# Offensive360

> Offensive360 is the application security and risk management brand of O360 B.V. It provides SAST, DAST, MAST, attack surface management, software supply chain security, an authorization-gated AI Pentester, autonomous red teaming and early-access GRC. Deployment options include cloud, on-premise OVA, Azure VHD and air-gapped.

## Company

- Legal entity: O360 B.V., trading as Offensive360. Based in Amsterdam, the Netherlands. Founded 2017.
- Certification: ISO/IEC 27001 certified. Certificate and current scope are available to customers and prospects under NDA.
- Public attribution: The Offensive360 Team. Media and general contact: info@offensive360.com.
- O360 AI is Offensive360's AI layer. It supports AI-assisted triage, the AI Pentester and autonomous red teaming. The underlying provider is not disclosed.
- Brand naming: Offensive360 (one word) is the brand; O360 B.V. is the legal entity. Product names are SAST, DAST, MAST, ASM, AI Pentester, Autonomous Red Teaming, Software Supply Chain Security and GRC.

## Products

- [SAST — Static Application Security Testing](https://offensive360.com/products/sast/): Source code analysis for supported languages, with finding evidence and remediation guidance. CI and IDE integrations include a SARIF GitHub Action and an MCP server for AI coding assistants. Cloud, on-premise OVA, Azure VHD or air-gapped; annual licence quoted per scope.
- [DAST — Dynamic Application Security Testing](https://offensive360.com/products/dast/): Tests running web applications, REST and GraphQL APIs, single-page apps and LLM applications with more than 40 active checks and 19 passive analyzers. Supports authenticated scanning and reports request/response evidence.
- [MAST — Mobile Application Security Testing](https://offensive360.com/products/mast/): Analyses Android APK/AAB and iOS IPA binaries without source code, maps findings to the OWASP Mobile Top 10 (2024) and reports hardcoded secrets, insecure storage, weak cryptography and platform weaknesses.
- [ASM — Attack Surface Management](https://offensive360.com/products/asm/): Continuously discovers domains, subdomains, hosts, ports, services and TLS posture, and monitors leaked credentials. Scheduled monitors alert on change. On-premise and air-gapped.
- [AI Pentester](https://offensive360.com/products/ai-pentester/): Runs PTES-methodology penetration-testing engagements gated by a signed in-product authorization record, with human approval before exploitation, a visible kill switch and denial-of-service techniques force-disabled. On-premise and air-gapped.
- [Autonomous Red Teaming](https://offensive360.com/products/autonomous-red-teaming/): Continuous adversary emulation that plans attack paths inside an enforced scope guard, validates exploitability with non-destructive proof-of-exploit, and can run its AI reasoning offline. On-premise and air-gapped.
- [GRC — Governance, Risk and Compliance](https://offensive360.com/products/grc/): Early-access platform for compliance, risk, policies, evidence, audits, incidents and vendor risk, with Arabic and English workflows and NCA ECC-2:2024, SAMA CSF, PDPL, NCA CCC and ISO/IEC 27001 packs. Runs on customer infrastructure or hosted in the EU; quote-based.
- [Container image, SBOM and Kubernetes manifest scanning](https://offensive360.com/products/container-security/): Cloud-demo assessment of uploaded Docker/OCI archives, CycloneDX or SPDX SBOMs and Kubernetes resource manifests. It does not connect to a live cluster or execute uploaded images.
- [Software Supply Chain Security](https://offensive360.com/software-supply-chain-security/): A workflow for dependency inventory, advisory review, remediation and retesting across source manifests, SBOMs, image archives and deployment manifests. Coverage and advisory freshness are confirmed per configuration.

## Services

- [Source Code Review](https://offensive360.com/services/#source-code-review): Automated scanning plus expert review, with line-level findings and OWASP/CWE mapping.
- [API Security Assessment](https://offensive360.com/services/#api-security): REST, GraphQL and SOAP testing against the OWASP API Security Top 10.
- [Secure SDLC Enablement](https://offensive360.com/services/#secure-sdlc): Maturity assessment, threat-modeling workshops, secure coding standards and CI/CD gates.
- [Application Architecture Review](https://offensive360.com/services/#architecture-review): Trust boundaries, data flows and privilege paths, with a threat model.
- [Software Composition Analysis](https://offensive360.com/services/#sca): Dependency inventory, CVE findings and licence obligations.
- [Malware and Binary Analysis](https://offensive360.com/services/#malware-binary): Static and dynamic analysis of compiled binaries and packages.
- [Post-Quantum Cryptography Readiness](https://offensive360.com/services/#pqc-readiness): Live cryptographic inventory, CycloneDX CBOM and a phased migration roadmap.
- [Manual Penetration Testing and Red Teaming](https://offensive360.com/services/#penetration-testing): Practitioner-led testing with validated findings and a retest.
- [Stress Testing](https://offensive360.com/services/#stress-testing): Load and resilience testing against agreed service levels.
- [Threat Modeling](https://offensive360.com/services/#threat-modeling): STRIDE and attack-tree workshops with security requirements.
- [Infrastructure Security Assessment](https://offensive360.com/services/#infrastructure-assessment): Control-by-control hardening review against CIS, vendor guides or DISA STIGs.
- [AI Cybersecurity Services](https://offensive360.com/services/#ai-security): LLM penetration testing, AI-generated code review and EU AI Act readiness.

