Penetration Testing
Mobile Penetration Testing for iOS and Android Apps
Mobile penetration testing (mobile application penetration testing) is a manual security test of your iOS or Android app, its on-device storage, its network traffic and the APIs behind it, carried out to the OWASP MASVS and MASTG. We are a PCI SSC-approved QSA company, so the report doubles as PCI DSS and ISO 27001 evidence.
Prefer to talk? Call +44 161 523 5276
- iOS and Android
- OWASP MASVS and MASTG
- Retest of remediated findings available
Trusted by banks, payment providers and global brands
On this page
- Mobile app security testing: what's included
- What we test for
- Mobile app penetration testing at a glance
- iOS app penetration testing
- Android app penetration testing
- How long does a mobile app penetration test take?
- How much does mobile app penetration testing cost?
- Mobile app security testing vs a mobile penetration test
- How is a mobile app penetration test carried out?
- Why choose Sovereign Secure for mobile penetration testing?
- Frequently asked questions
Overview
What is mobile application penetration testing?
The short answer
Mobile penetration testing is a manual security test of an iOS or Android app and the services behind it. A tester analyses the app package, runs the app on real devices and tests its on-device storage, network traffic, authentication, platform controls and back-end APIs against the OWASP MASVS and MASTG.
Mobile application penetration testing is a detailed examination of an iOS or Android app to find security weaknesses before an attacker does. We use both static analysis of the app package and dynamic analysis of the running app to examine code, configuration, runtime behaviour and the way it communicates with back-end systems.
Mobile apps have their own risks: data left unprotected on the device, weak transport security, secrets baked into the binary, and logic that can be reverse-engineered or tampered with. We test all of these, on rooted and jailbroken devices where needed, following the OWASP Mobile Application Security framework.
iOS and Android fail in different ways, so we adapt the tests to each platform, as the iOS and Android sections below explain. We can test one platform or both in the same engagement.
Because the app is only as secure as the services behind it, we test the APIs it consumes where they are in scope, and our API security checklist lists the back-end controls your developers can check between tests. Apps that take payments or handle card data fall under PCI DSS penetration testing requirements, and we write findings up to support that and your ISO 27001 evidence. New to testing? Our guides to what penetration testing is and the types of penetration testing show where this test fits.
What's included
Mobile app security testing: what's included
Every mobile engagement covers the app, the device and the back end.
- 01
Static analysis
Examination of the app package, code and configuration for hardcoded secrets, insecure settings and weak controls.
- 02
Dynamic analysis
Testing the running app on device to observe its runtime behaviour, storage and network traffic.
- 03
Local storage review
Checks for sensitive data stored insecurely in databases, preferences, keychains and files.
- 04
Transport security testing
Assessment of TLS use, certificate validation and resistance to interception.
- 05
Authentication and session testing
Login, token handling, biometric and session controls tested for the flaws that lead to account takeover.
- 06
Resistance to reverse engineering
Assessment of code protection, root and jailbreak detection, and anti-tampering controls.
- 07
Back-end API testing
The APIs the app relies on, tested alongside the client where they fall in scope.
- 08
Retest
A retest of remediated findings, scoped in your fixed-price proposal, with the report updated to show them closed.
What we test for
What we test for
Coverage follows the OWASP MASVS and Mobile Application Security Testing Guide, with platform-specific checks for iOS and Android.
iOS platform checks
Checks specific to how iPhone and iPad apps store data and talk to other apps.
- Keychain and data protection classes
- App Transport Security exceptions
- URL schemes and universal links
- Jailbreak detection and binary protections
- Sensitive data in snapshots, caches and logs
Android platform checks
Checks specific to Android’s component model and storage.
- Exported activities, services and content providers
- Intent handling and deep links
- Android Keystore use
- Network security configuration and cleartext traffic
- Root detection and WebView settings
Insecure data storage
Sensitive information left on the device without adequate protection.
- Unencrypted local databases
- Insecure use of shared preferences or keychain
- Plaintext data in files or logs
- Weak encryption implementation
- Sensitive data exposed in device backups
Insecure communication
Data in transit that can be intercepted or manipulated.
- Missing or weak TLS encryption
- Improper certificate validation
- No certificate pinning where warranted
- API keys or tokens exposed in requests
- Session tokens sent insecurely
Authentication and session handling
Weak identity controls that let an attacker take over accounts.
- Weak or bypassable authentication
- Insecure token storage and handling
- Flawed biometric or PIN implementation
- Poor session lifecycle management
- Insecure password reset flows
Platform misuse and permissions
Incorrect use of operating-system features that leads to data leaks or privilege issues.
- Excessive or unnecessary permissions
- Insecure inter-app communication and intents
- Weak app sandboxing
- Exported components left unprotected
- Insecure use of platform APIs
Code tampering and reverse engineering
Logic and secrets exposed in the app binary that an attacker can read or modify.
