# Borg

> Borg is autonomous application security: continuous pentesting that chains vulnerabilities and tests business logic the way a real attacker would, then pushes confirmed findings straight into Linear, Jira, and GitHub. Odin is the platform; Mjolnir is the autonomous pentest engine, Huginn continuous asset discovery, and Gungnir continuous red teaming.

## Product

- [Platform](https://www.borghq.io/platform): How Odin, Mjolnir, Huginn, and Gungnir discover assets, find vulnerabilities, and confirm them.
- [Enterprise](https://www.borghq.io/enterprise): Odin's modular approach, the embedded research service, deployment and scale.

## Company

- [About](https://www.borghq.io/about): Who Borg is and how the company got here.
- [Contact](https://www.borghq.io/contact): Get in touch or book a demo.
- [Privacy Policy](https://www.borghq.io/privacy): How Borg handles data.

## Blog

- [Blog index](https://www.borghq.io/blog): All articles.
- [Security Testing Every Release Without a Manual Bottleneck](https://www.borghq.io/blog/security-testing-every-release-without-a-manual-bottleneck): Security review is often the last release step that waits on a person. What can run per merge, what still needs a human, and how the two split.
- [Two Years of Continuous Security with Banana Gun](https://www.borghq.io/blog/banana-gun-continuous-security): How Borg has worked alongside Banana Gun for more than two years, providing continuous offensive security as its infrastructure evolved.
- [How Automatic Retests Verify a Fix When Your PR Merges](https://www.borghq.io/blog/how-automatic-retests-verify-a-fix-when-your-pr-merges): Link a pull request to a security finding and the merge triggers verification. How the linking works, what the review reads, the outcomes, and where it stops.
- [How to Continuously Map Your External Attack Surface](https://www.borghq.io/blog/how-to-continuously-map-your-external-attack-surface): Mapping an external attack surface continuously: what counts as an asset, the discovery techniques and why they run on different clocks, and where it stops.
- [Autonomous Pentesting vs Vulnerability Scanning: What Each Finds](https://www.borghq.io/blog/autonomous-pentesting-vs-vulnerability-scanning-what-each-finds): Autonomous pentesting and vulnerability scanning answer different questions. What each one reaches, where each stops, and when to reach for which.
- [SAST and Business Logic Vulnerabilities: What Static Analysis Can Reach](https://www.borghq.io/blog/sast-and-business-logic-vulnerabilities-what-static-analysis-can-reach): Static analysis and business logic are a poor fit by construction. What SAST covers well, what the published accuracy research shows, and what covers the rest.
- [Bug Bounty Alternatives: What AI Security Testing Replaces, and What It Doesn't](https://www.borghq.io/blog/bug-bounty-alternatives-what-ai-security-testing-replaces-and-what-it-doesn-t): Bug bounty alternatives compared for engineering teams: what continuous AI offensive testing genuinely replaces, and where a bounty is still the right instrument.
- [Full Pentest vs PR Security Review: What Each One Actually Answers](https://www.borghq.io/blog/full-pentest-vs-pr-security-review-what-each-one-actually-answers): A full pentest and a PR security review answer different questions. Here is what each one covers, what neither sees, and why you need both.
- [What Is Code-Aware Application Security Testing?](https://www.borghq.io/blog/what-is-code-aware-application-security-testing): Code-aware application security testing uses repository context to drive targeted offensive attacks, finding auth and logic bugs that traditional scanners miss.
- [How to Test Business Logic Vulnerabilities in a SaaS Application](https://www.borghq.io/blog/how-to-test-business-logic-vulnerabilities-in-a-saas-application): Learn how to test business logic vulnerabilities in SaaS using a 5 step offensive methodology. Surface auth, billing, and isolation bugs that scanners miss.
- [What Is Continuous Pentesting? A Definition for Engineering Teams](https://www.borghq.io/blog/what-is-continuous-pentesting-a-definition-for-engineering-teams): What is continuous pentesting? Learn how this offensive security practice replaces annual audits with real-time testing for auth flows, APIs, and business logic.
- [XBOW Alternatives: Comparing Autonomous AI Pentesting Platforms](https://www.borghq.io/blog/xbow-alternatives-comparing-autonomous-ai-pentesting-platforms): XBOW alternatives compared on code context, pull request review, proof of exploitation and pricing: Borg, Hacktron, MindFort, RunSybil, Escape and Aikido.
- [Why we dropped "Security" from our name](https://www.borghq.io/blog/why-we-dropped-security-from-our-name): The story of how bug bounties in a living room turned into Borg, and why everything we've built now lives under one name.
- [Your scanner didn't find it. Mjolnir did.](https://www.borghq.io/blog/your-scanner-didnt-find-it-mjolnir-did): Scanners match known patterns. Mjolnir reads your code, tests the auth and business logic behind it, and returns findings with a working proof of concept.
- [What startups get wrong about Application Security](https://www.borghq.io/blog/what-startups-get-wrong-about-application-security): Most startups treat security as a compliance checkbox. Here's why that approach fails and what a practical appsec strategy actually looks like when you're shipping fast.
- [How Borg pushes findings to Linear, Jira, and GitHub automatically](https://www.borghq.io/blog/how-borg-pushes-findings-to-linear-jira-github): Pentest findings only get fixed once they are tickets. How to connect Linear, Jira or GitHub to Odin, set auto-ticketing, and verify the fix afterwards.
- [Your Vulnerabilities exist right now. Odin finds them first.](https://www.borghq.io/blog/your-vulnerabilities-exist-right-now-odin-finds-them-first): Your attack surface changes with every deployment. Odin provides continuous discovery, automated testing, and daily reporting so nothing slips through the cracks.