1010.cx

  • Top 10 Best API Penetration Testing Companies In 2025

    ·

    ,

    API penetration testing has evolved dramatically in 2025. While traditional, human-led penetration testing remains critical, the scale and complexity of modern APIs have necessitated a new approach.

    The companies on this list are not just offering one-time testing services; they provide automated, continuous, and intelligent API security platforms that perform dynamic testing, behavioral analysis, and real-time protection, effectively acting as an automated penetration test that runs 24/7.

    These platforms are designed to “shift security left” into the development pipeline and protect APIs in production.

    Why We Choose These Companies

    The rise of a “platform-first” approach to API security is a response to the limitations of traditional testing. The sheer volume and frequent updates of APIs mean that a yearly or quarterly human-led test is no longer sufficient.

    The top companies in this space for 2025 have embraced automation, machine learning, and continuous discovery to provide security that keeps pace with development.

    They blend proactive testing (like DAST) with runtime protection (like WAF and behavioral analysis) to provide a comprehensive security posture.

    How We Choose It

    Our selection is based on the following criteria:

    API-Specific Expertise: A deep focus on the unique risks of APIs, such as broken object-level authorization (BOLA) and business logic abuse, as outlined in the OWASP API Security Top 10.

    Automation & Continuous Testing: The ability to automatically discover APIs and continuously test them for vulnerabilities without manual intervention.

    Runtime Protection: The integration of real-time monitoring and protection against live attacks.

    “Shift-Left” Capabilities: Tools that integrate with development workflows to find and fix issues before they reach production.

    Market Leadership & Trust: Recognition from industry analysts and a proven track record with enterprise clients.

    Comparison Of Key Features (2025)

    CompanyAutomated DiscoveryDAST CapabilitiesRuntime ProtectionShift-Left Integration
    Salt Security✅ Yes✅ Yes✅ Yes✅ Yes
    Noname Security✅ Yes✅ Yes✅ Yes✅ Yes
    Traceable✅ Yes✅ Yes✅ Yes✅ Yes
    Cequence Security✅ Yes✅ Yes✅ Yes✅ Yes
    42Crunch✅ Yes✅ Yes✅ Yes✅ Yes
    Wallarm✅ Yes✅ Yes✅ Yes✅ Yes
    APIsec✅ Yes✅ Yes✅ Yes✅ Yes
    Invicti (Netsparker)✅ Yes✅ Yes❌ No✅ Yes
    F5 (WAAP)✅ Yes✅ Yes✅ Yes✅ Yes
    Imperva✅ Yes✅ Yes✅ Yes❌ No

    1. Salt Security

    API penetration testing

    Salt Security is a market leader known for its agentless, AI-powered API security platform. The company specializes in continuously discovering APIs and using machine learning to create a baseline of normal behavior.

    By detecting deviations from this baseline, the platform can identify complex vulnerabilities, including business logic flaws, that traditional tools miss.

    Salt’s platform provides deep, contextual insights that effectively act as a continuous, automated penetration test.

    Why You Want to Buy It:

    Salt’s behavioral analysis is its key differentiator. It’s designed to find and block sophisticated attacks that bypass standard security controls, giving security teams a proactive defense against even the most subtle threats.

    FeatureYes/NoSpecification
    Automated Discovery✅ YesDiscovers all APIs in real-time, including shadow APIs.
    DAST Capabilities✅ YesProbes and tests for vulnerabilities in live traffic.
    Runtime Protection✅ YesBlocks malicious activity and business logic attacks.
    Shift-Left Integration✅ YesIdentifies and remediates issues in pre-production.

    Best For: Large enterprises that need a powerful, automated, and context-aware solution to protect a high volume of complex APIs.

    Try Salt Security here → Salt Security Official Website

    2. Noname Security

    API penetration testing

    Noname Security offers a comprehensive API security platform that combines discovery, posture management, runtime protection, and API security testing.

    Their platform provides a single-pane-of-glass view of the entire API attack surface.

    A core strength is its proactive vulnerability detection, which uses AI to analyze API traffic and discover flaws before they can be exploited.

    This makes it a powerful tool for continuous, automated penetration testing.

    Why You Want to Buy It:

    Noname’s platform is highly versatile, providing both in-depth testing and robust runtime protection from a single dashboard.

    Its “active testing” capability allows security teams to run automated tests that simulate attacker reconnaissance, making it a strong choice for proactive security.

