Expert service
Your app, tested on a real device.
We test the app on real devices as well as statically, including the API it talks to, against OWASP MASVS.
Why teams book this test
- Your app holds real data.Payments, health or identity on a phone you do not control. Prove it stays safe.
- A customer asked for it.Partners ask for an independent mobile test before they integrate with your app.
- An audit is coming.Reports your ISO 27001 or SOC 2 auditor can use as evidence.
What we test
- Local data storage and secrets in the package
- Certificate pinning and network security
- Authentication, session and biometric flows
- Deep links, intents and platform interaction
- Reverse engineering and tampering resistance
- The backend API the app calls
How an engagement runs
- ScopeA free 30-minute call. Targets, rules, dates.
- TestHands-on, to the agreed method.
- VerifyEvery finding confirmed with evidence.
- ReportImpact and a clear fix for each one.
- RetestWe check what you fixed.
Repeat every release or quarter, starting again from scope.
Why experts
What you receive
A human tests intent, chains attacks and signs the report as an independent third party. That is what the platform alone cannot give you.
- An executive summary written for leadership and customers
- Every finding with evidence, CVSS 3.1 score, impact and a fix your team can follow
- An independent third-party report. Reports your ISO 27001 or SOC 2 auditor can use as evidence.
- Retesting of fixed findings, agreed in the quote
- A walkthrough call with your team
The usual pentest, minus the usual pain.
Typical pentest firm
- PriceDay rates that grow with the job
- FindingsScanner output with your logo on it
- Follow-upBilled as a new engagement
- HandoverA PDF in your inbox
- Next yearStart again from zero
Cerberon experts
- PriceA fixed quote after a 30-minute call
- FindingsEvery finding backed by evidence, with what to fix
- Follow-upRetest or follow-up agreed in your quote
- HandoverA walkthrough call with your team
- Next yearKeep testing on your own server with the Cerberon platform
Questions about this service
Do you test both Android and iOS?
Yes. Each platform is scoped separately because the checks and builds differ.
Is dynamic testing included?
Yes. Unlike the platform's static checks, a service engagement runs the app on real devices and tests its traffic and runtime behaviour.
Tell us what you need tested.
A 30-minute scoping call, then a fixed quote.