Overview
US banking, health, retail and on-demand apps handle sensitive data on devices you don't control. We test the app and the APIs behind it against OWASP MASVS, which gives you useful evidence for HIPAA, PCI DSS and GLBA security programs and helps you answer enterprise customer and app-store security reviews with confidence.
Mobile apps run on devices you don't control. Anyone can download your app, decompile it, inspect what it stores, intercept its traffic and replay requests to your backend. A mobile penetration test measures how well your app and its APIs hold up under that scrutiny.
Our assessments combine static analysis of the app package, dynamic analysis on rooted and jailbroken test devices, and full testing of the backend APIs the app relies on — because once attackers understand your API, the app's client-side protections no longer matter.
Findings are mapped to the OWASP Mobile Application Security Verification Standard (MASVS v2), giving your iOS and Android developers platform-specific guidance they can act on.
How testing works for US organizations
- Signed scope and written authorization before any testing, including hosting and cloud provider permissions
- Testing windows agreed around your US time zone at scoping, including after-hours windows for production
- Fully remote delivery, with internal and wireless access via VPN or a shipped test device, so no travel costs
- Reports mapped to SOC 2, PCI DSS, HIPAA and customer questionnaires, with a fixed price in USD
What's included
Our approach
- Static analysisDecompilation and review of manifests, plists, binaries and embedded secrets.
- Dynamic analysisRuntime instrumentation on test devices to inspect storage and bypass controls.
- Traffic interceptionManipulating API calls to test authentication, authorization and input handling.
- Business logicAbuse of in-app purchases, rewards, KYC and payment flows.
- Report & retestPlatform-specific fixes for iOS and Android teams, followed by verification.
What you receive
- Separate iOS and Android findings
- MASVS v2 control mapping
- Backend API findings
- Code-level remediation guidance
- Retest report and attestation letter
Standards & frameworks
- OWASP MASVS v2
- OWASP MASTG
- OWASP API Top 10
- CWE
- GLBA / FTC Safeguards Rule (where applicable)
- SOC 2 CC4.1
Frequently asked questions
Do we need to test both platforms?
Usually yes. iOS and Android differ in storage, permissions and security features, and codebases often diverge even with cross-platform frameworks.
Can you test Flutter and React Native apps?
Yes. Cross-platform apps need some different reverse-engineering tooling, but MASVS controls and API testing apply in the same way.
What builds should we provide?
Ideally both a debuggable build (faster, deeper testing) and the release build (to assess real-world protections).
Are you a PCI QSA or ASV, FedRAMP 3PAO or CMMC C3PAO?
No. We don't claim any of those statuses on this site. Most penetration tests for SOC 2, HIPAA, PCI DSS Requirement 11.4, the FTC Safeguards Rule and customer due diligence don't require them. If your contract, assessor or program requires a specific accredited provider, tell us at scoping and we'll say plainly whether we can meet it. See US compliance requirements.
Do you quote in US dollars?
Yes. US proposals are fixed-price and quoted in USD, with scope, effort, deliverables and payment terms set out in writing before work starts. See our US pricing guide for published market ranges.