Scan Types Comparison
Ostorlab offers specialized scan types tailored to different security assessment objectives, target assets, and lifecycle phases. This guide compares the core scan types and profiles so you can select the right scan for your security and compliance needs.
🧭 Testing Modes at a Glance
The table shows what each mode is for, what you need to prepare, and its AI provider or cost.
| Mode | What you get | What you need | AI and cost |
|---|---|---|---|
| Free store scan (Community plan) | Static analysis of an app published on the App Store or Google Play | The store app, plus an email address on ostorlab.co or an Ostorlab account | None |
| Continuous checks: Fast / Full in CI or on a schedule | Fast: static analysis. Full: static, dynamic and backend testing | The app, URL or repository; test credentials for logged-in areas (optional) | None |
| Deep Agentic Scan (mobile, web, network) | AI-agent pentest: attack chains, business logic, findings validated with a proof of concept (no human validation). On mobile, it also runs every Mobile Shielding Scan check | The target, an AI provider and a testing depth; test credentials for logged-in areas (optional) | Cyber Models or BYOK |
| Multi-asset scan | A mobile app, web apps, network ranges, code and files in one scan, with attack chains across assets in a single report | The assets (at most one mobile app), an AI provider and an effort level | Core / Advanced / Elite: 50 / 200 / 400 credits, or BYOK |
| Mobile Shielding Scan | How the app's hardening holds up: obfuscation, anti-tampering, anti-debugging, root and jailbreak detection. Not a vulnerability scan. The Mobile Deep Agentic Scan includes these checks; this mode runs them on their own | The app, an AI provider and an effort level; test credentials optional | Core / Advanced / Elite: 50 / 200 / 400 credits, or BYOK |
| Single Vulnerability Assessment | A re-test of one reported finding after a fix | The reported finding | Cyber Models or BYOK |
The free store scan is part of the Community plan. For what each paid plan includes, see Pricing.
📊 Overview Comparison Matrix
| Scan Category | Target Assets | Primary Focus | Analysis Techniques | Credit / AI Consumption |
|---|---|---|---|---|
| Mobile Application Scans | Android (.apk, .aab), iOS (.ipa), Store URLs, TestFlight |
Binary integrity, client storage, runtime behavior, backend API communication | SAST, DAST, runtime instrumentation, API fuzzing, AI pentesting | Optional (Only for Deep Agentic) |
| Web & API Scans | Web apps, Single Page Apps (SPAs), REST, GraphQL, OpenAPI | Injection, auth bypass, business logic flaws, dependency security | Headless crawling, active fuzzing, Nuclei CVE templates, AI vulnerability chaining | Optional (Only for Deep Agentic) |
| Attack Surface Scans | Domains, subdomains, IP ranges, public cloud footprints | Organization-wide discovery, perimeter monitoring, shadow IT, CISA KEV | OSINT, DNS brute-forcing, certificate transparency, template scanning | None (no credits used) |
| Network Infrastructure Scans | Single IPs, CIDR blocks, hostnames, network services | Open ports, outdated daemon versions, misconfigurations, default credentials | Port scanning, service banner fingerprinting, protocol handshakes, AI network reasoning | Optional (Only for Deep Agentic) |
| Source Code Scans | Git repositories (GitHub, GitLab, Bitbucket, Azure DevOps), ZIP archives | Code vulnerabilities, hardcoded secrets, dependency CVEs, architecture flaws | Deterministic SAST (Opengrep), SCA (OSV lockfiles), TruffleHog secrets, AI multi-turn AST agents | Configurable (Core, Advanced, Elite) |
📱 Mobile, Web, and API Scan Profiles Comparison
Different profiles cater to varying operational speeds, testing depth, and CI/CD integration requirements:
| Feature / Capability | Fast Scan | Full Scan | Exhaustive Scan (web / network) | Deep Agentic Scan | Single Vulnerability Assessment |
|---|---|---|---|---|---|
| Primary Use Case | Rapid PR / CI/CD pipeline checks | Scheduled deep security audits | Periodic perimeter & exposure audits | Pre-release pentesting & zero-day discovery | Remediation verification & re-testing |
| Execution Duration | 1 - 5 minutes | 15 - 45 minutes | 30 - 90 minutes | 1 - 3 hours | 2 - 10 minutes |
| Static Code / Binary Analysis (SAST) | Supported | Supported | Partial (Fingerprinting) | Supported | Focused on target issue |
| Dynamic Runtime Instrumentation (DAST) | No | Supported | No | Supported (Dynamic tools) | Target verification |
| Backend API Fuzzing & Communication | No | Supported | External discovery | Supported | Target endpoint |
| CVE & Known Vulnerability Templates | Dependencies (SCA) | Supported | Thousands (Nuclei) | Supported | Target CVE |
| Autonomous Vulnerability Chaining | No | No | No | Supported (e.g., SSRF to RCE) | No |
| Business Logic Flaw Detection | No | Basic heuristics | No | Supported (Multi-turn LLM) | Targeted verification |
| Automated PoC Exploit Generation | No | No | No | Supported (Actionable PoC) | Supported |
| Credit Requirement | None | None | None | Cyber Models or BYOK | Cyber Models or BYOK |
🔍 Attack Surface Scan Comparison
Attack Surface Management (ASM) scans focus on mapping your organization's external footprint rather than deep application code analysis:
| Capability / Dimension | Attack Surface Exhaustive Scan | Attack Surface KEV Scan | In-Depth Asset Scans (Web/Mobile/Network) |
|---|---|---|---|
| Objective | Continuous discovery and mapping of all external-facing assets | Prioritized detection of actively exploited vulnerabilities | Comprehensive vulnerability assessment of a specific target |
| Scope | Broad organization domain, subdomains, certificates, public mobile apps | Discovered organization assets matched against CISA KEV catalog | Deep inspection of an individual asset (app, binary, URL, IP) |
| Discovery Sources | Certificate Transparency, DNS records, public cloud buckets, app stores | Automated feeds from CISA KEV, threat intelligence | User-provided repository, binary, URL, or IP address |
| Depth of Testing | Lightweight non-intrusive service fingerprinting and exposure detection | Rapid vulnerability checking targeting known exploit signatures | Deep multi-turn fuzzing, SAST, DAST, logic exploration, and chaining |
| Run Frequency | Continuous / Scheduled (daily, weekly) | Continuous / Automated on new KEV publication | Per-commit, per-build, or on-demand security audit |
| Intrusiveness | Safe, passive to low-impact external probes | Low-impact targeted checks | Active fuzzing and agentic pentesting exploration |
🎯 How to Choose the Right Scan
- For CI/CD and Pull Request Checks:
- Use Source Code Fast Scan or Mobile Fast Scan to receive actionable feedback in minutes without using credits.
- For Scheduled Audits & Compliance:
- Use Full Web Scan or Full Mobile Scan to assess static, dynamic, and backend communication posture.
- For Organization-Wide Visibility & Shadow IT:
- Run Attack Surface Exhaustive Scan to continuously discover forgotten servers, rogue subdomains, and expired certificates.
- For Pre-Release Verification & High-Risk Applications:
- Deploy Web Deep Agentic Scan, Mobile Deep Agentic Scan, or Source Code Scan (Advanced/Elite) for autonomous business logic flaw discovery and exploit chaining.
- For Verifying Bug Fixes:
- Run Single Vulnerability Assessment directly from a reported ticket to confirm remediation without running a complete rescan.