What does Ostorlab test in a web application?

Ostorlab tests the running application and the APIs behind it: authentication and sessions, access control between users and roles, business logic, injection, exposed secrets and vulnerable components.

What do you need to run a scan?

The URLs or domains of your web app, or your API endpoints, and optionally a GraphQL, OpenAPI or WSDL schema file. No mobile app is needed. To test behind login, add test credentials: a login and password, HTTP headers such as an API key, or a recorded browser script for complex login flows. For apps that aren't internet-facing, allowlist our scanner IP addresses, use a reverse proxy, or run an on-premises scanner.

What is in scope, and what isn't?

In scope: the web apps, single-page apps and APIs at the URLs you provide, including the pages and API calls behind login when you add test credentials. You can exclude URLs with a regex filter and cap the number of requests per second. Depth depends on the scan: a Full Web Scan crawls and tests the running app, including known-vulnerability checks, and an Agentic Deep Scan adds business logic testing, vulnerability chaining and proof-of-concept exploits. Ostorlab is not a compliance certification, and it does not replace manual testing for the scope that needs human judgment.

Each finding comes with a risk rating and technical evidence in the Ostorlab platform, and can be sent as a ticket to Jira, ServiceNow and other ticketing systems. You can export any scan as a PDF: a full technical report, an executive summary, or a standards report that maps findings to compliance standards. Agentic Deep Scans also show the steps the AI agent took to validate each finding, and a coverage heatmap of which areas were tested in depth and where coverage was limited. Once a fix ships, you can re-test a single finding from its ticket without a full rescan.

Can you test web apps behind SSO and MFA?

Yes. Add test accounts and a way to receive one-time codes, for example by TOTP or email, in the scan setup. Ostorlab then logs in and tests the authenticated pages and API calls. Our team can help you set this up for your app.

Can Ostorlab find access control flaws between users and tenants?

Yes. Give Ostorlab test accounts with different roles or tenants, and the AI agents replay requests across them to find broken object-level and function-level authorization.

Does Ostorlab test GraphQL and other APIs?

Yes. Ostorlab tests REST, GraphQL, SOAP and gRPC APIs for authorization flaws, excessive data exposure and injection, including the endpoints your front end calls behind login.

Can Ostorlab scan staging apps behind our firewall?

Yes. With on-premises scanning, scans run from inside your network, so staging apps and internal APIs never need to be exposed to the internet.

Can Ostorlab help with OWASP ASVS, PCI DSS or SOC 2?

Ostorlab is not a compliance certification. It helps you test your web app against OWASP ASVS, the OWASP Top 10 and the security expectations in PCI DSS, and gives you reports you can reuse as evidence in SOC 2 and ISO 27001 audits and customer reviews.

Will this work with our existing development tools?

Yes. Ostorlab integrates with CI/CD tools such as GitHub Actions, and sends findings to Jira and other ticketing systems, so security testing fits into your existing release process.

Does Ostorlab replace our manual penetration test?

No. Ostorlab tests every release automatically, so issues are found between manual tests, and it can reduce the manual pentest effort you need. Keep manual testing for the scope that needs human judgment.

How does Ostorlab reduce false positives?

Findings are validated and backed by technical evidence, which keeps false positives under 5%. Confirmed findings get a standard risk rating (critical, high, medium, low), and potential findings are kept separate and clearly marked.

How long until we see findings?

Fast scans usually finish in 1 to 5 minutes and full scans in 15 to 45 minutes. An agentic penetration test goes deeper and typically takes a few hours, depending on the app.

Is our data secure with Ostorlab?

Ostorlab has a SOC 2 Type II report for the Security criteria, covering 18 Nov 2024 – 18 Apr 2025 (the audit for the current period is in progress), and data is encrypted at rest and in transit. On the Enterprise plan you can choose data residency in the United States, the European Union, the GCC or Asia-Pacific, or run scans on-premises. Details are in the Trust Center.

Every release of your web app and APIs, tested by AI agents the way an attacker would.

