Features

Everything your team needs to test a mobile application - without leaving evidence on the table.

Static, dynamic and runtime analysis, supply-chain review, authenticated API surface inspection, data-protection checks and tamper verification - unified in a single platform, mapped to the frameworks your auditor already recognises, and designed to fit into the engineering pipeline your team actually uses.

Start Free Trial See pricing

Static analysis, end to end

The analysis engine decomposes every application package you submit - Android and iOS, single binaries and multi-module bundles - and walks the full code graph. Manifests, bytecode, native libraries, embedded resources and configuration files are parsed and indexed so the scanner can reason about the application in the same way an attacker would, but far faster.

Detections are a hybrid of deterministic pattern checks and flow-sensitive rules. Data-flow and taint analysis track untrusted input from entry point to sink, so issues such as unsafe deserialisation, path traversal, weak cryptography, injection flaws or unsafe reflection surface with the exact propagation path, not just a line number.

  • Supported packages: APK, AAB, XAPK (Android) and IPA (iOS)
  • Languages covered: Java, Kotlin, Swift, Objective-C, C / C++ for native libraries
  • Cross-framework support: hybrid mobile frameworks are analysed at both the native and bundled-code layer
  • Detection style: deterministic rules plus flow-sensitive analysis with inter-procedural tracking
  • Coverage signals: control-flow graph density, resolved entry points, analysed sinks, reachable strings
  • Finding metadata: severity, CWE reference, OWASP MASVS/MASTG test case, suggested remediation

Dynamic and runtime behaviour

Static analysis cannot observe every decision a real binary makes. The platform boots each application in an isolated, instrumented mobile runtime with full network capture and observation of filesystem, IPC, permission dialogs and component interactions.

Runtime instrumentation hooks live function calls to verify whether the security controls declared by the application actually execute. That is what turns "certificate pinning is configured" into "certificate pinning is enforced on this endpoint under these conditions" - the difference that matters during a pen test.

  • Tenant-isolated per-build runtime instances with clean boot between scans
  • Full outbound traffic capture with TLS inspection and decoded request / response bodies
  • Hook verification for TLS pinning, root and emulator detection, anti-debug, biometrics, screen record blocking
  • Automated user flows: login, register, password reset, deep-link entry, common vertical screens
  • Exit state is wiped and the runtime is discarded after every scan - no residual data survives

Secret and credential detection

Credentials accidentally bundled into a mobile binary are the single most common high-impact finding. The platform detects hardcoded API keys, tokens, session secrets, signing material and configuration that should never have left the build server - then prioritises each finding by exposure rather than by string pattern alone.

Detection uses a signature catalogue for well-known providers, entropy analysis for arbitrary secrets, and contextual classification that rejects test fixtures, documentation placeholders and reused public keys. Every confirmed secret ships with a revocation checklist so the on-call engineer has a clear next step.

  • Signature catalogue for widely used cloud, messaging, analytics and payment providers
  • Entropy and structural scoring for unknown or custom-format credentials
  • Provenance: resource file, native library, obfuscated string pool or split constant
  • Validated where safe: confirms a live credential only if the probe is read-only and non-billable
  • Output: revocation playbook, time of introduction, affected release, associated build artefact

Supply chain and bill of materials

Most of the code inside a modern mobile application is not written by the team that ships it. The platform produces a complete, standards-compliant software bill of materials for every build, covering native libraries, framework bundles and transitive dependencies - and diffs that inventory against known-vulnerability sources on every scan.

  • Inventory includes native libraries, framework bundles (for hybrid apps) and declared package dependencies
  • Component identification by fingerprint: survives renaming, shading and obfuscation where feasible
  • Matching against recognised vulnerability sources with CVE, CVSS and EPSS enrichment
  • License reporting so legal review can happen from the same artefact as the security review
  • Exports in CycloneDX and SPDX formats for archival or downstream tooling

API and backend surface

A mobile application is an inventory of every endpoint it calls. The platform extracts that inventory from the binary, then tests each endpoint for authentication bypass, broken object-level authorisation, excessive data exposure, mass assignment, insecure direct object reference and misconfigured cross-origin controls - with the authentication context the real app actually uses.

