobile applications and web vulnerability scans. We have a very good partnership.

Director, IT Security and Risk ManagementBanking · <50M USD

Their customer service is top notch and their product is constantly improving.

Senior Cyber Security SpecialistConstruction · 1B - 3B USD

Easy to use and getting better with new updates, they are also quick to help and very efficient.

CTOIT Services · <50M USD

Great product, with amazing customer service, very useful, accurate, and straightforward to use.

Engineering ManagerEducation · Gov't/PS/ED <5,000 Employees

Prompt support and personalized features highlighted.

IT Security & Risk Management AssociateSoftware · 30B+ USD

I had a very excellent experience with Ostorlab as a MAST solution.

Director, IT Security and Risk ManagementBanking · 250M - 500M USD

Very efficient team, the support engineers are very good and knowledgeable. The product is always evolving and they take customer input very seriously.

Senior AppSec EngineerBanking · 50M - 250M USD

A reliable product with unique features and a personalized approach to products.

IT Security & Risk Management AssociateSoftware · 30B+ USD

The platform helped us evaluate our internal mobile applications easily and efficiently. The onboarding was smooth and the UI dynamic automation is great.

Operations AssociateIT Services · 30B+ USD

The product meets our needs perfectly and is easy to set up and use. The team is very reactive.

Engineering ManagerIT Services · 50M - 250M USD

Very professional and technical. Five star. Excellent delivery.

Security ArchitectMedia · 250M - 500M USD

We selected Ostorlab as our sole partner in providing mobile applications and web vulnerability scans. We have a very good partnership.

Director, IT Security and Risk ManagementBanking · <50M USD

Their customer service is top notch and their product is constantly improving.

Senior Cyber Security SpecialistConstruction · 1B - 3B USD

Easy to use and getting better with new updates, they are also quick to help and very efficient.

CTOIT Services · <50M USD

Great product, with amazing customer service, very useful, accurate, and straightforward to use.

Engineering ManagerEducation · Gov't/PS/ED <5,000 Employees

Prompt support and personalized features highlighted.

IT Security & Risk Management AssociateSoftware · 30B+ USD

I had a very excellent experience with Ostorlab as a MAST solution.

Director, IT Security and Risk ManagementBanking · 250M - 500M USD

Very efficient team, the support engineers are very good and knowledgeable. The product is always evolving and they take customer input very seriously.

Senior AppSec EngineerBanking · 50M - 250M USD

A reliable product with unique features and a personalized approach to products.

IT Security & Risk Management AssociateSoftware · 30B+ USD

The platform helped us evaluate our internal mobile applications easily and efficiently. The onboarding was smooth and the UI dynamic automation is great.

Operations AssociateIT Services · 30B+ USD

The product meets our needs perfectly and is easy to set up and use. The team is very reactive.

Engineering ManagerIT Services · 50M - 250M USD

Very professional and technical. Five star. Excellent delivery.

Security ArchitectMedia · 250M - 500M USD

We selected Ostorlab as our sole partner in providing mobile applications and web vulnerability scans. We have a very good partnership.

Director, IT Security and Risk ManagementBanking · <50M USD

Their customer service is top notch and their product is constantly improving.

Senior Cyber Security SpecialistConstruction · 1B - 3B USD

Easy to use and getting better with new updates, they are also quick to help and very efficient.

CTOIT Services · <50M USD

Great product, with amazing customer service, very useful, accurate, and straightforward to use.

Engineering ManagerEducation · Gov't/PS/ED <5,000 Employees

Prompt support and personalized features highlighted.

IT Security & Risk Management AssociateSoftware · 30B+ USD

I had a very excellent experience with Ostorlab as a MAST solution.

Director, IT Security and Risk ManagementBanking · 250M - 500M USD

FAQ

Frequently asked questions

Straight answers on coverage, setup, and how results reach your team.

Can't find your answer? Book a demo or contact us.

In scope: the Android, iOS or HarmonyOS app you provide, from the store or as an APK, AAB, non-encrypted IPA or TestFlight build, how it behaves at runtime, and the backend APIs it calls. Depth depends on the scan: a Fast Scan covers static analysis and dependencies, a Full Scan adds dynamic testing and backend API testing, and an Agentic Deep Scan adds business logic testing, vulnerability chaining and proof-of-concept exploits. Runtime protections can limit dynamic testing, so we recommend scanning with protections enabled, then disabled. Backends that aren't internet-facing need our scanner IP addresses allowlisted, or an on-premises scanner. Ostorlab is not a compliance certification, and it does not replace manual testing for the scope that needs human judgment.
Each finding comes with a risk rating and technical evidence in the Ostorlab platform, and can be sent as a ticket to Jira, ServiceNow and other ticketing systems. You can export any scan as a PDF: a full technical report, an executive summary, or a standards report that maps findings to standards such as OWASP MASVS. Agentic Deep Scans also show the steps the AI agent took to validate each finding, and a coverage heatmap of which areas were tested in depth and where coverage was limited. Once a fix ships, you can re-test a single finding from its ticket without a full rescan.

See how Ostorlab would pentest your banking app

Book a demo to walk through a scan with our team and get answers to your security and vendor-review questions. Or start with a free scan of your app from the store.

Book a demo Scan your app free

Every release of your banking app, pentested.

Banking Report 2025: Security at the Core of Mobile Finance

Where banking apps get attacked

Login and MFA

Onboarding and KYC

Payments and transfers

Beneficiary management

Session handling

Account access

Every finding comes with evidence your developers can act on

Key capabilities for banks

Evidence for your auditors and your vendor review

Helps you test against and produce evidence for

Ostorlab's own security

Data residency

On-premises

Trusted by Security Teams Worldwide

Frequently asked questions

01What do you need to run a scan?

02Can Ostorlab test behind login, one-time codes and MFA?

03What is in scope, and what isn't?

04What do we receive?

05We don't have a mobile app. Can you test just our web app and APIs?

06Does Ostorlab replace our manual penetration test?

07How does Ostorlab reduce false positives?

08Where is our data stored?

09Do you support Android, iOS and HarmonyOS?

10How do results integrate with our workflow?

11How long until we see findings?

See how Ostorlab would pentest your banking app