## Pricing

- [Pricing](https://offensive360.com/pricing/): Annual licence quoted for the products, scanning scope, deployment and support selected. No per-developer seat fee. Every evaluation starts with a free 30-minute demo.
- [Free SAST for open source](https://offensive360.com/free-for-open-source/): Eligible public repositories receive a renewable 30-day scan token and SARIF output for CI.
- [ROI calculator](https://offensive360.com/roi-calculator/): Estimates time and incident savings from automated testing.

## Deployment and operations

- [Deployment options](https://offensive360.com/deployment/): Cloud, on-premise OVA, Azure VHD and air-gapped; confirm product availability and offline update arrangements during evaluation.
- [Platform overview](https://offensive360.com/platform/): One platform for SAST, DAST, MAST, ASM, AI Pentester, Autonomous Red Teaming and GRC.
- [Integrations](https://offensive360.com/integrations/): GitHub Actions, GitLab CI/CD, Bitbucket, Azure DevOps, Jenkins, CircleCI, IDEs and a REST API.
- [Trust and security](https://offensive360.com/security/): Security controls, data handling, ISO/IEC 27001 certification and vulnerability disclosure.
- [Compliance mapping](https://offensive360.com/compliance/): OWASP, PCI DSS, SOC 2, ISO 27001, HIPAA, NIST 800-53 and GDPR mapping.
- [GRC for Saudi Arabia](https://offensive360.com/grc/saudi-arabia/): NCA ECC-2, SAMA CSF and PDPL in English; Arabic mirror at /ar/grc/.

## Solutions

- [Government and defence](https://offensive360.com/solutions/government/): Air-gapped deployment and data-sovereignty options for public-sector teams.
- [Financial services](https://offensive360.com/solutions/financial-services/): Source, application and supply-chain testing for banks and payment providers.
- [Healthcare](https://offensive360.com/solutions/healthcare/): Application security for patient-facing and clinical systems.

## Research and learning

- [Security blog](https://offensive360.com/blog/): Technical guides and vulnerability research.
- [Vulnerability knowledge base](https://offensive360.com/knowledge-base/): 31 entries with detection and remediation guidance.
- [Security research and CVEs](https://offensive360.com/zerodays/): Advisory analysis of disclosed vulnerabilities.
- [Secure coding academy](https://offensive360.com/academy/): 79 lessons and exercises.
- [AppSec glossary](https://offensive360.com/glossary/): Definitions of application security terms.
- [Product comparisons](https://offensive360.com/compare/): Ten side-by-side comparisons, including Checkmarx, Veracode, Fortify, SonarQube, Snyk and Semgrep.
- [Security headers checker](https://offensive360.com/tools/security-headers/): Free response-header grading tool.
- [Resource library](https://offensive360.com/resources/): Evaluation guide, tools and reference material.
- [RSS feed](https://offensive360.com/rss.xml): Blog and vulnerability-research feed.

## Arabic (العربية)

- [Arabic home](https://offensive360.com/ar/): The platform, dashboards and reports are available in Arabic with right-to-left layouts.
- [Arabic product pages](https://offensive360.com/ar/products/): SAST, DAST, MAST, ASM, AI Pentester, Autonomous Red Teaming, GRC and container security.
- [Arabic GRC](https://offensive360.com/ar/grc/) and [Arabic compliance](https://offensive360.com/ar/compliance/): NCA ECC, SAMA CSF and regional framework coverage.

## Contact and reference files

- Sales and general enquiries: info@offensive360.com
- [Contact page](https://offensive360.com/contact/)
- [Book a demo](https://offensive360.com/demo/): Free 30-minute personalised walkthrough.
- [Press kit and company facts](https://offensive360.com/press/)
- [Company profile (Markdown)](https://offensive360.com/resources/offensive360-company-profile.md)
- [Vulnerability disclosure](https://offensive360.com/.well-known/security.txt)
- [Extended reference](https://offensive360.com/llms-full.txt)
- [Sitemap](https://offensive360.com/sitemap-index.xml)

## Optional

- [GitHub](https://github.com/offensive360)
- [LinkedIn](https://www.linkedin.com/company/offensive360/)
- [G2 reviews](https://www.g2.com/products/offensive360/reviews)
- [Gartner Peer Insights](https://www.gartner.com/reviews/market/application-security-testing/vendor/offensive-360/product/offensive-360)
- [Crunchbase](https://www.crunchbase.com/organization/offensive-360)