Understand the initial security exposure of your mobile app.
Baseline checks. Authenticated testing and deep agentic assessments belong to the paid offers.
Try mobile CommunityContinuous security for your code and applications.
Need a broader security program, deployment options or tailored support?
Very efficient team, the support engineers are very good and knowledgeable. The product is always evolving and they take customer input very seriously.
Gartner® and Peer Insights™ are trademarks of Gartner, Inc. and/or its affiliates. All rights reserved. Gartner Peer Insights content consists of the opinions of individual end users based on their own experiences, and should not be construed as statements of fact, nor do they represent the views of Gartner or its affiliates. Gartner does not endorse any vendor, product or service depicted in this content nor makes any warranties, expressed or implied, with respect to this content, about its accuracy or completeness, including any warranties of merchantability or fitness for a particular purpose
AppSec Mobile
Test mobile releases and track remediation over time.
Upload a supported Android or iOS build, or use a supported store or TestFlight link.
Add test accounts for authenticated workflows. OTP and MFA testing needs configured access to the test codes.
Run static, dynamic and runtime checks, track findings across versions, and connect testing to your release pipeline.
WHAT YOU ARE PAYING FOR
One Android package or iOS bundle identifier, including configured development and production aliases. Android and iOS count separately. Connected APIs can be supplied as assessment context; ongoing independent API coverage uses a Web/API subscription.
Each platform application has its own coverage. Development, QA and production builds on the same platform can share a subscription when their identifiers are configured as aliases.
Manage Source, Web/API and Mobile in one account. Source covers up to 100 repositories per subscription; Web/API covers up to 5 applications or API services. Mobile is licensed per application.
Paid subscriptions include unlimited collaborators, SSO, role-based access and audit logs.
Review severity, technical context and remediation guidance, track changes across scans, and hand work to your development team. Use AI credits for a targeted investigation, a proposed patch or fix validation.
Explore mobile testingUnderstand the initial security exposure of your mobile app.
Baseline checks. Authenticated testing and deep agentic assessments belong to the paid offers.
Try mobile CommunityConnect scans to CI/CD and your issue tracker. Configure integrations to fit the way your team releases software.
Need a broader security program, deployment options or tailored support?
CREDITS
Routine security testing is included in your AppSec subscription. AI credits are a separate allowance for deeper investigation, remediation and agentic assessments.
Mobile includes 10 AI credits per application each month. Each Source subscription includes 10 AI credits per month, shared across its covered repositories. Each Web/API subscription includes 5 AI credits per month, shared across its covered applications.
| AI action | What it does | Typical credits per action |
|---|---|---|
| Dig Deeper | Investigate a finding, explore its impact or test a specific security question. | 2–10 |
| AI Autofix patch | Generate a proposed code or configuration fix for your team to review. | 0.1–1 |
| Fix validation | Check whether a specific remediation resolves the finding. | 1–5 |
Typical ranges. Actual use depends on the finding, code and work involved.
For example, 10 credits could cover one Dig Deeper investigation costing 10 credits, or two fix validations costing 5 credits each.
These are alternative examples of spending the same budget, not guaranteed quantities or a combined allowance.
Unused monthly credits carry over and never expire. Each new monthly allowance is added to your unused balance.
Routine scans keep running when credits run out. AI work pauses until you add credits, receive your next allowance or use a supported BYOK configuration.
In your account, open Plans & pricing, then Unlock full coverage. Choose additional credits; they are added to your balance after payment.
Open my accountWhere your plan supports BYOK, your AI provider bills your model usage directly and no Ostorlab credits are used for that work. Your platform subscription still applies.
Check BYOK availabilitySee how each plan supports application testing, AI-powered remediation, reporting, continuous security, and governance. Click category headers to expand or collapse.
Not sure which testing mode you need? Compare testing modes
Learn how plans, application coverage, credits, and agentic scans work — including what happens when credits run out and how to top up.
Book a demoMobile covers one Android package or iOS bundle identifier, including configured development and production aliases. One Web/API subscription covers up to 5 web applications or independently tested API services. One Source subscription covers up to 100 public or private repositories. Each subscription includes routine testing, collaboration and monthly AI credits.
Start with Agentic Pentesting or build your complete Application Security program.