For security and engineering teams shipping web applications and APIs. Ostorlab logs in, maps the pages and API calls behind your app, and tests access control, business logic and injection on every release.

Gets in: SSO, MFA and custom login flows
Looks for: broken access control between users, roles and tenants
Goes through: the REST and GraphQL APIs behind each page
Proves: a working exploit you can replay for each AI-agent finding

Book a demo Read the GraphQL case study

Trusted by security teams at companies including

4.8/5 on Gartner Peer Insights SOC 2 Type II report (Security)

Ostorlab case study

How Ostorlab's AI agents found broken function-level authorization in GraphQL subscriptions

A GraphQL WebSocket endpoint accepted connections without credentials and let any user run a subscription that returned sensitive data. The case study follows each step the AI agent took, from the first unauthenticated handshake to a working proof of concept.

Case study published on the Ostorlab blog, December 2025.

Read the case study

Attack surface

Where web apps and APIs get attacked

Attackers go after the flows where identity, permissions and data move between the browser and your backend. Here is what Ostorlab tests in each one, on every release.

Authentication and SSO
The risk
Flaws in login, SSO, password reset and session handling let an attacker take over accounts.
What Ostorlab tests
Logs in with your test accounts through SSO, MFA or custom login flows, and tests session handling, password reset and token logic.
Access control and IDOR
The risk
Changing an identifier in a request returns another user's or another tenant's data, or unlocks admin functions.
What Ostorlab tests
Replays requests across users, roles and tenants to find broken object-level and function-level authorization.
APIs
The risk
Undocumented endpoints, GraphQL introspection and real-time subscriptions widen the attack surface beyond what the interface shows.
What Ostorlab tests
Discovers the REST and GraphQL endpoints your app calls and tests them for authorization flaws, excessive data exposure and injection.
Business logic
The risk
Workflows such as checkout, sign-up and approvals can be abused when the server trusts the order or content of requests.
What Ostorlab tests
AI agents explore multi-step workflows the way an attacker would, looking for steps that can be skipped or tampered with.
Injection
The risk
SQL, command and template injection or cross-site scripting let attackers read data, run code or act as your users.
What Ostorlab tests
Tests inputs, parameters and headers across authenticated pages and APIs for injection flaws, with request and response evidence for each finding.
Third-party integrations and secrets
The risk
API keys and tokens exposed in front-end code, vulnerable libraries and risky third-party scripts give attackers a way in.
What Ostorlab tests
Finds secrets in front-end code and traffic, vulnerable open-source components, and malicious or risky third-party code.

Every finding comes with evidence your developers can act on

Request and response evidence
The exact traffic that shows the issue
Step-by-step trace
How the AI agent reached the finding, action by action
Affected endpoint
Where the issue is, with remediation guidance
Replayable exploit
A working exploit you can replay for each AI-agent finding

Platform

Key capabilities for web app and API security

The parts of the Ostorlab platform web security and engineering teams ask about most. Each one has its own page with the details.

Compliance and vendor review

Evidence for your auditors and your customers' security reviews

Ostorlab helps you test your web app and APIs against the security and privacy expectations in the rules your auditors and customers ask about, and gives you reports you can reuse as evidence from one release to the next.

Helps you test against and produce evidence for

Europe
Personal data protection, cybersecurity for essential and important entities, and security requirements for products with digital elements
- GDPR
- NIS2
- CRA
United Kingdom
Data protection
- UK GDPR
United States
Consumer privacy in California, and health information safeguards where your app holds health data
- CCPA/CPRA
- HIPAA
Middle East
Personal data protection and national cybersecurity controls in Saudi Arabia, and personal data protection in the UAE
- Saudi PDPL
- NCA ECC
- UAE PDPL
Africa
Data protection in South Africa and Nigeria
- POPIA
- Nigeria NDPA
Asia-Pacific
Data protection in Singapore, Japan and India
- Singapore PDPA
- Japan APPI
- India DPDP
Latin America
Data protection in Brazil
- LGPD
Global standards
Web application security verification, the most critical web risks, payment card security, and evidence for the SOC 2 and ISO 27001 reviews your customers ask about
- OWASP ASVS
- OWASP Top 10
- PCI DSS
- SOC 2
- ISO 27001

Ostorlab's own security

Ostorlab has a SOC 2 Type II report for the Security criteria, covering 18 Nov 2024 – 18 Apr 2025 (the audit for the current period is in progress). Our controls, policies and document requests are in the Trust Center.

