Mobile App Penetration Testing
Security testing for your iOS and Android apps — on the device and against the backend they talk to — covering the risks the app stores' own checks never look for.
What's covered
-
Data storage
Sensitive data left in local storage, databases, logs, caches and backups.
-
Authentication & sessions
Login, token handling, biometric flows and session management.
-
Certificate pinning & transport
How the app protects its traffic, and whether pinning can be bypassed.
-
Jailbreak & root detection
Whether device-integrity checks can be defeated, and what that exposes.
-
Backend APIs
The web services behind the app, tested for broken authorisation and data leakage.
-
Platform hardening
Reverse-engineering resistance, exported components and deep-link handling.
A clear, transparent process
Scope
Get an instant estimate, then a short call to confirm targets, timing and rules of engagement.
Test
Hands-on testing by an experienced consultant, with critical issues flagged to you as they're found.
Report
A clear report: executive summary, risk-rated findings, evidence and practical fixes.
Retest
We check your fixes and confirm they work.
Common questions
Do you test both iOS and Android?
Yes. We test iOS, Android, or both. Testing both costs more than a single platform because the apps and their protections differ.
Do you need the source code?
No. We can test the compiled app as an attacker would. Source code (a 'grey box' test) can make testing more thorough, but it isn't required.
Does the mobile test include the backend API?
The app's own behaviour and its direct API calls are in scope. A full, separate test of a large API is best quoted as an API engagement — we'll advise during scoping.
How much does a mobile app pen test cost?
It depends on platform(s) and app complexity. Try the instant estimate tool for a guide price, then we confirm the scope with you.
Ready to get started?
Get an instant estimate for your mobile applications test, or book a free consultation.