  • Endpoint extraction from network calls, manifest intents, deep links and embedded configuration
  • Authentication-aware probing: the scanner carries real session context through the tests
  • OpenAPI-compatible export of the discovered surface for your API security team
  • Results are correlated with the calling screen or flow inside the app for faster triage

Data protection and cryptography

The platform traces how each piece of sensitive data flows through the application - where it is collected, where it is stored, which transport it takes, which key protects it, and how that key is derived and rotated. Weak ciphers, deprecated key sizes, mis-used random number generators, plaintext storage, unsafe logging and predictable IVs are reported with a ranked severity that reflects the data class at risk.

  • Storage analysis: shared preferences, key-value databases, file system and external storage
  • Transport analysis: TLS configuration, pinning posture, fallback behaviour, cleartext exceptions
  • Key material: hardware-backed storage detection, key ceremony review, key derivation inspection
  • Cryptographic API usage graded against current published guidance

Tamper and integrity checks

Where the application declares protection against tampering, rooting, debugging or repackaging, the platform verifies that those controls actually fire. Static declarations are confirmed at runtime using instrumented scenarios, and weaknesses in the bypass surface are reported with reproduction steps.

  • Root and emulator detection coverage
  • Anti-debug and anti-hook defence in depth
  • Code signing and package integrity verification
  • Device attestation pathways and fallback behaviour

Compliance framework mapping

Every finding is tagged with its corresponding OWASP MASVS and MASTG test-case identifier. Where applicable, the same finding is also mapped to controls in NIST SSDF SP 800-218, NIST SP 800-53 Rev. 5, ISO 27001:2022 Annex A, PCI-DSS v4.0 and the HIPAA Security Rule. Personal-data processing findings reference KVKK and GDPR articles.

  • One primary framework identifier per finding, plus secondary cross-references where relevant
  • Assurance matrices exportable at the application or portfolio level
  • Per-tenant configuration to mark which frameworks are in scope for the organisation
  • Audit-ready evidence bundles regenerated on every scan

Reporting and evidence export

Reporting is a core output of the platform, not a post-processing afterthought. Every scan produces a signed evidence chain that records what was analysed, what was found, which rules applied, how they were configured and who accessed the result.

  • Executive report (PDF): scoped, branded, audit-ready
  • Engineering report (PDF and JSON): full findings with reproduction steps
  • Machine-readable outputs: SARIF, CycloneDX, SPDX, raw JSON
  • Stable URLs for every scan and every finding for long-lived references in your own systems
  • Immutable audit trail of scan, review and export events

Automation and DevSecOps integration

Security testing that only runs when someone remembers to push a button does not work at the speed modern teams ship. The platform is designed to run automatically on every build, fail a pipeline when risk thresholds are crossed, and route findings to the tools your teams already use.

  • REST API covering projects, scans, findings, policies and exports
  • Webhooks for every lifecycle event, with retry and per-destination authentication
  • Native pipeline integration: scan on pull request, on merge and on scheduled release
  • Policy-as-code: severity thresholds, framework coverage requirements, waiver handling
  • Outbound forwarders for ticketing, log pipelines, SIEM and collaboration systems

Platform controls

Identity, access and audit were not added late. The platform has per-tenant isolation, role-based access control with least-privilege defaults, SAML 2.0 and OIDC single sign-on, SCIM-based user lifecycle, and an append-only audit log of every privileged action.

  • SSO via SAML 2.0 and OpenID Connect, with just-in-time provisioning
  • SCIM 2.0 for automated user and group lifecycle
  • Role-based access with granular scopes, scoped API tokens and session controls
  • Tenant isolation at the data, compute and network layers
  • Encryption in transit (TLS 1.3) and at rest (AES-256-GCM), optional customer-managed keys
  • Immutable audit log streamable to your existing log pipeline

Flexible deployment

The platform is deployed exactly where the organisation needs it. Managed cloud, private-cloud single tenant in a customer-owned account, or fully air-gapped on-premise - the feature set is identical.

  • Managed multi-tenant cloud with configurable data residency
  • Single-tenant private cloud inside a customer-owned account
  • Fully on-premise or air-gapped install, including restricted-network mirror for updates
  • Horizontal scaling for enterprise portfolios; no per-scan throttling at enterprise tier
  • Backup, restore and disaster-recovery procedures documented and tested

Walk through the platform with one of our engineers.

We scan an application of your choice, hand over the full evidence bundle and answer every technical question your team brings.

Start Free Trial See pricing