Visit the Trust Center

Data residency

On the Enterprise plan, choose where your data is hosted.

United States
European Union
GCC
Asia-Pacific

On-premises

Run scans from inside your network, so non-production apps and APIs never need to be exposed.

About on-premises scanning

Trusted by Security Teams Worldwide

Discover why industry experts love working with our platform

4.8 / 5

Very efficient team, the support engineers are very good and knowledgeable. The product is always evolving and they take customer input very seriously.

Senior AppSec EngineerBanking · 50M - 250M USD

A reliable product with unique features and a personalized approach to products.

IT Security & Risk Management AssociateSoftware · 30B+ USD

The platform helped us evaluate our internal mobile applications easily and efficiently. The onboarding was smooth and the UI dynamic automation is great.

Operations AssociateIT Services · 30B+ USD

The product meets our needs perfectly and is easy to set up and use. The team is very reactive.

Engineering ManagerIT Services · 50M - 250M USD

Very professional and technical. Five star. Excellent delivery.

Security ArchitectMedia · 250M - 500M USD

We selected Ostorlab as our sole partner in providing mobile applications and web vulnerability scans. We have a very good partnership.

Director, IT Security and Risk ManagementBanking · <50M USD

Their customer service is top notch and their product is constantly improving.

Senior Cyber Security SpecialistConstruction · 1B - 3B USD

Easy to use and getting better with new updates, they are also quick to help and very efficient.

CTOIT Services · <50M USD

Great product, with amazing customer service, very useful, accurate, and straightforward to use.

Engineering ManagerEducation · Gov't/PS/ED <5,000 Employees

Prompt support and personalized features highlighted.

IT Security & Risk Management AssociateSoftware · 30B+ USD

I had a very excellent experience with Ostorlab as a MAST solution.

Director, IT Security and Risk ManagementBanking · 250M - 500M USD

Very efficient team, the support engineers are very good and knowledgeable. The product is always evolving and they take customer input very seriously.

Senior AppSec EngineerBanking · 50M - 250M USD

A reliable product with unique features and a personalized approach to products.

IT Security & Risk Management AssociateSoftware · 30B+ USD

The platform helped us evaluate our internal mobile applications easily and efficiently. The onboarding was smooth and the UI dynamic automation is great.

Operations AssociateIT Services · 30B+ USD

The product meets our needs perfectly and is easy to set up and use. The team is very reactive.

Engineering ManagerIT Services · 50M - 250M USD

Very professional and technical. Five star. Excellent delivery.

Security ArchitectMedia · 250M - 500M USD

We selected Ostorlab as our sole partner in providing mobile applications and web vulnerability scans. We have a very good partnership.

Director, IT Security and Risk ManagementBanking · <50M USD

Their customer service is top notch and their product is constantly improving.

Senior Cyber Security SpecialistConstruction · 1B - 3B USD

Easy to use and getting better with new updates, they are also quick to help and very efficient.

CTOIT Services · <50M USD

Great product, with amazing customer service, very useful, accurate, and straightforward to use.

Engineering ManagerEducation · Gov't/PS/ED <5,000 Employees

Prompt support and personalized features highlighted.

IT Security & Risk Management AssociateSoftware · 30B+ USD

I had a very excellent experience with Ostorlab as a MAST solution.

Director, IT Security and Risk ManagementBanking · 250M - 500M USD

Very efficient team, the support engineers are very good and knowledgeable. The product is always evolving and they take customer input very seriously.

Senior AppSec EngineerBanking · 50M - 250M USD

A reliable product with unique features and a personalized approach to products.

IT Security & Risk Management AssociateSoftware · 30B+ USD

The platform helped us evaluate our internal mobile applications easily and efficiently. The onboarding was smooth and the UI dynamic automation is great.

