Overview
UK consumers expect to bank, shop and book appointments from a phone, so mobile apps often reach more of your customers than the website does. We review both platforms against OWASP MASVS, then follow each call back to the server, because the most damaging findings in mobile work usually sit in the API rather than on the handset.
A mobile application ships to devices that may be jailbroken, rooted, stolen or running a hostile proxy, so the assumptions a web app can make no longer hold. We test what the app stores on the device, how it protects that data at rest, and whether an attacker with physical or network access can recover credentials, tokens or personal data from files, databases, logs or the keychain and keystore.
We examine the app in motion as well as at rest. That means inspecting transport security and certificate validation, attempting to intercept and modify traffic, and checking platform-specific weaknesses: exported components and deep links on Android, inter-process URL handling on iOS, and insecure use of WebViews on both. Where client-side controls such as root detection or certificate pinning exist, we assess how much real protection they add.
Because most of a mobile app's value lives in its backend, the APIs it calls are in scope by default. A hardened client is of little use if its server trusts any request, so we carry the authorisation and logic testing through to the service behind the app. Findings are aligned to the MASVS, scored with CVSS v4.0, and written so your mobile and backend teams each know what to change.
How we work with UK clients
- Testing windows set in UK time at scoping. India runs 4.5 hours ahead during British Summer Time and 5.5 hours ahead in winter, so our days overlap.
- Fixed proposals in GBP, excluding VAT; the reverse charge usually applies to UK business buyers.
- No traffic leaves our hands until written authorisation is signed by someone entitled to give it, as the Computer Misuse Act 1990 requires.
- Findings labelled for the evidence you file: ISO 27001 Annex A, UK GDPR Article 32, PCI DSS or a supplier questionnaire.
What's included
Our approach
- Build intakeWe take your IPA or APK and the test accounts needed for each role and platform.
- Static reviewWe unpack and inspect the build for secrets, configuration and insecure components.
- Dynamic testingOn real devices we exercise storage, transport, platform and runtime behaviour.
- Backend testingThe APIs the app calls are tested for authorisation and logic flaws.
- Report & debriefFindings are evidenced, scored and explained to your mobile and server teams.
What you receive
- Per-platform findings aligned to the OWASP MASVS
- Static and dynamic evidence for each issue
- CVSS v4.0 scores and prioritised remediation
- Backend API findings where in scope
- Free retest of fixed issues and an attestation letter
Standards & frameworks
- OWASP MASVS
- OWASP MASTG
- OWASP API Security Top 10
- PTES
- NIST SP 800-115
- CVSS v4.0
- UK GDPR Art. 32
Frequently asked questions
Do you need the source code?
No. We can test a compiled IPA or APK as a grey-box engagement using test accounts. Source or build access speeds up static review and improves coverage, so we welcome it where you can share it, but it is not a requirement.
Do you test on real devices or emulators?
Both. Emulators are useful for repeatable static and dynamic checks, but some platform and hardware behaviour only appears on physical handsets, so we confirm key findings on real rooted and jailbroken devices across the versions you support.
Is the backend included or priced separately?
The APIs the app relies on are part of a meaningful mobile test, so we include authorisation and logic testing of them by default. A very large backend with many unrelated services may be scoped as its own API engagement, which we confirm before we start.
Can testing run during UK office hours?
Yes. Testing windows are agreed in UK time at scoping. India is 4.5 hours ahead of the UK during British Summer Time and 5.5 hours ahead in winter, so our working day overlaps yours. If you prefer quiet periods, we can also test in your early morning or evening.
Does an application pentest help with UK GDPR?
It can. Article 32 of the UK GDPR expects "a process for regularly testing, assessing and evaluating the effectiveness" of security measures. A dated application test with retested fixes is a clear record of that process for the personal data your application handles.