What do you need to run a scan?

At a minimum, you can search for your application on the App Store or Google Play and run a free, fast scan on ostorlab.co with no login required. Or provide the mobile artifact (APK, AAB or IPA). For deeper coverage of authenticated flows, add test credentials before running a full scan.

Can Ostorlab test behind login, one-time codes and MFA?

Yes. Add test accounts and a way to receive one-time codes, for example by SMS, TOTP or email, in the scan setup. Ostorlab then logs in and tests the authenticated flows. Our team can help you set this up for your app.

What is in scope, and what isn't?

In scope: the Android, iOS or HarmonyOS app you provide, from the store or as an APK, AAB, non-encrypted IPA or TestFlight build, how it behaves at runtime, and the backend APIs it calls. Depth depends on the scan: a Fast Scan covers static analysis and dependencies, a Full Scan adds dynamic testing and backend API testing, and an Agentic Deep Scan adds business logic testing, vulnerability chaining and proof-of-concept exploits. Ostorlab detects runtime shielding and uses adaptive bypass techniques to test protected builds, with evidence of which protections held and which were bypassed. Backends that aren't internet-facing need our scanner IP addresses allowlisted, or an on-premises scanner. Assessment scope and any required compliance sign-off are agreed separately; a scan report is not a compliance certification.

Each finding comes with a risk rating and technical evidence in the Ostorlab platform, and can be sent as a ticket to Jira, ServiceNow and other ticketing systems. You can export any scan as a PDF: a full technical report, an executive summary, or a standards report that maps findings to standards such as OWASP MASVS. Agentic Deep Scans also show the steps the AI agent took to validate each finding, and a coverage heatmap of which areas were tested in depth and where coverage was limited. Once a fix ships, you can re-test a single finding from its ticket without a full rescan.

We don't have a mobile app. Can you test just our web app and APIs?

Yes. Ostorlab tests web applications and APIs on their own, with no mobile app needed. Provide the URLs or API endpoints and test accounts, and optionally a GraphQL, OpenAPI or WSDL schema file. See web app and API security testing.

Does Ostorlab replace our manual penetration test?

Yes. Ostorlab replaces manual application penetration testing with agentic assessments of your application and the APIs in scope. AI agents investigate attack paths, back confirmed findings with exploit evidence, and deliver technical and executive reports. Choose an Agentic Deep Scan or Agentic Pentest assessment for this work; the free store scan is a separate offer. Any regulatory requirements for certification, assessor accreditation or a specific sign-off should be agreed when defining the assessment.

How does Ostorlab reduce false positives?

Findings are validated and backed by technical evidence, which keeps false positives under 5%. Confirmed findings get a standard risk rating (critical, high, medium, low), and potential findings are kept separate and clearly marked. When a finding is marked as a false positive, we track it so it doesn't resurface in future scans.

Where is our data stored?

Ostorlab has a SOC 2 Type II report for the Security criteria, covering 18 Nov 2024 – 18 Apr 2025 (the audit for the current period is in progress). On the Enterprise plan you can choose data residency in the United States, the European Union, the GCC or Asia-Pacific, or run scans on-premises. Details are in the Trust Center. Run the scanner inside your network to reach private apps and APIs. Scans execute locally; the cloud platform orchestrates scans and receives results and scanner status for reporting.

Do you support Android, iOS and HarmonyOS?

Yes, Ostorlab scans Android, iOS and HarmonyOS applications, including APK and TestFlight builds.

How do results integrate with our workflow?

Ostorlab groups vulnerabilities into tickets that can be assigned in the platform or sent to Jira, ServiceNow and other ticketing systems.

How long until we see findings?

Fast scans usually finish in 1 to 5 minutes and full scans in 15 to 45 minutes. An AI-agent pentest goes deeper and typically takes a few hours, depending on the app.

Mobile Application Security Testing for banking apps (MAST)

Replace manual application pentesting with AI agents that find and prove exploitable flaws in your banking app and its APIs. Test account access, payments and customer-data flows, then give developers replayable evidence and clear remediation guidance.

Find account takeover and authorization flaws
Test payment and transfer business logic
Challenge runtime shielding and app protections
Give developers replayable exploits for confirmed AI findings

Book a demo Inspect the evidence

Trusted by banks and fintechs, including

4.8/5 on Gartner Peer Insights SOC 2 Type II report (Security)

Evidence for your evaluation

Inspect the evidence before choosing a scanner

Review a finding, check which workflows were reached, and compare tools on your own banking app.