    FeatureYes/NoSpecification
    Automated Discovery✅ YesProvides a comprehensive API inventory.
    DAST Capabilities✅ YesOffers active testing for pre-production environments.
    Runtime Protection✅ YesUses behavioral analytics to block real-time threats.
    Shift-Left Integration✅ YesIntegrates with CI/CD pipelines to find flaws early.

    Best For: Organizations that need a full-lifecycle API security platform that seamlessly integrates with their existing security and DevOps tools.

    Try Noname Security here → Noname Security Official Website

    3. Traceable

    API security testing

    Traceable is an API security platform that uses distributed tracing to provide unparalleled visibility into API behavior and data flow.

    By analyzing every API transaction, Traceable builds a deep, contextual understanding of each API, which allows it to detect and block complex threats like business logic abuse and data exfiltration.

    Its platform is designed to help security teams prioritize the most critical risks and perform automated testing.

    Why You Want to Buy It:

    Traceable’s unique use of distributed tracing gives it a significant advantage in understanding the flow of data across an application.

    This allows it to discover and protect sensitive data in transit and to identify threats that span multiple API calls.

    FeatureYes/NoSpecification
    Automated Discovery✅ YesProvides continuous discovery of all APIs.
    DAST Capabilities✅ YesOffers context-based API security testing.
    Runtime Protection✅ YesDetects and blocks business logic flaws in real-time.
    Shift-Left Integration✅ YesIntegrates with DevOps and API gateways.

    Best For: Enterprises with complex, multi-service architectures that need deep visibility and context-aware security to protect their APIs.

    Try Traceable here → Traceable AI Official Website

    4. Cequence Security

    API security testing

    Cequence Security offers a unified API Protection platform that combines discovery, risk assessment, and runtime protection.

    Its key innovation is its “Intelligent Mode” which uses AI to create autonomous security test plans from OpenAPI specifications.

    The platform’s ability to find coding errors, misconfigurations, and vulnerabilities in both pre-production and runtime environments makes it a highly effective tool for continuous penetration testing.

    Why You Want to Buy It:

    Cequence’s platform is a powerful blend of discovery, testing, and protection.

    Its unique ability to auto-generate security test plans simplifies the security testing process, making it highly efficient for both development and security teams.

    FeatureYes/NoSpecification
    Automated Discovery✅ YesDiscovers and catalogs all APIs in the environment.
    DAST Capabilities✅ YesAutonomous test creation from OpenAPI specs.
    Runtime Protection✅ YesProvides real-time WAF and bot mitigation.
    Shift-Left Integration✅ YesIntegrates with CI/CD pipelines for early testing.

    Best For: Organizations that want to unify multiple API security tools into a single platform that can protect against bots, fraud, and API-specific attacks.

    Try Cequence Security here → Cequence Security Official Website

    5. 42Crunch

    automated API penetration testing

    42Crunch is a developer-centric API security platform that emphasizes a “shift-left” approach.

    It is built to integrate directly into the development workflow, enabling developers to find and fix vulnerabilities in OpenAPI specifications and code as they are being written.

    The platform uses a combination of static analysis (API Audit) and dynamic testing (API Scan) to validate API security from the earliest stages of the software development lifecycle.

    Why You Want to Buy It:

    42Crunch’s focus on the API contract is a unique and powerful way to prevent vulnerabilities.

    By enforcing security best practices at the design stage, it significantly reduces the number of issues that make it to production.

    FeatureYes/NoSpecification
    Automated Discovery✅ YesScans repositories for OpenAPI definitions.
    DAST Capabilities✅ YesOffers dynamic, live API scanning with rich context.
    Runtime Protection✅ YesCan be used with gateways for runtime protection.
    Shift-Left Integration✅ YesDeep integration with IDEs and CI/CD tools.

    Best For: DevOps and DevSecOps teams that want to embed security into their CI/CD pipelines and empower developers to build secure APIs from the start.

    Try 42Crunch here → 42Crunch Official Website

    6. Wallarm

    automated API penetration testing

    Wallarm is an API security platform that provides full-stack protection from a single agent. It combines WAF, API security, and bot mitigation into a unified solution.

    Wallarm’s platform automatically discovers APIs, analyzes their behavior, and protects them from a wide range of attacks, including the OWASP API Security Top 10.

    Its active threat verification capabilities perform dynamic testing to confirm vulnerabilities and prioritize them for remediation.

