Mobile Application Security Testing
for Android and iOS
Apps You Can Trust
Mobile application security testing
Attacker-Led Testing for the Apps in Your Customers' Pockets
iSpyCyber tests your Android and iOS apps the way attackers do: on real devices, with the app, its local storage, its network traffic and its backend APIs all in scope. Every finding is validated by hand, risk-rated and delivered with remediation guidance your mobile and backend developers can act on immediately.
Why organisations choose iSpyCyber
Real-device testing
Apps are tested on physical Android and iOS devices, including rooted and jailbroken builds, not just emulators.
App and API together
Most mobile breaches happen in the backend. We test the app and the APIs it calls as one attack surface.
Near-zero noise
Static and dynamic tool output is triaged and reproduced by hand, so your team only receives real, exploitable issues.
Developer-ready fixes
Reproduction steps, proof-of-concept evidence and platform-specific remediation for Kotlin, Java, Swift and cross-platform frameworks.
Release-ready assurance
Testing aligned to OWASP MASVS helps you ship with confidence before app store submission and major releases.
Continuous validation
Retesting confirms every fix, and iefyx, our AI-native VAPT platform, keeps exposure visible between releases.
Coverage
What We Test in Your Mobile Apps
Our testers follow the OWASP Mobile Application Security Testing Guide and go beyond it, chaining client-side and backend weaknesses the way real attackers do.
Data storage
Sensitive data in local databases, shared preferences, Keychain and Keystore, logs, caches, backups and screenshots.
Authentication and sessions
Login, biometrics, MFA, token storage and refresh, session expiry and device binding.
Network communication
TLS configuration, certificate pinning, cleartext traffic and man-in-the-middle resilience.
Backend APIs
Broken object-level authorisation, mass assignment, rate limiting and excessive data exposure in the APIs the app calls.
Cryptography
Hard-coded keys, weak algorithms, insecure random number generation and key management.
Platform interaction
Exported activities, intents, deep links, URL schemes, WebViews and inter-app communication.
Code quality and binaries
Third-party SDKs, outdated libraries, debug flags and secrets left in the application package.
Resilience
Root and jailbreak detection, anti-tampering, obfuscation and runtime instrumentation defences.
Privacy
Permissions, tracking, data minimisation and how personal data leaves the device.
Methodology
A Proven Six-Phase Testing Methodology
Aligned to OWASP MASVS, the OWASP Mobile Application Security Testing Guide and NIST SP 800-115, and tailored to your app, platforms and risk.
- OWASP MASVS
- OWASP MASTG
- OWASP Mobile Top 10
- NIST SP 800-115
- CVSS 3.1
1–3
weeks for a typical engagement
6
standards-aligned phases
100%
findings manually validated
01
- Days 1–2
Scope and plan
Platforms, app versions, user roles, backend environments and success criteria agreed up front.
Key activities
- Confirm Android and iOS builds and versions
- Agree rules of engagement and test windows
- Provision test accounts and test devices
- Output: Signed rules of engagement
02
- Days 2–4
Map and model
Reverse engineering and threat modelling of the app, its data flows and the APIs it depends on.
Key activities
- Decompile and review the application package
- Map API endpoints, SDKs and data flows
- Threat-model sensitive features and data
- Output: Attack surface map and test plan
03
- Days 3–8
Discover
Static and dynamic analysis combined with hands-on testing on rooted and jailbroken devices.
Key activities
- Static analysis of code, config and secrets
- Dynamic testing with runtime instrumentation
- Backend API and business-logic testing
- Output: Candidate vulnerability list
04
- Days 6–10
Exploit and validate
Impact safely proven, client and server weaknesses chained and false positives eliminated.
Key activities
- Safely prove impact with proof of concept
- Chain app and API weaknesses into attack paths
- Rate every finding with CVSS and business context
- Output: Validated, risk-rated findings
05
- Days 10–13
Report and debrief
Executive summary, technical findings and a live walkthrough with your mobile, backend and leadership teams.