See exploit evidence in action
Explore annotated mobile and web/API assessments with technical findings, reproduction steps and remediation guidance.
View the mobile sample View the web and API sample
Check what was actually tested
Use call coverage and the scan heatmap to inspect reached screens, attack paths and areas with limited coverage.
Read the coverage guide
Compare on the same app
Agree the build, test accounts, scan settings and time budget. Your team reproduces findings from both tools.
Run a bake-off
Review how data is handled
See the hybrid scanner model, cloud reporting and AI-provider options. Request policy details for your vendor review.
Review the Trust Center

Ostorlab research

Banking Report 2025: Security at the Core of Mobile Finance

We analyzed more than 500 top mobile banking apps, in the second edition of our study. The report looks at decade-old codebases, backend centralization and the security flaws that keep showing up in production apps.

50%+of apps had hardcoded secrets such as API keys, tokens or credentials
46%of apps use outdated libraries
20%of apps still use cleartext HTTP

Figures from the Ostorlab Banking Report 2025, our study of weaknesses observed in more than 500 top mobile banking apps.

Read the banking report

Attack surface

Where banking apps get attacked

Find exploitable weaknesses where identity and money move: login, onboarding, transfers, payees and account access. Confirmed AI findings come with evidence your team can replay and act on.

Login and MFA
The risk
Flawed login, one-time code and step-up logic opens the door to account takeover.
What Ostorlab tests
Logs in with your test accounts, including one-time codes by SMS, TOTP or email, and tests the authentication logic behind them.
Onboarding and KYC
The risk
Identity documents and selfies captured during onboarding can be left behind on the device.
What Ostorlab tests
Checks where document and selfie artifacts are written, cached or logged, and whether they are protected at rest.
Payments and transfers
The risk
The APIs behind transfers carry the business logic that moves money.
What Ostorlab tests
Intercepts the app's traffic, even with TLS pinning, and tests the APIs and business logic behind payments.
Beneficiary management
The risk
Adding or changing a payee is a common step before fraud.
What Ostorlab tests
Exercises payee flows in the running app and tests the API calls behind them for authorization and logic flaws.
Session handling
The risk
Tokens that leak into storage, logs or screenshots let an attacker reuse a customer's session.
What Ostorlab tests
Looks for session tokens and personal data in local storage, caches, logs and screenshots.
Account access
The risk
Hidden endpoints, client-side gates and unsafe deep links or WebViews can expose account data.
What Ostorlab tests
Finds bypassable client-side controls, hidden endpoints, and injection paths through WebViews and deep links.

Technical evidence to review and act on

Decompiled source context
Shows where the risk originates, including third-party components
File system evidence
Shows what was written, where and when
Function invocation coverage
Shows that the affected code paths were actually reached
Replayable exploit
Confirmed AI findings include exploit evidence your team can inspect and reproduce.

Platform

Key capabilities for banks

The parts of the Ostorlab platform bank security teams ask about most. Each one has its own page with the details. Mobile Application Security Testing (MAST) combines static analysis (SAST) and dynamic analysis (DAST).

Compliance and vendor review

Evidence for your auditors and your vendor review

Ostorlab helps you test your app against the security expectations in the frameworks your auditors ask about, and gives you reports you can reuse as evidence from one release to the next.

Helps you test against and produce evidence for

Europe
Operational resilience, network security, data protection and strong customer authentication
- DORA
- NIS2
- GDPR
- PSD2 SCA
United Kingdom
Operational resilience for banks and payment firms
- FCA SYSC 15A
- PRA SS1/21
United States
Security testing, customer data protection and cybersecurity programs
- FFIEC
- GLBA
- NYDFS 23 NYCRR 500
Middle East
Central bank cybersecurity frameworks in Saudi Arabia, the UAE, Qatar and Bahrain
- SAMA Cyber Security Framework
- CBUAE
- QCB
- CBB (Bahrain)
Africa
Central bank and data protection rules in Morocco, Egypt, Nigeria, South Africa and Kenya
- Bank Al-Maghrib
- CBE (Egypt)
- CBN Cybersecurity Framework
- SARB / PA Joint Standard 2
- POPIA
- CBK Cybersecurity Guidance
Asia-Pacific
Technology risk and information security rules in Singapore, Hong Kong, India, Japan and Australia
- MAS TRM
- HKMA
- RBI
- FISC
- APRA CPS 234
Latin America
Cybersecurity and data protection rules in Brazil
- BCB
- LGPD
Global standards
Payment card data and mobile app security
- PCI DSS
- OWASP MASVS

Ostorlab's own security

Ostorlab has a SOC 2 Type II report for the Security criteria, covering 18 Nov 2024 – 18 Apr 2025 (the audit for the current period is in progress). Our controls, policies and document requests are in the Trust Center.