    Why You Want to Buy It:

    Wallarm’s ability to combine WAF, bot, and API security into a single, unified platform simplifies security management.

    It’s a great choice for companies that want to streamline their security stack and gain comprehensive visibility and control.

    FeatureYes/NoSpecification
    Automated Discovery✅ YesContinuously maps and discovers APIs.
    DAST Capabilities✅ YesActively probes APIs to verify vulnerabilities.
    Runtime Protection✅ YesProvides real-time WAF, bot, and API protection.
    Shift-Left Integration✅ YesIntegrates with CI/CD for early testing.

    Best For: Organizations that need to consolidate multiple security tools into a single platform for web and API protection, with a strong focus on risk analysis and threat prevention.

    Try Wallarm here → Wallarm Official Website

    7. APIsec

    continuous API security, API vulnerability assessment

    APIsec offers an automated API penetration testing platform designed to run in CI/CD pipelines.

    It goes beyond simple scanning by using an “API Attacker” to automatically generate thousands of attack scenarios, including those for business logic flaws and OWASP API Top 10 vulnerabilities.

    Its “zero-touch” deployment model means it can run tests without requiring source code access, making it a highly efficient and scalable tool for developers and security teams alike.

    Why You Want to Buy It:

    APIsec’s core mission is to automate the work of a penetration tester.

    It is a powerful platform for companies that want to perform frequent and thorough security testing without relying on resource-intensive manual engagements.

    FeatureYes/NoSpecification
    Automated Discovery✅ YesCatalogs and maps API endpoints.
    DAST Capabilities✅ YesAutomatically generates and executes thousands of attack scenarios.
    Runtime Protection✅ YesProvides runtime protection against threats.
    Shift-Left Integration✅ YesDesigned for deep integration into CI/CD workflows.

    Best For: DevSecOps teams that need a tool for continuous, automated penetration testing of APIs as part of their CI/CD pipeline.

    Try APIsec here → APIsec Official Website

    8. Invicti

    continuous API security, API vulnerability assessment

    Invicti is a leader in Dynamic Application Security Testing (DAST) and has extended its proven technology to APIs.

    Its platform automatically crawls and tests APIs for vulnerabilities, with a key differentiator being its Proof-Based Scanning™, which automatically verifies detected vulnerabilities.

    This feature eliminates false positives and provides actionable reports that are ready for immediate remediation by developers.

    Why You Want to Buy It:

    Invicti’s proof-based scanning is a powerful feature that gives security teams high confidence in their findings.

    This allows them to automate vulnerability management and streamline communication with development teams, leading to faster remediation.

    FeatureYes/NoSpecification
    Automated Discovery✅ YesDiscovers and scans all APIs.
    DAST Capabilities✅ YesProof-Based Scanning™ for accurate vulnerability detection.
    Runtime Protection❌ NoPrimarily a testing platform, not for runtime protection.
    Shift-Left Integration✅ YesIntegrates with CI/CD and bug-tracking tools.

    Best For: Security teams that need a reliable, accurate, and scalable DAST platform for both web applications and APIs, with a focus on eliminating false positives.

    Try Invicti here → Invicti Official Website

    9. F5

    API security platform

    F5, a leader in application delivery and security, offers a comprehensive API security solution through its Distributed Cloud WAAP (Web Application and API Protection).

    This platform combines a next-gen WAF with API discovery, testing, and protection.

    F5’s solution is known for its ability to enforce a positive security model based on learned or imported API specifications, providing robust protection against both known and unknown threats.

    Why You Want to Buy It:

    F5’s WAAP solution provides a powerful combination of threat intelligence and a positive security model.

    It’s an excellent choice for organizations that want to consolidate their application and API security under a single, trusted vendor.

    FeatureYes/NoSpecification
    Automated Discovery✅ YesAutomatically discovers all APIs from code and traffic.
    DAST Capabilities✅ YesTargeted testing on discovered API endpoints.
    Runtime Protection✅ YesProvides a WAF and positive security model.
    Shift-Left Integration✅ YesIntegrates with code repositories for early discovery.

    Best For: Enterprises that need a unified platform for WAF and API security, leveraging F5’s global network and expertise in application delivery.

    Try F5 API Security here → F5 Official Website

    10. Imperva

    API security platform

    Imperva, a long-standing leader in application security, offers a robust API security solution that integrates with its cloud WAF and bot management platforms.