- Lack of code obfuscation
- Hardcoded credentials or API keys
- Debuggable builds in production
- Missing root or jailbreak detection
- Weak anti-tampering controls
Third-party components
Risks introduced by libraries, SDKs and dependencies bundled into the app.
- Outdated or vulnerable libraries
- Insecure third-party SDK configurations
- Excessive data collection by SDKs
- Untrusted or unverified dependencies
- Known CVEs in bundled components
Mobile app penetration testing at a glance
Mobile app pentesting services vary widely in what they include, from an automated scan of the app package to weeks of manual testing on devices. The table shows what a typical scoped test covers, so you can compare proposals like for like.
| Aspect | Typical mobile app penetration test |
|---|---|
| Scope | One app on iOS, Android or both, every user role you provide and, where in scope, the API behind it |
| Approach | Grey box: a test build, test accounts for each role and some documentation, with static analysis of the package and dynamic testing on real devices, rooted or jailbroken where needed |
| Typical duration | Around one to two weeks for a single-platform app; longer for both platforms or a large back end |
| Published UK prices | From £1,650 in the published prices from UK providers we reviewed in September 2026, which at the £1,000 to £1,500 day rates in the same sample buys roughly one to one and a half tester-days; scoped tests of larger apps cost more |
| Standards | OWASP MASVS and MASTG, reported for PCI DSS 11.4 and ISO 27001 Annex A 8.8 and 8.29 |
| Deliverables | Executive summary, findings with reproduction steps and CVSS ratings, a MASVS coverage record, remediation advice and a debrief call |
iOS app penetration testing
iOS application penetration testing starts with the IPA file. We unpack it and inspect the binary and its Info.plist for hardcoded secrets, App Transport Security (ATS) exceptions that allow weak or unencrypted connections, debug settings, and the URL schemes and universal links the app registers.
On a jailbroken test device we then examine what the app leaves behind: Keychain items and their accessibility settings, files and their data protection classes, caches, background snapshots and logs. We test whether jailbreak detection, certificate pinning and other runtime protections can be bypassed, and what an attacker gains if they can. Traffic between the app and its back end is intercepted and tested in the same way as an API penetration test.
Android app penetration testing
Android application penetration testing starts with the APK or app bundle. We decompile it to review the manifest and code, looking for exported activities, services, broadcast receivers and content providers that other apps can call, unsafe intent handling and deep links, debuggable or backup flags, and secrets left in the code or resources.
On a rooted test device, Android penetration testing then checks how the app uses the Android Keystore, what it writes to shared preferences, databases and external storage, and whether its network security configuration allows cleartext traffic or user-added certificates. We test root detection, tamper checks and certificate pinning for bypasses, and review WebView settings that could expose the app to injected content.
How long does a mobile app penetration test take?
A typical single-platform app takes around one to two weeks, depending on its size and complexity. Testing both platforms or a large back end takes longer. These are the drivers:
| Driver | Effect on duration |
|---|---|
| Platforms | iOS and Android each need their own static analysis and on-device testing |
| Features and roles | Payments, messaging, file upload and admin functions each add test cases, and each role is tested against the others |
| Back-end API in scope | The API behind the app adds testing time; a large API may suit a separate API penetration test |
| Runtime protections | Certificate pinning, obfuscation and root or jailbreak detection must be bypassed before deeper testing can start |
| Build and access | A test build, test accounts for each role and a non-production back end let testing start straight away |
We confirm the timeline in your proposal.
How much does mobile app penetration testing cost?
In the published prices from UK providers we reviewed in September 2026, mobile app penetration tests started from £1,650. As with other tests, the price follows the number of tester-days your app needs, and these drivers set that number:
| Cost driver | Why it changes the price |
|---|---|
| iOS, Android or both | Each platform needs its own static analysis and on-device testing, so two platforms cost more than one |
| Features and user roles | Payments, messaging, file upload and admin functions add test cases, and each role is tested against the others |
| Back-end API in scope | Testing the API the app calls adds days; a large API may be scoped as a separate API penetration test |
| Runtime protections | Certificate pinning, obfuscation and root or jailbreak detection take time to bypass before deeper testing can start |
| Test environment and data | A non-production back end with realistic data lets testers try risky actions safely; production-only testing needs more care and time |
These figures are a small sample of published market prices, not Sovereign Secure prices. Our penetration testing cost guide compares every test type, and the mobile app penetration testing quote form turns your scope into a proposal.
Mobile app security testing vs a mobile penetration test
Mobile app security testing is the wider discipline: automated scanning of the app package, security checks in your build pipeline and developer review against a checklist. A mobile penetration test is the manual part, where a tester attacks the running app and its back end on real devices, bypasses its protections and proves what an attacker could reach.