Key activities
- Executive summary for leadership
- Platform-specific technical write-ups
- Live walkthrough and Q&A with your teams
- Output: Final report and debrief
06
- After remediation
Fix and retest
Remediation guidance, developer Q&A and retesting of new builds to confirm every issue is closed.
Key activities
- Developer Q&A while fixes are built
- Retest every remediated finding on the new build
- Updated report confirming closure
- Output: Retest report
Effort distribution
Where the testing time goes
Most of every engagement is spent on hands-on reverse engineering, dynamic testing and exploitation by skilled testers, not on running scanners. Percentages are indicative for a typical grey box test.
Quality built into every phase
Every finding reproduced
Nothing is reported until a tester has reproduced it by hand.
Risk rated in context
CVSS scores adjusted for your data, users and exposure.
Agreed rules of engagement
Test windows and limits protect live services.
Closure confirmed
Retesting proves each fix actually works.
Engagement models
Choose the Testing Approach That Fits Your Risk
Every approach uses the same methodology. The difference is how much context our testers start with, and how deep they can go.
Black box
Only the published app, simulating an attacker who downloads it from the store. Best for validating what any user or attacker can reach.
Grey box
Test accounts and API documentation to test authenticated features across roles. Best for most business apps, with the strongest balance of depth and efficiency.
White box
Source code, build configuration and backend access for the deepest coverage. Best for banking, healthcare and other high-risk or regulated apps.
Not sure which approach you need?
Our specialists will recommend a scope based on your platforms, users and compliance obligations.
Deliverables
Reports Built for Leadership, Developers and Auditors
Clear business context for decision-makers, precise technical detail for developers and evidence your auditors can rely on.
Executive summary
Overall risk posture, key themes and business impact in plain language for leadership and boards.
Technical findings
Every vulnerability with CVSS rating, affected platform and version, reproduction steps and evidence.
Remediation roadmap
Prioritised, platform-specific fix guidance so teams resolve the highest-impact issues first.
Retest report
Independent confirmation of which findings are closed on the new build, ready for customers and auditors.
Supports your compliance and assurance requirements
- OWASP MASVS
- OWASP Mobile Top 10
- PCI DSS
- ISO/IEC 27001
- SOC 2
- DPDP Act 2023
- RBI guidelines
- CERT-In guidelines
- HIPAA
- GDPR
iSpyCyber provides independent security testing that supports these requirements. Certification and attestation are issued by accredited bodies and licensed auditors.
Mobile application testing for every industry
FAQ
Mobile application security testing questions, answered
Can’t find what you need? Talk to our security team.
The basics
What is mobile application security testing?
Mobile application security testing is a structured assessment, led by skilled testers, that identifies and safely exploits vulnerabilities in an Android or iOS app, the data it stores on the device and the backend APIs it relies on, then explains the business impact and how to fix each issue.
Do you test both Android and iOS?
Yes. We test native Android and iOS apps as well as cross-platform apps built with frameworks such as React Native and Flutter, on real devices.
Do you also test the backend APIs?
Yes. The APIs an app calls are usually where the most serious issues are found, so they are included in scope by default unless you ask us to exclude them.
Which standards does your methodology follow?
Our methodology aligns with OWASP MASVS, the OWASP Mobile Application Security Testing Guide, the OWASP Mobile Top 10 and NIST SP 800-115, and findings are rated using CVSS.
Working with us
What do you need from us to start?
The app builds (APK or AAB for Android, IPA or TestFlight access for iOS), test accounts for each user role and, for grey or white box testing, API documentation or source code.
How long does a mobile app penetration test take?
Most engagements take one to three weeks, depending on the number of platforms, user roles and integrations in scope. We confirm the timeline during scoping.
Do you retest after we fix the issues?
Yes. We retest remediated findings on your new build and issue an updated report confirming which issues are closed.
Get started
Ship Secure Mobile Apps.
Without Slowing Releases.
Talk to our mobile security specialists about a scoped Android and iOS penetration test for your apps.
- ISO/IEC 27001 and ISO 9001 certified
- 40+ enterprise and government clients
- 15+ countries