    Imperva API Security provides automatic discovery, classification, and continuous monitoring of APIs.

    By analyzing traffic and leveraging a vast threat intelligence database, it can detect and block a wide range of attacks, from OWASP Top 10 vulnerabilities to API-specific business logic abuse.

    Why You Want to Buy It:

    Imperva’s solution provides a mature and trusted layer of protection for APIs.

    Its integration with its core WAF and bot mitigation products simplifies security management and provides a unified view of application and API threats.

    FeatureYes/NoSpecification
    Automated Discovery✅ YesAutomatically discovers and catalogs all APIs.
    DAST Capabilities✅ YesScans and tests for vulnerabilities.
    Runtime Protection✅ YesProvides WAF and API-specific attack blocking.
    Shift-Left Integration❌ NoPrimarily focused on runtime protection.

    Best For: Large enterprises that already use Imperva for their WAF or application security and want to extend that protection to their API portfolio.

    Try Imperva API Security here → Imperva Official Website

    Conclusion

    In 2025, the best API “penetration testing” companies have moved beyond one-off, manual services to provide continuous, automated security platforms.

    The leaders on this list are those that effectively blend proactive testing with real-time runtime protection.

    For a powerful, AI-driven solution that provides deep behavioral analysis, Salt Security and Noname Security are the top choices.

    If your organization is focused on a “shift-left” approach and wants to empower developers, 42Crunch and APIsec are excellent platforms.

    Meanwhile, vendors like F5 and Imperva offer a unified approach that is ideal for companies that need to secure both web applications and APIs.

    Ultimately, the right solution depends on your existing security stack, development practices, and the scale of your API landscape.

    The post Top 10 Best API Penetration Testing Companies In 2025 appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Amazon Takes Down Russian APT29 Infrastructure Targeting Users

    ·

    , , ,

    Amazon’s cybersecurity team has successfully disrupted a sophisticated watering hole campaign orchestrated by APT29, a notorious hacking group linked to Russia’s Foreign Intelligence Service. The August 2025 operation represents the latest chapter in an ongoing cyber warfare battle between tech giants and state-sponsored threat actors seeking to infiltrate global networks and harvest sensitive credentials. APT29’s […]

    The post Amazon Takes Down Russian APT29 Infrastructure Targeting Users appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Citrix 0-Day Flaw Under Active Exploitation Since May

    ·

    , , ,

    Security researcher Kevin Beaumont has revealed alarming details about CVE-2025-6543, a critical Citrix NetScaler vulnerability that was actively exploited as a zero-day attack for months before the company issued patches. What Citrix initially downplayed as a simple “denial of service” vulnerability has proven to be a sophisticated remote code execution flaw that compromised government and […]

    The post Citrix 0-Day Flaw Under Active Exploitation Since May appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • QNAP Flaw Allows Attackers to Bypass Authentication

    ·

    , ,

    QNAP Systems has released security patches to address multiple vulnerabilities affecting QVR firmware in legacy VioStor Network Video Recorder (NVR) systems. The company disclosed two significant security flaws on August 29, 2025, urging users to update their systems immediately to prevent potential security breaches. The security advisory reveals two distinct vulnerabilities that could compromise the […]

    The post QNAP Flaw Allows Attackers to Bypass Authentication appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Google Warns 2.5B Gmail Users to Reset Passwords Following Salesforce Data Breach

    ·

    , ,

    Google has issued a broad security alert to its 2.5 billion Gmail users, advising them to enhance their account security in the wake of a data breach involving one of the company’s third-party Salesforce systems.

    The incident, which occurred in June 2025, has escalated concerns over sophisticated phishing campaigns targeting a massive user base.

    In June, a threat group identified as UNC6040, also known by its extortion brand ShinyHunters, successfully infiltrated a corporate Salesforce instance used by Google. This system stored contact information and sales notes for small and medium-sized businesses.

    According to Google’s analysis, the threat actor accessed and retrieved a limited set of data containing basic, largely public business information like company names and contact details.

    Google has emphasized that the breach did not compromise consumer products like Gmail or Google Drive and that no passwords or financial data were exposed.

    The attackers employed a social engineering tactic known as voice phishing, or “vishing,” to gain initial access. By impersonating IT support staff over the phone, they deceived an employee into granting them system privileges.

