Stay up to date

Stay up to date

Mobile Application Security

Mobile Application Security Testing, A Must Do

Picture of Roxane Suau
By Roxane Suau on October, 19 2017

Every month, thousands of mobile applications are released and the amount of apps available on stores is currently estimated to be over 4 millions. In a recent study, the Ponemon institute identified that 60% of IT security leaders reported a data breach caused by an insecure mobile app, meanwhile only 29% of mobile applications are being tested for vulnerabilities.



1. Unwanted / unexpected behaviors

Usually, such flaws come along with third-party librairies. Libraries are designed for specific services (payment, analytics…) and embedded into applications. As they come from external companies, developers don’t have the hand over their source code. Very often, these libraries silently perform unnecessary actions (such as connections to unknown servers) and leak data.

2. Vulnerabilities

Coming from either the source code of the app itself or from a library, a mobile app can possibly feature one or several vulnerabilities. The OWASP community references the Top 10 mobile vulnerabilities as part of its Mobile Security Testing Guide. In total, there are hundreds of them potentially making apps vulnerable to attacks.

The various data protection regulations across the world (GDPR, PIPEDA, FTC Act…) advise companies to use all means available in order to protect data. Whether they develop apps for their employees, partners or end-users, companies must test the security levels of the apps they release to prevent them from data leakage and security breach. There are different solutions on the market to test mobile applications security at any stage of the development cycle.




  • SDLC integration & Ready-to-use platform: Whether a company wants to test an app along its development cycle or after it’s been developed, it’s convenient to use a solution that allows doing both. Having the choice between a ready-to-use platform and an API that integrates into SDLC (System Development Life Cycle) will offer more flexibility and adapt to companies evolving needs.
  • Customizable security levels: Because applications deal with data of different levels of sensitivity depending on the service they offer, they require to be tested accordingly. A testing solution that allows customizing security levels will provide a precise answer to the security needs.
  • One tool for every environment: Most of the time, applications have Android and iOS versions. It’s better to centralize the testing of all these apps using only one solution, compliant with every OS.



  • Static and dynamic behavioral analyses: An application could look safe just by looking at its code, but performs malicious actions once executed. To get a complete assessment and no false positive, both static and dynamic analyses have to be performed.
  • Vulnerabilities identification: In our last report, we identified that 57% applications were embedding one or more vulnerabilities, including the most popular ones. Pointing them out during the testing process is required to reinforce security.



  • The remediation phase occurs once an app has been tested and its points of failure have been identified. More than just providing a list of vulnerabilities and suspicious behaviors, some solutions offer in-depth advices on how to remediate apps and even provide an automatic remediation procedure. Adopting a solution that delivers this service will ease corrective actions process.



Discover Pradeo's Mobile Application Security Testing solution


Get in touch with mobile security experts

Contact us