Pwn2Own 2026 · Two flagships. Real proof.

The enterprise AI security platform

End-to-end mobile & API security.

One AI platform. From source code to proven risk and reviewed fixes.

Unify AI SAST, dynamic testing, coverage-guided fuzzing, and API backend testing. Automate fixes and pull requests through CI/CD, with an integrated Device Lab for testing and automation.

Book an enterprise demo Start free
  • Private cloud or on-premise · Your models · Your devices
  • ✓ 10 free AI SAST scans every month · No credit card

Built by

  • The same team who built Mobile Hacking Lab
  • Trainers at Black Hat
  • Winners of Pwn2Own TrendAI Zero Day Initiative

One platform. The complete security workflow.

Secure the app. And everything behind it.

Bring your mobile apps, native code, and API backends into one continuous security workflow. Give engineering teams the evidence to fix exploitable risks and the automation to test again with every release.

Source

AI SAST

Trace source, data flows, and connected attack paths across files.

Explore AI SAST →
Automation

Device Lab

Run E2E tests, your own AI agents, and the mobile products you build.

Explore Device Lab →

Deploy on your terms. Choose your models, connect your devices, and bring the platform into your private cloud or on-premise environment.

Find · Prove · Fix

AI SAST / Contextual analysis

A change lands. Djini goes deep.

Follow untrusted input across files, frameworks, and trust boundaries. Find the connected attack path hidden between individually innocent lines.

  • Reason across files and functions
  • Connect application logic and data flows
  • Surface advanced, exploitable weaknesses
A critical finding traced across source files, with its CWE, OWASP and MASVS mapping

Djini Mobile / Exploit validation

From a finding to “here's how.”

Move from a possible weakness to demonstrated impact. Djini chains the path, runs it on a device, and captures the evidence your team needs.

  • Android and iOS runtime testing
  • Business logic, native code, and APIs
  • Reproducible proof of exploitation
The Djini agentic console reproducing a finding on a connected Android test device

Auto PR / Continuous security

Close the loop. Ship the fix.

Turn findings into code fixes and pull requests. Trigger the workflow through CI/CD, review the proposed change, and retest the original attack path before merging.

  • Start from your CI/CD pipeline
  • Propose contextual code fixes
  • Keep review and merge in your hands
The AI SAST terminal: a completed scan with findings per MASVS category

Inside Djini. The actual product.

The finding. The code. The device. All in one investigation.

From source code or a compiled app to an actionable workspace. Explore the exact finding, inspect its context, and move straight into the device console.

  • 8 MASVS categories
  • Cross-file attack chains
  • JSON + SARIF output
  • CI/CD security gates

Read the AI SAST walkthrough →

Djini AI SAST findings for the InsecureShop training app, ranked by severity with their CWE mapping
The Djini security overview: upload an app binary or source code, and findings by severity

Djini Mobile + end-to-end testing

Your users have a journey. So does an attacker.

Let Djini interact with your app: navigate screens, follow authentication flows, exercise APIs, and explore the paths a checklist misses. Bring security testing and end-to-end validation into the same workflow, with the devices to run both.

  1. Sign in

    Authentication & session boundaries

  2. Explore the app

    Screens, deep links & business logic

  3. Challenge the assumptions

    Unexpected states. Connected weaknesses.

  4. Prove. Fix. Retest.

    Evidence your developers can act on

The Device Lab. Included.

Every device. One command center.

An integrated fleet for security testing, E2E QA, and the automation you build. Use virtual iOS and Android devices or supported physical hardware, with screen, shell, file, and API access for your agents and products.

  • Virtual devices
  • Real hardware
  • API access
  • Agentic console
  • Your automation
The Djini agentic console driving a connected Android test device

Drive a connected device from the agentic console: screen, shell, and app.

The Djini console confirming an exploit on a connected device, with the evidence files it created

Confirm the exploit on the device, and keep the evidence it leaves behind.

Build on the Device Lab

Your pipeline. Your agents. Your next product.

Use virtual devices as the execution layer for testing and automation, without maintaining your own device rack.

Security team

For your security team

Test and validate in the same environment.

Developers

For your developers

Use shells, file access and repeatable mobile test flows.

Builders

For your next idea

Generate API keys for your own agents, tools and services.

BYOD + BYOK

Your devices. Your model. Your call.

Use the included Device Lab or connect your own hardware. Choose the AI provider that fits your team, your infrastructure, and your budget.

Djini.ai

Bring your own device

Make your hardware part of the team.

Pair supported Android or iOS devices with DjiniConnect, or add physical hardware to your Device Lab. Keep your own devices in the same testing workflow.

  1. Open DjiniConnect
  2. Pair securely
  3. Start testing

Bring your own model

Power Djini with your preferred LLM.

Configure OpenRouter, a cloud provider, or a local model through Djini's OpenAI-compatible provider setting for AI SAST.

  1. OpenRouter
  2. Cloud provider
  3. Local model

AI SAST requires BYOK. Your provider bills model usage separately from your Djini subscription.