    This allowed the hackers to exfiltrate data before their access was discovered and terminated by Google’s security teams. ShinyHunters is a well-known group linked to recent breaches at other major companies, including Adidas, Cisco, and LVMH.

    While the stolen data itself is considered low-risk, security experts warn that it can be weaponized to create highly convincing phishing and vishing attacks.

    Attackers are leveraging the news of the breach to craft scams that appear legitimate, tricking users into revealing their login credentials or two-factor authentication (2FA) codes. The threat group is known for escalating its tactics by leaking data or using it for extortion to pressure victims.

    In response to the incident, Google promptly contained the breach, conducted an impact analysis, and began mitigation efforts.

    On August 5, the company publicly detailed the event and the activities of UNC6040. By August 8, Google confirmed it had completed sending email notifications to all parties directly affected by the breach.

    Given the heightened risk of follow-on attacks, Google is urging all Gmail users to remain vigilant and take proactive security measures. The company strongly recommends updating passwords, enabling two-factor authentication, and being wary of unsolicited emails or calls requesting personal information.

    Find this Story Interesting! Follow us on Google News, LinkedIn, and X to Get More Instant Updates.

    The post Google Warns 2.5B Gmail Users to Reset Passwords Following Salesforce Data Breach appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • WhatsApp Issues Emergency Update for Zero-Click Exploit Targeting iOS and macOS Devices

    ·

    WhatsApp has addressed a security vulnerability in its messaging apps for Apple iOS and macOS that it said may have been exploited in the wild in conjunction with a recently disclosed Apple flaw in targeted zero-day attacks. The vulnerability, CVE-2025-55177 (CVSS score: 8.0), relates to a case of insufficient authorization of linked device synchronization messages. Internal researchers on the

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • U.S. Government Seizes Online Marketplaces Used to Sell Fraudulent Identity Documents to Cybercriminals

    ·

    ,

    The U.S. Attorney’s Office for the District of New Mexico announced Thursday that federal authorities have executed a court-authorized seizure of two domain names and one affiliated blog associated with VerifTools, an online marketplace peddling counterfeit driver’s licenses, passports, and other state- and country-issued identity documents. 

    Operating under the banner of VerifTools since 2020, the enterprise leveraged the anonymity of cryptocurrency and underground DNS infrastructures to facilitate identity fraud on a global scale.

    Key Takeaways
    1. Seized VerifTools domains, blocking $6.4 M in fake-ID sales.
    2. FBI used DNS sinkholing and Tor forensics.
    3. US-Dutch law enforcement collaboration on identity theft and money laundering charges.

     FBI Takes Down VerifTools Dark Web Marketplace

    The Federal Bureau of Investigation (FBI) initiated Operation Iron Seal in August 2022 after uncovering a conspiracy to exploit stolen Personally Identifiable Information (PII) for unauthorized access to cryptocurrency accounts and illicit transfers on the blockchain. 

    VerifTools advertised counterfeit digital and physical IDs for all 50 U.S. states and multiple foreign jurisdictions, accepting payments in Bitcoin (BTC) and Monero (XMR) via privacy-enhanced wallets. 

    VerifTools Marketplace takendown
    VerifTools marketplace takendown

    According to court filings, the marketplace generated at least $6.4 million in illicit proceeds. Agents obtained and verified VerifTools’ backend source code through a controlled purchase of counterfeit New Mexico driver’s licenses priced at just $9 per document. 

    Using cryptocurrency mixing services and Tor‐based hidden services, operators obscured transaction trails and server locations. 

    FBI analysts deployed standard DNS sinkholing techniques to redirect VerifTools’ top-level domains (TLDs) to a government-controlled server, effectively neutralizing the sites and preserving evidence.

    “If you build or sell tools that let offenders impersonate victims, you are part of the crime,” Acting U.S. Attorney Ryan Ellison stated, citing a seizure warrant.

    Philip Russell, Acting Special Agent in Charge of the FBI’s Albuquerque Division, highlighted the technical complexity of dismantling such platforms:

    “The removal of this marketplace is a major step in protecting the public from fraud and identity theft crime. We leveraged advanced cyber forensics packet capture (PCAP) analysis, deep packet inspection (DPI), and WHOIS record mapping to identify infrastructure nodes and operators.”

    The sale or transfer of possession of false identification documents carries penalties of up to 15 years imprisonment. 

