Seven tests that tell you whether a mobile app security product works
Feature lists all look alike. These seven tests take about a day, run on your own app, and separate protection that works from protection that is promised. Ask every vendor on your shortlist to pass them, including us.
Score every vendor on the same build, the same device and the same day. Agree in advance what “pass” means for each test so the results are not negotiated afterwards.
The tests are deliberately simple. If a vendor needs special conditions to pass them, that tells you something too.
Run all seven on your own build
Open each test to see how to run it and what a pass looks like.
Clone test: can a repackaged copy still run?
Repackaging is the most common real-world attack on consumer apps and the easiest to test.
Hooking test: does Frida attach and change behaviour?
Instrumentation is how fraud tooling bypasses biometrics, limits and device binding.
Performance test: what is the real impact?
Protection that product teams reject never ships. Measure before anyone argues.
Pipeline test: can it run unattended?
If protection needs a human in the loop, releases will drift unprotected.
Visibility test: what does the console show?
If you cannot see an attack, you cannot respond to it or prove to a regulator that you did.
Framework test: does it protect what you actually ship?
Hardening that only covers native code leaves Flutter and React Native logic exposed.
Sovereignty test: can it run where your regulator requires?
For banks and public bodies, where binaries and telemetry go is a compliance question, not a preference.
Assess your own app before you compare vendors
The tests tell you whether protection works. An IronSCAN assessment tells you what needs protecting in the first place, so you can judge every vendor against the real weaknesses in your build.
- Automated OWASP, CVE and CWE assessmentRun on your compiled build before release.
- Insecure storage and logging, weak pinning, exported componentsFindings mapped to OWASP, with remediation guidance.
- A baseline you can reuse in every vendor testRe-run after protection to see what changed.
Questions to ask before you choose
Beyond the seven tests, these are the commercial and operational questions that cause regret later.
- Who applies protection on each release: your developers, the vendor or the pipeline?
- Is assessment included, or do you still need a separate scanning tool?
- What is the response when a threat is detected, and who controls the policy?
- Can device-risk signals feed your fraud engine, SIEM or API gateway?
- Which platforms and frameworks are covered, including HarmonyOS if you ship there?
- Is pricing per app, per device or per download, and how does it scale?
- Where is the vendor’s support team, and in which time zone?
- Has the vendor worked with your regulator’s framework before?
More on evaluating vendors
Practical reading from the SecIron team before you build your shortlist.
Run the seven tests with us
Send us a build and, subject to scope and supported builds, we can harden it live, run the clone and hooking tests in front of you and show the results in IronSKY.
End-to-end mobile application security. Assess, harden and monitor Android and iOS apps with codeless integration.
Solutions
Resource
About Us
Â