Visit the Trust Center

Data residency

On the Enterprise plan, choose where your data is hosted.

United States
European Union
GCC
Asia-Pacific

On-premises

Run the scanner inside your network to reach private apps and APIs. Scans execute locally; the cloud platform orchestrates scans and receives results and scanner status for reporting.

About on-premises scanning

Trusted by Security Teams Worldwide

Discover why industry experts love working with our platform

4.8 / 5

Very efficient team, the support engineers are very good and knowledgeable. The product is always evolving and they take customer input very seriously.

Senior AppSec EngineerBanking · 50M - 250M USD

A reliable product with unique features and a personalized approach to products.

IT Security & Risk Management AssociateSoftware · 30B+ USD

The platform helped us evaluate our internal mobile applications easily and efficiently. The onboarding was smooth and the UI dynamic automation is great.

Operations AssociateIT Services · 30B+ USD

The product meets our needs perfectly and is easy to set up and use. The team is very reactive.

Engineering ManagerIT Services · 50M - 250M USD

Very professional and technical. Five star. Excellent delivery.

Security ArchitectMedia · 250M - 500M USD

We selected Ostorlab as our sole partner in providing mobile applications and web vulnerability scans. We have a very good partnership.

Director, IT Security and Risk ManagementBanking · <50M USD

Their customer service is top notch and their product is constantly improving.

Senior Cyber Security SpecialistConstruction · 1B - 3B USD

Easy to use and getting better with new updates, they are also quick to help and very efficient.

CTOIT Services · <50M USD

Great product, with amazing customer service, very useful, accurate, and straightforward to use.

Engineering ManagerEducation · Gov't/PS/ED <5,000 Employees

Prompt support and personalized features highlighted.

IT Security & Risk Management AssociateSoftware · 30B+ USD

I had a very excellent experience with Ostorlab as a MAST solution.

Director, IT Security and Risk ManagementBanking · 250M - 500M USD

Very efficient team, the support engineers are very good and knowledgeable. The product is always evolving and they take customer input very seriously.

Senior AppSec EngineerBanking · 50M - 250M USD

A reliable product with unique features and a personalized approach to products.

IT Security & Risk Management AssociateSoftware · 30B+ USD

The platform helped us evaluate our internal mobile applications easily and efficiently. The onboarding was smooth and the UI dynamic automation is great.

Operations AssociateIT Services · 30B+ USD

The product meets our needs perfectly and is easy to set up and use. The team is very reactive.

Engineering ManagerIT Services · 50M - 250M USD

Very professional and technical. Five star. Excellent delivery.

Security ArchitectMedia · 250M - 500M USD

We selected Ostorlab as our sole partner in providing mobile applications and web vulnerability scans. We have a very good partnership.

Director, IT Security and Risk ManagementBanking · <50M USD

Their customer service is top notch and their product is constantly improving.

Senior Cyber Security SpecialistConstruction · 1B - 3B USD

Easy to use and getting better with new updates, they are also quick to help and very efficient.

CTOIT Services · <50M USD

Great product, with amazing customer service, very useful, accurate, and straightforward to use.

Engineering ManagerEducation · Gov't/PS/ED <5,000 Employees

Prompt support and personalized features highlighted.

IT Security & Risk Management AssociateSoftware · 30B+ USD

I had a very excellent experience with Ostorlab as a MAST solution.

Director, IT Security and Risk ManagementBanking · 250M - 500M USD

Very efficient team, the support engineers are very good and knowledgeable. The product is always evolving and they take customer input very seriously.

Senior AppSec EngineerBanking · 50M - 250M USD

A reliable product with unique features and a personalized approach to products.

IT Security & Risk Management AssociateSoftware · 30B+ USD

The platform helped us evaluate our internal mobile applications easily and efficiently. The onboarding was smooth and the UI dynamic automation is great.

Operations AssociateIT Services · 30B+ USD

The product meets our needs perfectly and is easy to set up and use. The team is very reactive.