    The Justice Department’s Office of International Affairs facilitated mutual legal assistance requests, while prosecutors consolidated charges, including Conspiracy to Commit Aggravated Identity Theft and Money Laundering.

    The FBI’s Albuquerque Field Office led the technical takedown, executing covert operations to seize control of VerifTools’ DNS records and preserving forensic images of server hard drives. 

    Domain registrars were served with ex parte seizure orders, and updated WHOIS entries now reflect registry status: “CONFISCATED BY THE UNITED STATES GOVERNMENT.” 

    Authorities continue to pursue the remaining cybercriminal network responsible for distributing these tools worldwide.

    Find this Story Interesting! Follow us on Google News, LinkedIn, and X to Get More Instant Updates.

    The post U.S. Government Seizes Online Marketplaces Used to Sell Fraudulent Identity Documents to Cybercriminals appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • WhatsApp Zero-Day Vulnerability Exploited with 0-Click Attacks to Hack Apple Devices

    ·

    , , , , , , ,

    WhatsApp has issued a critical security advisory addressing a newly discovered zero-day vulnerability, tracked as CVE-2025-55177, which has been exploited in highly sophisticated zero-click attacks targeting Mac and iOS users. The vulnerability, combined with an OS-level flaw (CVE-2025-43300), has raised alarms about the potential compromise of user devices and data, including sensitive messages. Vulnerability Details […]

    The post WhatsApp Zero-Day Vulnerability Exploited with 0-Click Attacks to Hack Apple Devices appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Iron Man in the Himalayas? China’s PLA embraces exoskeletons

    ·

    Imagine powered exoskeletons that enable soldiers to operate in the world’s most austere regions. Accompanied by robotic dogs and cargo drones, the troops can move through snow, easily carrying over 100 pounds of gear. 

    This is no longer science fiction. Earlier this year, China’s People’s Liberation Army executed an "intelligent logistics devices” exercise on the far-western Karakoram Plateau of the Xinjiang Military District, part of a push to move such gear from demonstrations to deployment.

    China has spent the last several years building a diverse exoskeleton research-and-development ecosystem: In 2019, the PLA hosted a “Super Warrior” contest in which 50-plus prototypes from 25 developers competed in categories such as lightweight mobility, heavy-load marching, and munitions handling. This broad base suggests China’s exoskeleton R&D is not limited to one program, but is spread among state-supported primes, private venture players, and universities, each tackling aspects like materials, power systems, and artificial intelligence for gait assistance.

    In 2020, state-owned defense conglomerate Norinco delivered a passive, backpack‑style frame to troops on the Tibet border. Their positive feedback triggered a follow‑on contract one month later. Separately, engineers at state-owned aerospace firm CASIC developed a powered frame with an electric‑motor drive and a swappable battery pack, unveiled in 2021 as the ‘Portable Ammunition Support Assist’ suit. This version adds roughly 44 pounds of lift, records usage data on a tablet, and straps on in under 40 seconds. PLA testers report the suit off‑loads more than 50 percent of the weight burden and lets one soldier haul a 110-pound ammo box “without much effort.”

    A lighter, knee-only brace surfaced at the 2024 Zhuhai Airshow. Built by Beijing Precision Mechatronics, the device injects 55 pounds of torque during ascent, but  weighs only a few pounds. Though marketed for military special operations work, exhibitors noted the knee brace is small enough for tourist or industrial markets—a perfect example of China’s military-civil fusion ecosystem. 

    [[Related Posts]]

    Private start‑ups have also started to get involved. Beijing‑based Blood Wingnse previewed its hybrid Vanguard full‑body suit in Weibo clips ahead of the 2025 Shanghai Defense‑Industry Expo. According to the company, the carbon‑fiber/titanium frame weighs less than 55 pounds and offers three assist modes that pair 88 pounds of arm assistance with 132 pounds of leg support. Engineers claim the structure can handle a 220-pound continuous load, but pull up to 440 pounds for a short time, a figure echoed in recent Chinese coverage of consumer exoskeletons.

    With the systems moving from lab prototypes to more and more capability, the PLA has begun to selectively introduce exoskeletons to units operating in China’s most physically demanding terrains—including the high-altitude mountain brigades and border defense regiments in Tibet and Xinjiang. These plateau units were early adopters because they regularly conduct long foot patrols and supply missions at an elevation of 4,500–5,500 meters, where oxygen is thin and a typical soldier’s endurance is severely limited. 

