O360 B.V.

O360 B.V., which markets its products under the Offensive360 brand, is a Dutch application security software company. It builds an enterprise-grade application security and risk management platform that spans source code security (SAST), dynamic testing of running applications and APIs (DAST), mobile application security testing (MAST), external attack surface management (ASM), AI-assisted pentesting, red teaming and governance, risk and compliance (GRC). The company positions itself as an alternative to conventional application security testing vendors, emphasizing accuracy over noise, deployment inside the customer's own infrastructure, and the absence of per-developer or per-seat pricing. According to its own account, Offensive360 was founded by offensive security professionals who tested enterprise applications for a living and became frustrated with the tools available to them — tools they considered too expensive, too prone to false positives, and lacking an air-gapped deployment option. They set out to build what they wished existed: an enterprise-grade SAST and DAST platform that deploys on-premise, finds real vulnerabilities, and does not charge per developer. The company states that it built its own scanning engines rather than relying on third-party engines, and that on-premise deployment is treated as a first-class feature rather than an afterthought, aimed at regulated industries and governments. The Offensive360 platform is organized around discrete capabilities that customers can adopt according to the risk they need to address. SAST secures shipped source code using data-flow analysis and remediation guidance, with integrations into repositories, IDEs and CI/CD pipelines. DAST tests running web applications and APIs, letting teams investigate request and response evidence and prioritize findings. MAST analyzes Android and iOS application packages for secrets, insecure storage and platform weaknesses. ASM continuously discovers and monitors internet-facing assets — domains, subdomains, hosts, open ports, services, certificates and leaked credentials — scoring each exposure by risk and watching for change on an hourly or daily cadence. An AI Pentester capability guides AI-assisted application security testing within an authorized scope, and the platform also covers red teaming and GRC. The company says the platform supports more than 60 languages, combines SAST, DAST, SCA, malware and license scanning in a single offering, is 100% air-gap and offline capable, and uses no third-party scan engines. Beyond software, Offensive360 offers expert-driven security assessment services. These include source code review, API security assessment against the OWASP API Security Top 10, SDLC, architecture, software composition analysis and binary reviews, and AI security assessments, delivered by specialists with line-level findings, severity ratings, OWASP Top 10 coverage and CWE/CVE mapping. The company states that assessments can be delivered fully offline for air-gapped environments. Offensive360 sells primarily to enterprises, including regulated industries and government organizations, and offers personalized demos and consultations. Its stated mission is to make enterprise-grade application security testing accessible to organizations of every size. The company is headquartered in the Netherlands and operates globally; it is privately held, and no parent company or stock listing is indicated in the available evidence.

Offensive360 was founded by offensive security professionals who tested enterprise applications for a living. According to the company's own account, they grew frustrated with the application security tools available to them: the tools were too expensive, produced too many false positives, and offered no air-gapped deployment option. They decided to build what they wished existed — an enterprise-grade SAST and DAST platform that deploys on-premise, finds real vulnerabilities, and does not charge per developer. From that starting point the company developed its own scanning engines rather than relying on third-party engines, and treated on-premise deployment as a first-class feature rather than an afterthought, explicitly aiming at regulated industries and governments that need to keep code and testing inside their own infrastructure. The platform grew from source code security (SAST) and dynamic testing (DAST) into a broader set of capabilities: mobile application security testing (MAST), external attack surface management (ASM), AI-assisted pentesting, red teaming and governance, risk and compliance (GRC). The company describes the platform as a 5-in-1 offering combining SAST, DAST, SCA, malware and license scanning, supporting more than 60 languages and capable of running 100% air-gapped and offline. Alongside the software platform, Offensive360 built an expert services practice. Its services page describes seven service types spanning code, API, SDLC, architecture, SCA, binary and AI security, delivered by specialists and backed by remediation guidance, with OWASP Top 10 coverage across web, API, mobile and LLM categories and full offline capability for air-gapped assessments. The company is registered as O360 B.V. in the Netherlands and markets its products under the Offensive360 brand. It sells to enterprises and government organizations and offers personalized demos and consultations. It is privately held; the available evidence does not indicate any parent company, outside investment or stock listing. Its stated mission is to make enterprise-grade application security testing accessible to organizations of every size, and its stated differentiators are accuracy over noise, security without compromise through on-premise deployment, developer experience, and the absence of per-seat pricing.

• Offensive360 founded by offensive security professionals to build an on-premise, air-gap-capable SAST and DAST platform.

• Platform expanded beyond SAST and DAST to include MAST, ASM, AI Pentester, red teaming and GRC.

• Expert-driven security assessment services introduced, covering code, API, SDLC, architecture, SCA, binary and AI security.

Enterprise-grade application security testing made accessible: on-premise and air-gap capable, accurate over noisy, no per-developer pricing, self-built scan engines.

• Offensive360 SAST

  Static application security testing that finds source code vulnerabilities with data-flow analysis and remediation guidance, integrated with repositories, IDEs and CI/CD.

• Offensive360 DAST

  Dynamic testing of running web applications and APIs, with request and response evidence and prioritized findings.

• Offensive360 MAST

  Mobile application security testing that analyzes Android and iOS packages for secrets, insecure storage and platform weaknesses.

• Offensive360 ASM

  Attack surface management that continuously discovers and monitors internet-facing assets, exposures and breached credentials, scoring each by risk.

• Offensive360 AI Pentester

  AI-assisted application security testing guided within an authorized scope, with evidence review.

• Offensive360 security assessment services

  Expert-driven assessments including source code review, API security assessment, SDLC, architecture, SCA, binary and AI security reviews.

1. 1Offensive360 | Application Security & GRC Platformoffensive360.com
2. 2About Us — Built by Security Researchers | Offensive360offensive360.com
3. 3AI & Application Security Services | Offensive360offensive360.com
4. 4Attack Surface Management (ASM) | Offensive360offensive360.com
5. 5O360 B.V. — Wikidatawikidata.org