Scan Types Comparison
Ostorlab offers specialized scan types tailored to different security assessment objectives, target assets, and lifecycle phases. This guide compares the core scan types and profiles so you can select the right scan for your security and compliance needs.
📊 Overview Comparison Matrix
| Scan Category | Target Assets | Primary Focus | Analysis Techniques | Token / AI Consumption |
|---|---|---|---|---|
| Mobile Application Scans | Android (.apk, .aab), iOS (.ipa), Store URLs, TestFlight |
Binary integrity, client storage, runtime behavior, backend API communication | SAST, DAST, runtime instrumentation, API fuzzing, AI pentesting | Optional (Only for Deep Agentic) |
| Web & API Scans | Web apps, Single Page Apps (SPAs), REST, GraphQL, OpenAPI | Injection, auth bypass, business logic flaws, dependency security | Headless crawling, active fuzzing, Nuclei CVE templates, AI vulnerability chaining | Optional (Only for Deep Agentic) |
| Attack Surface Scans | Domains, subdomains, IP ranges, public cloud footprints | Organization-wide discovery, perimeter monitoring, shadow IT, CISA KEV | OSINT, DNS brute-forcing, certificate transparency, template scanning | None (Zero token usage) |
| Network Infrastructure Scans | Single IPs, CIDR blocks, hostnames, network services | Open ports, outdated daemon versions, misconfigurations, default credentials | Port scanning, service banner fingerprinting, protocol handshakes, AI network reasoning | Optional (Only for Deep Agentic) |
| Source Code Scans | Git repositories (GitHub, GitLab, Bitbucket, Azure DevOps), ZIP archives | Code vulnerabilities, hardcoded secrets, dependency CVEs, architecture flaws | Deterministic SAST (Opengrep), SCA (OSV lockfiles), TruffleHog secrets, AI multi-turn AST agents | Configurable (Core, Advanced, Elite) |
📱 Mobile, Web, and API Scan Profiles Comparison
Different profiles cater to varying operational speeds, testing depth, and CI/CD integration requirements:
| Feature / Capability | Fast Scan | Full Scan | Exhaustive Scan | Deep Agentic Scan | Single Risk Validator |
|---|---|---|---|---|---|
| Primary Use Case | Rapid PR / CI/CD pipeline checks | Scheduled deep security audits | Periodic perimeter & exposure audits | Pre-release pentesting & zero-day discovery | Remediation verification & re-testing |
| Execution Duration | 1 - 5 minutes | 15 - 45 minutes | 30 - 90 minutes | 1 - 3 hours | 2 - 10 minutes |
| Static Code / Binary Analysis (SAST) | Supported | Supported | Partial (Fingerprinting) | Supported | Focused on target issue |
| Dynamic Runtime Instrumentation (DAST) | No | Supported | No | Supported (Dynamic tools) | Target verification |
| Backend API Fuzzing & Communication | No | Supported | External discovery | Supported | Target endpoint |
| CVE & Known Vulnerability Templates | Dependencies (SCA) | Supported | Thousands (Nuclei) | Supported | Target CVE |
| Autonomous Vulnerability Chaining | No | No | No | Supported (e.g., SSRF to RCE) | No |
| Business Logic Flaw Detection | No | Basic heuristics | No | Supported (Multi-turn LLM) | Targeted verification |
| Automated PoC Exploit Generation | No | No | No | Supported (Actionable PoC) | Supported |
| AI Token Requirement | None | None | None | Cybermodels or BYOK | None |
🔍 Attack Surface Scan Comparison
Attack Surface Management (ASM) scans focus on mapping your organization's external footprint rather than deep application code analysis:
| Capability / Dimension | Attack Surface Exhaustive Scan | Attack Surface KEV Scan | In-Depth Asset Scans (Web/Mobile/Network) |
|---|---|---|---|
| Objective | Continuous discovery and mapping of all external-facing assets | Prioritized detection of actively exploited vulnerabilities | Comprehensive vulnerability assessment of a specific target |
| Scope | Broad organization domain, subdomains, certificates, public mobile apps | Discovered organization assets matched against CISA KEV catalog | Deep inspection of an individual asset (app, binary, URL, IP) |
| Discovery Sources | Certificate Transparency, DNS records, public cloud buckets, app stores | Automated feeds from CISA KEV, threat intelligence | User-provided repository, binary, URL, or IP address |
| Depth of Testing | Lightweight non-intrusive service fingerprinting and exposure detection | Rapid vulnerability checking targeting known exploit signatures | Deep multi-turn fuzzing, SAST, DAST, logic exploration, and chaining |
| Run Frequency | Continuous / Scheduled (daily, weekly) | Continuous / Automated on new KEV publication | Per-commit, per-build, or on-demand security audit |
| Intrusiveness | Safe, passive to low-impact external probes | Low-impact targeted checks | Active fuzzing and agentic pentesting exploration |
🎯 How to Choose the Right Scan
- For CI/CD and Pull Request Checks:
- Use Source Code Fast Scan or Mobile Fast Scan to receive actionable feedback in minutes with zero token overhead.
- For Scheduled Audits & Compliance:
- Use Full Web Scan or Full Mobile Scan to assess static, dynamic, and backend communication posture.
- For Organization-Wide Visibility & Shadow IT:
- Run Attack Surface Exhaustive Scan to continuously discover forgotten servers, rogue subdomains, and expired certificates.
- For Pre-Release Verification & High-Risk Applications:
- Deploy Web Deep Agentic Scan, Mobile Deep Agentic Scan, or Source Code Scan (Advanced/Elite) for autonomous business logic flaw discovery and exploit chaining.
- For Verifying Bug Fixes:
- Run Single Vulnerability Assessment directly from a reported ticket to confirm remediation without running a complete rescan.