    PLA forums and tech outlets reported in January that plateau infantry brigades have been test marching with the new third-gen powered suits. This drill, notably conducted near the sensitive Indian border before India’s Army Day, aimed to validate man-machine teaming in extreme environments. Chinese sources claimed that exoskeletons, by alleviating altitude fatigue, help troops “overcome the physiological difficulties of high-altitude combat” and arrive mission-ready.

    A mid high‑altitude field drill offers additional data on field performance. CCTV‑7 followed Joint Logistic Support Force engineers from the Xining Joint Logistics Support Center as they laid a fuel‑pipeline kit at 4,000 meters in Qinghai. Troops wearing knee‑hip frames that weighed less than 13 pounds carried 154‑pound hose reels and pump modules across loose gravel while contending with thin air and freezing temperatures, demonstrating that the suits preserve lifting capacity under extreme conditions.

    Among the specific PLA units known to use exoskeletons are the frontier defense companies stationed in Tibet’s Ngari prefecture, along the Line of Actual Control with India. Observers have also identified additional PLA mountain infantry brigades, also under the Western Theater Command, integrating the gear in training. Although official unit designations aren’t always disclosed, it’s clear the Western Theater forces along or near the contested Line of Actual Control with India have led testing and implementation.

    But the technology is no longer confined to the plateau, and has started to spread to other commands. A PLA Daily feature on the 73rd Group Army opposite Taiwan showed an Eastern Theater Command medic sprinting with a 154-pound casualty while wearing a leg‑and‑waist frame—a development that would cut stretcher teams in half. A news report on a June 2025 Northern Theater logistics exercise casually noted the use of exoskeletons by logistics soldiers in transporting munitions. Chinese defense bloggers now track exoskeleton sightings in the Western, Eastern, and Northern Theater Commands, all training with the rigs as part of a wider push toward unmanned and assisted logistics.

    Within official PLA discourse, exoskeletons have shifted from laboratory curiosities to items the Army now slots directly into logistics, patrol, and battlefield‑aid drills. A December PLA Daily article on historical logistics innovation describes the “robotic exoskeleton system” as a new link in the “steel transport line,” easing heavy physical logistics support activities such as ammunition handling. A July account of an Army Logistics University exercise adds that exoskeleton porters, teamed with UAV “swarms” and unmanned ground vehicles, raise a single soldier’s load capacity by 110 to 176 pounds and are central to an emerging “unmanned, intelligent supply chain”.

    Doctrine writers frame these advances under the banner of “smart support,” contending that mechanical exoskeletons let troops effortlessly carry and move more equipment, making the rigs a combat‑power multiplier for extended patrols and high‑altitude resupply missions. During a recent demonstration of a PLA logistics unit using at least three different exoskeletons, Senior Colonel Gong Zhansheng, director of the Quartermaster Procurement Department at the PLA Army Logistics University in Chongqing, explained that the PLA uses both active frames (which integrate a series of technologies such as automatic control, intelligent sensing, and mechanical design) and simpler passive versions of exoskeletons, allowing small logistics detachments to push vital supplies through the ‘last mile’ without mustering large porter teams or calling up vehicles.

    China’s decision to continue to pursue and field soldier augmentation reshapes the tactical math in places where every ounce and breath counts. On the Himalayan frontier, frames that let a porter move 110 to 176 pounds alone mean patrols can haul heavier sensors or extra ammunition without adding mules or vehicle convoys. The development alters sustainment, casualty evacuation, and squad mobility. It also shortens the logistics tail that Indian and U.S. planners could seek to disrupt.

    Dual use economics mean export models may soon surface in partner armies from Pakistan to the Arabian Gulf, undermining long‑held assumptions that Western or allied forces will field the most capable medics and porters during disaster relief and peacekeeping missions. 

    Lightweight frames that strap on in under a minute and run on power tool batteries no longer should be thought of as sci‑fi; in China they are edging toward baseline kit. 

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Researchers Warn of Sitecore Exploit Chain Linking Cache Poisoning and Remote Code Execution

    ·

    Three new security vulnerabilities have been disclosed in the Sitecore Experience Platform that could be exploited to achieve information disclosure and remote code execution.  The flaws, per watchTowr Labs, are listed below – CVE-2025-53693 – HTML cache poisoning through unsafe reflections CVE-2025-53691 – Remote code execution (RCE) through insecure deserialization CVE-2025-53694 –

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