Coming next — planned capabilities, separate from what's available today.

  • Company context
  • Requirement testing
  • Agentic threat modeling
  • Research & learning loops

Built by researchers. Proven in the arena.

Pwn2Own Ireland · October 2026

The people behind Djini break boundaries.

At Pwn2Own Ireland 2026, researchers used Djini.ai in successful demonstrations against two flagship phones. ZDI named Djini in the official results.

Research by Dimitrios Valsamaras, Ken Gannon of Mobile Hacking Lab, and Tenia Valsamara of CENSUS Labs. Photo and result reporting: TrendAI Zero Day Initiative. Awards recognise the researchers' demonstrated results.

TrendAI Zero Day Initiative's post crediting Dimitrios Valsamaras, Ken Gannon using Djini.ai, and Tenia Valsamara for exploiting the Samsung Galaxy S26 at Pwn2Own
Djini.ai, in ZDI's own words.

Level up the humans, too.

A smarter agent. A stronger researcher.

Combine Djini with Mobile Hacking Lab Academy training. Develop your AppSec foundation, earn practical certifications, or go deeper into userland fuzzing and exploitation.

01

AppSec bundle / Academy + exams

CAPT · Android Pentester, CIPT · iOS Pentester

02

Included with yearly AppSec

Advanced Android Hacking + CAAH certification exam

03

Research bundle / choose one course

Android or iOS Userland Fuzzing & Exploitation

04

Enterprise

The full Mobile Hacking Lab Academy

Save 20% with yearly AppSec or Research. Yearly AppSec also includes Advanced Android Hacking + the CAAH exam. Enterprise opens the full academy.

Put the intelligence to work

Where will you take Djini?

Hunt mobile bugs, pentest each release, bring security into your pull requests, and automate devices. Find the workflow for your research or your team.

Djini.ai
Ship secure appsProduct & engineering teams
Research & bountyResearchers & disclosure teams
Run it at scaleEnterprise & security leaders

Explore all use cases →

Your industry. Your attack surface.

Different worlds. The same need for proof.

From banking releases to CERT investigations and government research. See how teams use Djini to run security reviews, automate devices, and move findings into fixes.

From the lab

The research. Behind the intelligence.

Research · Pwn2Own Ireland 2026: Two Phones, Two Successful Exploits, and Third Place Last week, I traveled to Ireland to compete in Pwn2Own Ireland 2026. I teamed up with Dimitrios and Tenia Valsamara to form Team ZyGoat. Keeping with … Ken Gannon Product Guides · Free Djini AI SAST: Now Fixes What It Finds Our AI source-code scanner now brings the next step into GitHub: automated fixes, issues and pull requests. Connect your Android or iOS repository, … Arno Miedema Product Guides · Djini AI SAST: A Free AI Scanner for Mobile App Source Code Meet Djini AI SAST: free source-code scanning for Android and iOS, with setup instructions, BYOK configuration, API examples, and CI/CD integration. Ken Gannon

All articles →

Expertise, delivered

Your next goal. Our team behind it.

Bring in our experts for a managed mobile pentest or a model built around your organisation's security knowledge.

ON-DEMAND SECURITY TESTING

Managed mobile pentesting

Book a scoped assessment of your Android or iOS app and its API backend. Mobile Hacking Lab runs the engagement using Djini, verifies the findings, and gives your team evidence it can act on.

MODEL FINE-TUNING SERVICES

Custom local model fine-tuning

Turn your organisation’s internal reports, research, and methodologies into a local model that carries your team’s DNA. We help create the dataset and fine-tune a suitable base model of your choice around your collective knowledge.

Start curious. Go deeper.

Your next finding starts for free.

From your first scan to an enterprise security program. Choose how far you want to go.

Meet Djini

Free

€0 / month

Put your first app to the test.

  • 10 AI SAST scans per month
  • 1 blackbox AI SAST + dynamic scan (welcome credit)
  • Bring your own model key
  • No credit card required
Start free

Build securely

AppSec

€150 / month
€1,440 €1,800 / year

Everyday mobile security testing.

  • 10 monthly app scans
  • Android & iOS AppSec
  • AI agentic chats
  • €100 AI budget / month
  • MHL Academy AppSec training
  • CAPT & CIPT certification exams
  • Yearly AppSec also includes Advanced Android Hacking + the CAAH exam
Buy now Buy now Free trial Free trial

Your perimeter

Enterprise

Built around your team

Your infrastructure. Your control.

  • Private & on-premises deployment
  • CI/CD integration
  • Team & user management
  • Custom private AI models
  • Full MHL Academy access
Build your plan

AI SAST requires BYOK; model usage is billed separately by your provider. The blackbox welcome scan is a one-time new-account credit. Device Lab capacity and usage depend on your plan.

Your next release deserves a Djini.

Don't just take our word. Give it a task.

Every great investigation starts with a question. What's yours?

Local demo · nothing is sent. Your real workspace runs at app.djini.ai.

✓ Free account. 10 AI SAST scans / month. Your first step starts here.