Overview
UK banking, health and retail apps handle sensitive personal data on devices you don't control. We test the app and the APIs behind it against OWASP MASVS, which is useful evidence for your UK GDPR security obligations and app-store reviews.
Mobile apps run on devices you don't control. Anyone can download your app, decompile it, inspect what it stores, intercept its traffic and replay requests to your backend. A mobile penetration test measures how well your app and its APIs hold up under that scrutiny.
Our assessments combine static analysis of the app package, dynamic analysis on rooted and jailbroken test devices, and full testing of the backend APIs the app relies on — because once attackers understand your API, the app's client-side protections no longer matter.
Findings are mapped to the OWASP Mobile Application Security Verification Standard (MASVS v2), giving your iOS and Android developers platform-specific guidance they can act on.
How testing works for UK organisations
- Signed scope and written authorisation before any testing, in line with the Computer Misuse Act 1990
- Testing windows agreed in UK time, including out-of-hours windows for production systems
- Fully remote delivery, with internal and wireless access via VPN or a posted test device, so there are no travel costs
- Reports mapped to ISO 27001, PCI DSS, UK GDPR Article 32 and customer questionnaires, with a fixed price in GBP
What's included
Our approach
- Static analysisDecompilation and review of manifests, plists, binaries and embedded secrets.
- Dynamic analysisRuntime instrumentation on test devices to inspect storage and bypass controls.
- Traffic interceptionManipulating API calls to test authentication, authorisation and input handling.
- Business logicAbuse of in-app purchases, rewards, KYC and payment flows.
- Report & retestPlatform-specific fixes for iOS and Android teams, followed by verification.
What you receive
- Separate iOS and Android findings
- MASVS v2 control mapping
- Backend API findings
- Code-level remediation guidance
- Retest report and attestation letter
Standards & frameworks
- OWASP MASVS v2
- OWASP MASTG
- OWASP API Top 10
- CWE
- FCA / PSR expectations (where applicable)
- NCSC penetration testing guidance
Frequently asked questions
Do we need to test both platforms?
Usually yes. iOS and Android differ in storage, permissions and security features, and codebases often diverge even with cross-platform frameworks.
Can you test Flutter and React Native apps?
Yes. Cross-platform apps need some different reverse-engineering tooling, but MASVS controls and API testing apply in the same way.
What builds should we provide?
Ideally both a debuggable build (faster, deeper testing) and the release build (to assess real-world protections).
Are you CREST or CHECK accredited?
We don't claim CREST or NCSC CHECK status on this site. Most private-sector tests, including those for ISO 27001, PCI DSS and customer due diligence, don't require either. If a contract, public-sector buyer or regulator specifically requires a CHECK or CREST-accredited provider, tell us at scoping and we'll tell you honestly whether we can meet it. See our CREST and CHECK guide.
Do you quote in pounds sterling?
Yes. UK proposals are fixed-price and quoted in GBP. Prices exclude VAT where VAT applies to cross-border services. We confirm the treatment for your organisation in the proposal.