Mobile app penetration testing companies

Mobile application penetration testing companies describe the same service in very different words. Some name iOS and Android, some say "mobile" once in a list. The table lists providers whose own pages state mobile testing, in A to Z order with no ranking. Each row shows the facts we could source, and "Not published" where a provider says nothing. Facts were checked on 9 November 2026.

What does mobile app penetration testing cover?#

A mobile app penetration test examines the app on the device and the backend it talks to. Testers install a build, inspect local storage, intercept traffic, and try to read or change data they should not reach. The OWASP Mobile Application Security Verification Standard (MASVS) is the usual checklist. It groups app controls into eight areas: storage, cryptography, authentication and authorization, network communication, platform interaction, code quality, resilience against reverse engineering and tampering, and privacy.

The OWASP Mobile Application Security Testing Guide (MASTG) holds the test procedures for Android and iOS. A provider that cites MASVS areas in its reports lets you check coverage against a public list. The method itself is on the service sites. See web application penetration testing for the web side of the same job.

Who needs a mobile app pentest, and when?#

You need one when an app holds user data on the device, handles payments or sessions, or is the main way customers reach your service. Common triggers are a first store release, a new login method, a change to how the app stores tokens, and a customer security review.

A scan of the store listing or the binary does not replace a test. Authorization flaws live in the backend, so a test that stops at the app misses them. Pair the app test with an API penetration test or confirm the quote covers both.

What should you ask mobile pentest providers?#

Ask for these answers in writing before you sign. Each one should become a sentence in the scope document.

Our guide questions to ask a pentest provider has the longer list.

What drives the price of a mobile app pentest?#

Price follows the number of platforms, the size of the app, the number of roles, the depth of runtime testing, whether the backend API is included, and the retest terms. Many providers quote after scoping. Some publish a unit price. Securitum, for example, lists 640 EUR to 890 EUR per man day on its pricing page, with the rate set by project length, team size and delivery mode.

The "Published price" column shows a figure only where a provider lists one, so a blank price is a missing fact and not a low price. See penetration testing cost for the ranges we sourced.

How do you read the table?#

Providers appear in the table when their own pages state mobile testing. The Web, API, Cloud and AI apps columns show "yes" only where the provider names that scope, and "unknown" means the pages we read did not say. The Sample report column says whether a report is public, on request or not published. Click a provider name for its sources and check date. Read how we compare for the rules.

The table does not split iOS from Android. Ask each provider directly, and compare the answer with the platforms you ship.

Which scoping mistakes cause rework?#

Three mistakes cause most change requests. Teams send a production build with pinning on and ask for a runtime test. Teams list the app but forget the backend. Teams give one test account when the app has several roles.

Compare other service pages in the directory when your app also exposes a cloud back end.