Penetration testing
Mobile Application Penetration Testing
We test your iOS and Android apps end to end, from the code on the device to the APIs behind them.
Overview
What it is
A mobile app puts your code in the hands of everyone who downloads it, including attackers. We test what the app stores, how it talks to your servers and whether its protections actually hold.
Our testing covers insecure data storage, weak transport security, authentication flaws, the APIs the app relies on and the platform-specific issues that affect iOS and Android.
Who it is for and what you get
Who it is for
- Organisations with customer-facing iOS or Android apps
- Product teams handling personal or payment data on mobile
- Anyone whose app is central to their business
- Teams that need assurance before an app store release
What you get
- A clear report with an executive summary for leadership and technical detail for your team.
- Every finding ranked by real-world risk, with practical, prioritised remediation advice.
- A free retest of the fixes you make, so you can prove the risk is closed.
- A debrief call to walk through the results and answer your questions.
Our process
How the engagement runs
- 01
Scope
We agree the platforms, app builds and test accounts, and whether the back-end APIs are in scope.
- 02
Test
We analyse the app on the device and in transit, and test the APIs it depends on.
- 03
Report
You get findings with evidence and clear fixes for both the app and its back end.
- 04
Retest
We confirm the updated build has closed the issues.
FAQs
Frequently asked questions
Do you test both iOS and Android?
Yes. We test each platform you support. The two have different risks, so we assess both where your app runs on both.
Do you test the APIs behind the app?
Yes. Most serious mobile findings sit in the APIs the app talks to, so we strongly recommend including them in scope.
What do you need from us to test?
A test build of the app, test accounts and any documentation you have. We will confirm the exact requirements during scoping.
Can you test an app that is already live?
Yes. We can test a production build, though a dedicated test environment lets us probe more thoroughly without affecting real users.
Related services
You might also need
Get started
Ready to scope your mobile application penetration testing?
Tell us about your organisation and we will recommend the right approach. Quote only, no hard sell.