Mobile Application Security Testing
Shipped to the App Store. Let's find the flaws before someone else does.
Manual security testing of your iOS and Android apps, covering client-side and server-side vulnerabilities, aligned to OWASP MASVS.
- CREST member company
- Consultant-led testing
- Transparent pricing
Our Pentest Methodology
What our mobile app testing includes
We assess your mobile application and the APIs it consumes, using the OWASP Mobile Application Security Verification Standard (MASVS) as a baseline and adding testing specific to your app's design.
01
Insecure Data Storage
Mobile applications frequently write sensitive data to accessible locations such as shared preferences, external storage, unprotected databases, or system logs. We identify what is persisted and whether it can be accessed by other applications or a physically compromised device.
02
Authentication & Session Management
We review how the application authenticates users and manages session state, including token storage, expiry enforcement, and behaviour after logout. We assess whether session material can be extracted or reused by an attacker.
03
Network Communication & Certificate Validation
We examine TLS handling including whether certificate validation is correctly enforced, whether certificate pinning is implemented and bypassable, and whether any traffic is transmitted over unprotected channels.
04
Cryptographic Implementation
We review algorithm selection, key generation, and storage practices. This includes assessing use of platform keystore APIs and identifying cases where cryptographic material is hardcoded or stored in recoverable locations.
05
Client-Side Logic & Trust Assumptions
We assess where the application makes trust decisions based on locally held state, device properties, or data returned from the server that could be manipulated by an attacker.
06
Dynamic & Static Analysis
Testing combines dynamic and static analysis with reverse engineering where possible, covering both runtime behaviour and code-level vulnerabilities.
Pricing
From £3,150
for mobile app penetration testing
Not sure where your application fits? A 30-minute scoping call is free and gets you a fixed written quote.
No obligation · Strictly confidential · Reply within one business day
Pricing Examples
| Basic mobile app Single platform, API included | £3,150 - £4,500 |
| Complex mobile app iOS or Android, more features and integrations, API included | £4,500 - £6,700 |
| Both platforms iOS and Android, API included | £6,700 - £10,500+ |
Indicative ranges only. Your exact price is confirmed after a short scoping conversation. See full service pricing.
Compare all our penetration testing services.
What's Included
- Fixed-price proposal agreed before testing starts
- Manual, consultant-led testing. Not automated scans
- Report within 2 business days, with an executive summary and technical findings mapped to OWASP MASVS
- Debrief call and Exploitr platform access at no extra cost
Ready to secure your mobile application?
Our team will review your application's scope and provide a tailored testing proposal that fits your timeline and budget.
Common Questions
Mobile application security testing: frequently asked questions
Mobile application testing starts from £3,150 for a single platform, and testing both iOS and Android typically costs £6,700 to £10,500+. The cost depends on the number of platforms, how many user roles the app supports and any API scope beyond what the app itself calls.
Our penetration testing pricing guide compares costs across every service.
Yes, we test applications on both platforms. Each has different security architectures and vulnerabilities, so we tailor our methodology accordingly. For iOS, there can be challenges with grey-box testing. Where codebases are identical between platforms, we often recommend testing on Android for simplicity and coverage.
We can test with just the compiled application file (.ipa for iOS, .apk for Android). However, source code access enables more thorough testing including static code analysis. We recommend white-box testing for applications handling sensitive data or financial transactions.
Yes. We test apps at any stage of development including beta versions, internal enterprise apps, and pre-release applications. You simply provide the installation file and we'll install it on our testing devices.
Yes, we test applications built with any framework including React Native, Flutter, Xamarin, Ionic, and Cordova. Cross-platform frameworks can introduce unique vulnerabilities, especially when bridging native and JavaScript code.