Mobile Application Security
Testing iOS and Android applications for the risks specific to running on a device you don’t control.
Who this is for: Businesses that have built or commissioned a mobile app, particularly one handling logins, payments, or sensitive data.
The Problem
A mobile app runs on a device the business doesn’t control, which introduces risks a web application doesn’t have: insecure local storage, weak API communication, and code that can be reverse-engineered by anyone who downloads it.
Our Solution
We test the app itself, its local data storage, how it communicates with your backend API, and how resistant it is to reverse-engineering and tampering.
What's included
- Local data storage security review
- API communication and certificate-pinning review
- Authentication and session handling testing
- Reverse-engineering and tampering resistance testing
- Platform-specific testing for iOS and Android
Mobile app security is closely related to API Security, since most of what an app does happens through API calls to a backend, but the app itself introduces its own risks: data cached insecurely on the device, or business logic that can be extracted and studied by decompiling the app.
Benefits
- Risks specific to running on an uncontrolled device identified
- API communication tested from the app’s actual perspective
- A report covering both iOS and Android where relevant
Our Process
Scope
Identify platforms, backend APIs, and sensitive data handled.
Test Storage
Review how data is stored locally on the device.
Test Communication
Review API communication and certificate handling.
Test Resilience
Assess resistance to reverse-engineering and tampering.
Report
Severity-ranked findings for your development team.
Frequently asked questions
Do you test both iOS and Android?
Yes, testing is scoped to whichever platforms your app is built for; the two platforms have some distinct risks worth testing separately.
Does this cover our backend API too?
The app’s communication with your API is tested as part of this engagement; a deeper API-specific review is available through our API Security service.
Especially relevant for
Related services
Website Security
WAF deployment, malware scanning, and CMS/plugin hardening for public-facing sites and storefronts.
shield_lockWordPress Management & Security
Ongoing management and security hardening built specifically for WordPress, the platform behind a huge share of the small-business web, and the one attackers target hardest because of it.
alternate_emailEmail Security
Full email authentication and anti-phishing hardening, closing the gaps between partial protection and actually secure email.
Not sure if this is the right fit?
Tell us what's worrying you. We'll tell you what actually needs fixing first.