Operations AssociateIT Services · 30B+ USD

The product meets our needs perfectly and is easy to set up and use. The team is very reactive.

Engineering ManagerIT Services · 50M - 250M USD

Very professional and technical. Five star. Excellent delivery.

Security ArchitectMedia · 250M - 500M USD

We selected Ostorlab as our sole partner in providing mobile applications and web vulnerability scans. We have a very good partnership.

Director, IT Security and Risk ManagementBanking · <50M USD

Their customer service is top notch and their product is constantly improving.

Senior Cyber Security SpecialistConstruction · 1B - 3B USD

Easy to use and getting better with new updates, they are also quick to help and very efficient.

CTOIT Services · <50M USD

Great product, with amazing customer service, very useful, accurate, and straightforward to use.

Engineering ManagerEducation · Gov't/PS/ED <5,000 Employees

Prompt support and personalized features highlighted.

IT Security & Risk Management AssociateSoftware · 30B+ USD

I had a very excellent experience with Ostorlab as a MAST solution.

Director, IT Security and Risk ManagementBanking · 250M - 500M USD

FAQ

Frequently asked questions

Straight answers on coverage, setup, and how results reach your team.

Can't find your answer? Book a demo or contact us.

The URLs or domains of your web app, or your API endpoints, and optionally a GraphQL, OpenAPI or WSDL schema file. No mobile app is needed. To test behind login, add test credentials: a login and password, HTTP headers such as an API key, or a recorded browser script for complex login flows. For apps that aren't internet-facing, allowlist our scanner IP addresses, use a reverse proxy, or run an on-premises scanner.
In scope: the web apps, single-page apps and APIs at the URLs you provide, including the pages and API calls behind login when you add test credentials. You can exclude URLs with a regex filter and cap the number of requests per second. Depth depends on the scan: a Full Web Scan crawls and tests the running app, including known-vulnerability checks, and an Agentic Deep Scan adds business logic testing, vulnerability chaining and proof-of-concept exploits. Ostorlab is not a compliance certification, and it does not replace manual testing for the scope that needs human judgment.
Each finding comes with a risk rating and technical evidence in the Ostorlab platform, and can be sent as a ticket to Jira, ServiceNow and other ticketing systems. You can export any scan as a PDF: a full technical report, an executive summary, or a standards report that maps findings to compliance standards. Agentic Deep Scans also show the steps the AI agent took to validate each finding, and a coverage heatmap of which areas were tested in depth and where coverage was limited. Once a fix ships, you can re-test a single finding from its ticket without a full rescan.

See how AI agents would test your web app

Book a demo to walk through a web app and API scan with our team and get answers to your security, compliance and vendor-review questions. Or review our controls and policies in the Trust Center.

Book a demo Visit the Trust Center

Every release of your web app and APIs, tested by AI agents the way an attacker would.

How Ostorlab's AI agents found broken function-level authorization in GraphQL subscriptions

Where web apps and APIs get attacked

Authentication and SSO

Access control and IDOR

APIs

Business logic

Injection

Third-party integrations and secrets

Every finding comes with evidence your developers can act on

Key capabilities for web app and API security

Evidence for your auditors and your customers' security reviews

Helps you test against and produce evidence for

Ostorlab's own security

Data residency

On-premises

Trusted by Security Teams Worldwide

Frequently asked questions

01What does Ostorlab test in a web application?

02What do you need to run a scan?

03What is in scope, and what isn't?

04What do we receive?

05Can you test web apps behind SSO and MFA?

06Can Ostorlab find access control flaws between users and tenants?

07Does Ostorlab test GraphQL and other APIs?

08Can Ostorlab scan staging apps behind our firewall?

09Can Ostorlab help with OWASP ASVS, PCI DSS or SOC 2?

10Will this work with our existing development tools?

11Does Ostorlab replace our manual penetration test?

12How does Ostorlab reduce false positives?

13How long until we see findings?

14Is our data secure with Ostorlab?

See how AI agents would test your web app