Two platforms, two tests
Android and iOS are separate engagements. Different binary formats, different storage models, different platform security controls, different tooling, and frequently different codebases even when the product is presented as one app.
A quote for "mobile app penetration testing" that looks cheap relative to the market is frequently covering one platform. Ask which, and whether the second is priced additionally. This is the most common pricing surprise in mobile engagements and it is easily avoided by asking before signing.
Cross-platform frameworks such as React Native or Flutter share application code but still produce two binaries with two sets of platform-specific storage and transport behaviour, so they reduce the delta rather than removing it.
What gets tested on the device
| Area | What is examined |
|---|---|
| Local data storage | Credentials, tokens or PII written to device storage insecurely |
| Transport security | TLS validation, certificate pinning, fallback behaviour |
| Binary protections | Obfuscation, anti-tampering, root and jailbreak detection |
| Inter-process communication | Exported components, deep links, custom URL schemes |
| Cryptography | Key storage, algorithm choice, hardcoded secrets |
| Session handling | Token lifetime, logout behaviour, background state |
Hardcoded secrets in the binary remain remarkably common. API keys, credentials and endpoints extracted from a decompiled app are a recurring first finding, and they are trivially recoverable — the binary is on the attacker's device by definition.
Most of the risk is in the API
The uncomfortable truth about mobile testing: a large share of the serious findings are not on the device at all, they are in the API the app talks to.
The mobile client is fully under the attacker's control. They can decompile it, hook it, intercept its traffic and replay its requests with anything they choose. Every control implemented only in the app is advisory. What actually protects data is server-side authorisation.
Which means a mobile engagement that does not include API testing is testing the least defensible half. Confirm the API is in scope — a mobile test that stops at the binary is missing where the real exposure lives.
How it is scoped and priced
By platform, then by the complexity of the app and its API surface. Practical inputs: builds for each platform, test accounts covering each user role, whether jailbroken or rooted devices are permitted in scope, and whether the backing API is included.
US pricing sits broadly in line with web application testing per platform. In the Indian market it is generally quoted inside a wider VAPT scope — see Indian VAPT pricing and penetration testing cost.
FAQs
Are Android and iOS penetration tests separate?
Yes. Different binary formats, storage models, platform controls and tooling mean they are two engagements. A mobile testing quote that looks cheap relative to the market frequently covers one platform, so confirm which and whether the second is priced separately before signing.
Does a cross-platform framework mean only one test?
No. React Native and Flutter share application code but still produce two binaries with platform-specific storage and transport behaviour, so both still need testing. The framework reduces the difference between the two engagements rather than removing the need for one of them.
What does mobile app penetration testing find?
On the device: insecure local storage of credentials or PII, transport and certificate validation weaknesses, missing binary protections, exposed inter-process components and deep links, weak cryptography and hardcoded secrets, and session handling flaws. Hardcoded API keys in a decompiled binary remain a very common first finding.
Should API testing be included in a mobile pentest?
Yes, and a mobile engagement without it tests the least defensible half. The mobile client is entirely under the attacker's control — it can be decompiled, hooked and its traffic replayed — so every control implemented only in the app is advisory. Server-side authorisation is what actually protects data.
How is mobile penetration testing priced?
Per platform, then by app complexity and API surface. US pricing sits broadly in line with web application testing for each platform. Indian providers usually quote it inside a wider VAPT scope, which is part of why VAPT quotes vary so widely.
Where to go next
See API penetration testing, our services, or what testing costs.