Your mobile app, tested on the device and behind it
We test your iOS and Android apps together with the APIs and services they talk to, inside a scope and rules you agree to in writing. Then we show you what we found, why it matters and what to fix first.
Overview
What a mobile test covers
A mobile app runs on a device you do not control, in the hands of anyone who downloads it. Whatever it stores, sends or assumes can be examined at leisure. A useful test therefore looks at the app itself, at how it uses the platform it runs on, and at the backend it trusts.
We review how the app handles data at rest and in transit, how it authenticates users and keeps sessions, what it exposes to other apps on the device, and how the APIs behind it enforce access. Findings in the app and findings in the backend are reported together, because an attacker would use them together.
Where it helps, we structure the work around a recognised reference such as the OWASP Mobile Application Security Verification Standard (MASVS) and the OWASP Mobile Application Security Testing Guide (MASTG), or around requirements your clients or auditors set.
Who it is for
Companies that publish their own mobile apps, or have them built by an agency, and want to know how the app and its backend hold up before a release, after a major change, or because clients, partners or frameworks such as ISO/IEC 27001, PCI DSS or SOC 2 ask for independent testing.
The work, from scoping to evidence.
What we do
iOS and Android apps
Native and cross-platform apps you own or have the right to have tested, on one platform or both, from a store build or a build you provide.
Data storage and privacy
What the app keeps on the device, where, and for how long, including credentials, tokens, personal data and logs.
Network communication
How the app talks to its servers and third-party services, and whether that traffic is protected the way you intend.
Authentication and sessions
Login, biometric and device-binding features, session handling and authorisation, checked both in the app and on the server side.
Backend and APIs
The APIs and services the app depends on, tested for access control, input handling and business logic, since most of what matters lives there.
Platform interaction and resilience
Permissions, links, inter-app communication and the protections you have built in against tampering and reverse engineering.
How the engagement runs
Kickoff and scoping
We agree the apps, versions, platforms, backend endpoints and test accounts, and what is out of bounds. An NDA can be signed before the first meeting.
Proposal and authorisation
A business proposal, then written authorisation from someone entitled to give it for the apps and every backend in scope, and rules of engagement: environments, test windows, contacts and how critical findings are handled.
Testing
We test the app and its backend within the agreed rules, preferably against a test or staging environment. Anything that cannot wait for the report is raised with you at once.
Results handover
A business report with a risk assessment and a technical report with reproducible findings and remediation advice, walked through with your developers and product owners.
Retest and closing
We verify your fixes in a new build and close the project with a feedback session. On request, a certificate of the engagement that anyone can verify on our site.
What you receive
- Agreed scope and rules of engagement
- Business report with risk assessment for management
- Technical report with findings, evidence and remediation advice for developers
- Prioritised recommendations covering app and backend
- Retest results for the fixed findings
- Optional certificate of successful engagement, verifiable at /verify
Questions
Do you test only the app, or the backend as well?
Both, unless you ask otherwise. Many of the findings that matter most sit in the APIs the app calls, so we recommend including them. If the backend belongs to a third party, we need their permission before it can be in scope.
What do you need from us?
Builds of the app for the platforms in scope, test accounts with the roles you want covered, the backend endpoints, and a contact on your side. Source code or design documents are optional and make the test more thorough.
Can you test against production?
We prefer a test or staging environment that matches production. If only production is available, we agree limits in the rules of engagement and discuss the remaining risk with you before we start.
Is the certificate a compliance certification?
No. It is a record that the engagement took place and was completed, which anyone can check on our site. It does not certify the app against any standard or law.
Related services
- Offensive securityPenetration TestingPenetration testing by Black Fox Security: black, grey and white box tests against an agreed scope, business and technical reports, and a retest of your fixes.
- Advisory and responseDevSecOps and secure developmentDevSecOps from Black Fox Security: secure SDLC, threat modelling, code review, security in CI/CD, dependency and secret scanning, and developer training.
- Managed securityVulnerability managementRecurring vulnerability reviews from Black Fox Security: scanning, triage, prioritisation by exploitability and exposure, fix tracking and trend reporting.
- Managed securitySecurity hardeningSecurity hardening by Black Fox Security: endpoint, server and network hardening, secure configuration baselines, monitoring setup and personal security.
Tell us which app you want tested
Send us the app, the platforms and what worries you about it. We will come back with a scope and a proposal.