Engineering ManagerIT Services · 50M - 250M USD

Very professional and technical. Five star. Excellent delivery.

Security ArchitectMedia · 250M - 500M USD

We selected Ostorlab as our sole partner in providing mobile applications and web vulnerability scans. We have a very good partnership.

Director, IT Security and Risk ManagementBanking · <50M USD

Their customer service is top notch and their product is constantly improving.

Senior Cyber Security SpecialistConstruction · 1B - 3B USD

Easy to use and getting better with new updates, they are also quick to help and very efficient.

CTOIT Services · <50M USD

Great product, with amazing customer service, very useful, accurate, and straightforward to use.

Engineering ManagerEducation · Gov't/PS/ED <5,000 Employees

Prompt support and personalized features highlighted.

IT Security & Risk Management AssociateSoftware · 30B+ USD

I had a very excellent experience with Ostorlab as a MAST solution.

Director, IT Security and Risk ManagementBanking · 250M - 500M USD

FAQ

Frequently asked questions

Straight answers on coverage, setup, and how results reach your team.

Can't find your answer? Book a demo or contact us.

In scope: the Android, iOS or HarmonyOS app you provide, from the store or as an APK, AAB, non-encrypted IPA or TestFlight build, how it behaves at runtime, and the backend APIs it calls. Depth depends on the scan: a Fast Scan covers static analysis and dependencies, a Full Scan adds dynamic testing and backend API testing, and an Agentic Deep Scan adds business logic testing, vulnerability chaining and proof-of-concept exploits. Ostorlab detects runtime shielding and uses adaptive bypass techniques to test protected builds, with evidence of which protections held and which were bypassed. Backends that aren't internet-facing need our scanner IP addresses allowlisted, or an on-premises scanner. Assessment scope and any required compliance sign-off are agreed separately; a scan report is not a compliance certification.
Each finding comes with a risk rating and technical evidence in the Ostorlab platform, and can be sent as a ticket to Jira, ServiceNow and other ticketing systems. You can export any scan as a PDF: a full technical report, an executive summary, or a standards report that maps findings to standards such as OWASP MASVS. Agentic Deep Scans also show the steps the AI agent took to validate each finding, and a coverage heatmap of which areas were tested in depth and where coverage was limited. Once a fix ships, you can re-test a single finding from its ticket without a full rescan.
Yes. Ostorlab replaces manual application penetration testing with agentic assessments of your application and the APIs in scope. AI agents investigate attack paths, back confirmed findings with exploit evidence, and deliver technical and executive reports. Choose an Agentic Deep Scan or Agentic Pentest assessment for this work; the free store scan is a separate offer. Any regulatory requirements for certification, assessor accreditation or a specific sign-off should be agreed when defining the assessment.
Ostorlab has a SOC 2 Type II report for the Security criteria, covering 18 Nov 2024 – 18 Apr 2025 (the audit for the current period is in progress). On the Enterprise plan you can choose data residency in the United States, the European Union, the GCC or Asia-Pacific, or run scans on-premises. Details are in the Trust Center. Run the scanner inside your network to reach private apps and APIs. Scans execute locally; the cloud platform orchestrates scans and receives results and scanner status for reporting.

See how Ostorlab would pentest your banking app

Book a demo to walk through a scan with our team and get answers to your security and vendor-review questions. Or start with a free scan of your app from the store.

Book a demo Scan your app free

Mobile Application Security Testing for banking apps (MAST)

Inspect the evidence before choosing a scanner

See exploit evidence in action

Check what was actually tested

Compare on the same app

Review how data is handled

Banking Report 2025: Security at the Core of Mobile Finance

Where banking apps get attacked

Login and MFA

Onboarding and KYC

Payments and transfers

Beneficiary management

Session handling

Account access

Technical evidence to review and act on

Key capabilities for banks

Evidence for your auditors and your vendor review

Helps you test against and produce evidence for

Ostorlab's own security

Data residency

On-premises

Trusted by Security Teams Worldwide

Frequently asked questions

01What do you need to run a scan?

02Can Ostorlab test behind login, one-time codes and MFA?

03What is in scope, and what isn't?

04What do we receive?

05We don't have a mobile app. Can you test just our web app and APIs?

06Does Ostorlab replace our manual penetration test?

07How does Ostorlab reduce false positives?

08Where is our data stored?

09Do you support Android, iOS and HarmonyOS?

10How do results integrate with our workflow?

11How long until we see findings?

See how Ostorlab would pentest your banking app