Both have a place. Automated checks catch known-bad settings on every build; a penetration test finds the logic and authorisation flaws they miss and gives auditors independent evidence. Our mobile app security testing checklist lists what your developers can check between tests.
How it works
How is a mobile app penetration test carried out?
- 1
Scoping
We agree the app, the platforms, the test build, the roles and the back end in scope, and fix the price.
- 2
Static analysis
We examine the app package, code and configuration for insecure storage, secrets and weak controls.
- 3
Dynamic testing
We test the running app on device, observing storage, traffic and runtime behaviour, and exercise the APIs it calls.
- 4
Reporting
An executive summary and technical report with reproduction steps, CVSS ratings and remediation advice.
- 5
Debrief
A walkthrough with your team covering the findings, the risk and the fixes.
- 6
Retest
Once remediated, we retest and reissue the report showing findings closed.
Every test follows the five stages of penetration testing: planning and reconnaissance, scanning, gaining access, maintaining access, and analysis and reporting.
Why Sovereign Secure
Why choose Sovereign Secure for mobile penetration testing?
Established in 2012, we deliver PCI, ISO and Cyber Essentials work for banks, payment processors, card manufacturers and fast-growing companies.
Read client testimonials →- Testing aligned to the OWASP MASVS and MASTG, the recognised standard for mobile security.
- Static and dynamic analysis on device, plus the back-end APIs the app depends on.
- Reporting written for your compliance evidence by a QSA company.
- Fixed scope and price, with any retest and its window agreed in your proposal.
FAQ
Frequently asked questions
Can't find your answer? Call us on +44 161 523 5276 or send us a message.
Do you test both iOS and Android?
Yes. We test both platforms and adapt the methodology to each, since their storage, permission and code-protection models differ. We can test one or both in the same engagement.
What do you need from us for a mobile app penetration test?
A test build of the app (an IPA or APK, or access via TestFlight or an internal track), test accounts for each role, and details of the back-end environment. If certificate pinning is in place, guidance on any test configuration helps.
Do you test on real devices?
Yes. We test on physical devices, including rooted and jailbroken devices where needed, to exercise storage, runtime behaviour and platform controls that emulators cannot fully reproduce.
Does the API behind the app get tested too?
The APIs the app relies on are usually critical to its security, so we test them where they are in scope. For a larger back end we often recommend a dedicated API penetration test.
What is the OWASP MASVS?
The OWASP Mobile Application Security Verification Standard (MASVS) sets out what a secure mobile app should do, grouped into control areas such as storage, cryptography, authentication, network communication, platform interaction, code quality, resilience and privacy. Its companion, the Mobile Application Security Testing Guide (MASTG), explains how to test each control, and we test to both.
What are the types of mobile app penetration testing?
There are three, and a thorough test combines them: static analysis of the app package and code without running it, dynamic analysis of the running app on a real device, and testing of the back-end API the app talks to. Static analysis finds secrets and insecure settings in the build, dynamic analysis shows what the app actually stores and sends, and API testing shows whether one user can reach another user’s data.
Is an automated mobile app scan enough?
No. Automated mobile scanners are useful for spotting known-bad settings in the app package, but they cannot bypass certificate pinning, abuse business logic or prove that one user can reach another user’s data through the API. A manual test does, and it is what PCI DSS and ISO 27001 auditors expect to see.
Does mobile app testing support PCI DSS and ISO 27001?
Yes. Mobile apps that handle cardholder data fall under PCI DSS 11.4, and mobile testing supports ISO 27001:2022 Annex A 8.8 and 8.29. As a QSA company we write the report so it serves as evidence.
Last reviewed October 2026 by the Sovereign Secure assessment team.
Related services
- API penetration testingAPI penetration testing services for REST, GraphQL and SOAP web services, tested against the OWASP API Security Top 10 by a PCI QSA company. Get a quote.
- Web application testingWeb application penetration testing in the UK: manual OWASP Top 10, access-control and business logic testing by a PCI QSA company. Get a quote.
- PCI DSS penetration testingPCI compliance penetration testing to PCI DSS Requirement 11.4 by a QSA company: internal, external, application and segmentation pen tests with ROC-ready reports.
- Penetration testing costPen test cost in the UK for 2026: published day rates and penetration testing price ranges by test type, what drives cost, and how to get a fixed quote.
- Penetration testing quoteScope your test types and asset counts and get a fixed-price penetration testing proposal.
Free consultation
Talk to an assessor
We aim to reply within one working day, and send a fixed quote once your scope is confirmed.
- PCI SSC-approved QSA, QPA, CPSA, P2PE and 3DS assessors
- IASME-licensed Cyber Essentials certification body
- Clients across the UK, US, Europe, Middle East and Asia since 2012
“The Cyber Security Services were delivered on time and price was competitive.”
Call +44 161 523 5276
Email [email protected]