License & Deployment Mix: 10 tools – 6 OSS (including the OWASP standard), 4 commercial.
Color: Red team / AppSec.
What Is This Category?
Mobile Application Security Testing covers the per-app security review for iOS and Android. Distinct from MTD (which protects mobile devices), MAST looks at a specific app: static analysis of the binary, dynamic instrumentation while the app runs, traffic inspection, and storage / permission auditing. The OWASP MASVS / MASTG standards define the testing methodology.
Distinct from neighbouring categories
- Mobile Threat Defense (MTD) – MTD protects the mobile device at runtime; MAST audits the app at build / test time
- Code Quality / SAST / DAST – Code quality / SAST is source-language scanning; MAST is binary + runtime scanning of shipped APK / IPA
- Vulnerability Management – VM scans network assets; MAST scans installed mobile apps
The information on these pages was researched by a combination of human review and large language models. To suggest an addition or correction, please contact us. Prepared by Rhodium Systems Inc., author of the ResorsIT platform — a unified IT operations management platform for IT teams and MSPs that integrates a curated suite of open-source, commercial, and SaaS applications into a single system with shared identity, single sign-on, access control, and a common audit trail. Use this catalogue only as a starting point for your own research, and review any tool carefully against your own requirements before relying on it. Catalogue data version 2026.197.
Comparison
Overview
Mobile AppSec splits between methodology + OSS analyst tools (OWASP MASTG / MASVS standard + MobSF + Frida + Drozer + jadx + apktool) and commercial testing platforms (NowSecure, AppKnox, Zimperium zScan) plus a separate app shielding category (Verimatrix App Shield).
Capability Matrix
| Tool | Static | Dynamic | Network | MASVS-Mapped | CI/CD |
|---|---|---|---|---|---|
| MobSF | yes | yes | partial | partial | yes |
| Frida + Objection | – | yes (first-class) | – | – | – |
| Drozer | partial | yes (IPC) | – | – | – |
| jadx | yes (decomp) | – | – | – | – |
| apktool | yes (decode + rebuild) | – | – | – | – |
| OWASP MASTG/MASVS | n/a | n/a | n/a | yes (the standard) | – |
| NowSecure | yes | yes | yes | yes | yes |
| AppKnox | yes | yes | yes | yes | yes |
| Zimperium zScan | yes | yes | yes | yes | yes |
| Verimatrix App Shield | shielding (not testing) | runtime RASP | – | – | yes (build-pipeline) |
License Comparison
| Tool | License | OSI | Type |
|---|---|---|---|
| MobSF | GPL-3.0-only | yes | OSS platform |
| Frida + Objection | wxWindows | yes | OSS library + helper |
| Drozer | BSD-3-Clause | yes | OSS framework |
| jadx | Apache-2.0 | yes | OSS decompiler |
| apktool | Apache-2.0 | yes | OSS reverse-engineering |
| OWASP MASTG/MASVS | CC-BY-SA-4.0 | yes | OSS methodology / standard |
| NowSecure | Proprietary | – | Commercial SaaS + on-prem |
| AppKnox | Proprietary | – | Commercial SaaS |
| Zimperium zScan | Proprietary | – | Commercial SaaS |
| Verimatrix App Shield | Proprietary | – | Commercial SDK + SaaS |
Composition Patterns
1. OSS pentest engagement
OWASP MASVS -- scoping framework / control list
OWASP MASTG -- per-test procedure guide
MobSF -- automated static + dynamic platform
Frida + Objection -- in-process dynamic analysis
Drozer -- Android IPC surface enumeration
jadx + apktool -- decompile / rebuild Android APKs
+ Burp / mitmproxy -- traffic interceptionOutput: full mobile-pentest toolkit at zero license cost. A standard OSS engagement stack.
2. Customer-managed automated testing
NowSecure (or AppKnox / Zimperium zScan)
Output: automated CI / CD-integrated MASTG-aligned testing. For customers wanting continuous testing rather than one-shot pentest engagements.
3. High-value-app protection layer
Verimatrix App Shield -- code obfuscation + RASP for shipped binary
+ MASTG testing -- still test the app despite shieldingOutput: app-hardening + testing combined for banking / DRM / streaming apps where active runtime protection matters.
Tools
10 tools.
apktool
Connor Tumbleson’s reverse-engineering tool for Android APK files; decode resources, rebuild modified APKs, smali assembler / disassembler.
License: Apache-2.0 (OSS) · Kind: cli · Deploy: native, package · SSO: none
AppKnox
Indian commercial mobile-AppSec platform; automated static / dynamic / API testing; alternative to NowSecure for Indian / Asian markets.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC, SAML
Drozer
WithSecure Labs’s (formerly MWR Labs) Android security testing framework; explore Android IPC + permissions interactively.
License: BSD-3-Clause (OSS) · Kind: cli · Deploy: native, package · SSO: none
Frida + Objection
Ole Andre Vadla Ravnaas’s dynamic instrumentation framework + Sensepost’s Objection helper; the canonical OSS mobile / desktop dynamic-analysis toolkit.
License: wxWindows (OSS) · Kind: library · Deploy: native, package · SSO: none
jadx
skylot’s Java decompiler with first-class Android APK / dex support; the canonical OSS Android decompilation tool.
License: Apache-2.0 (OSS) · Kind: desktop · Deploy: native, package · SSO: none
MobSF
Open-source mobile app security framework; static and dynamic analysis of Android APK and iOS IPA / Windows AppX in one platform.
License: GPL-3.0-only (OSS) · Kind: web · Deploy: docker, native · SSO: OIDC
NowSecure
Commercial mobile-AppSec platform; automated MASTG-aligned testing of iOS / Android apps; long-standing market leader.
License: Proprietary (proprietary) · Kind: web · Deploy: saas, native · SSO: OIDC, SAML
OWASP MASTG / MASVS
OWASP Mobile Application Security Testing Guide + Verification Standard; the canonical mobile-AppSec testing methodology + verification framework.
License: CC-BY-SA-4.0 (OSS) · Kind: library · Deploy: native · SSO: none
Verimatrix App Shield
Verimatrix’s commercial mobile-app shielding + threat-detection platform; code obfuscation + RASP + threat analytics; premier-tier for high-value apps.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC, SAML
Zimperium zScan
Zimperium’s commercial mobile-AppSec platform; sibling to Zimperium MTD (see tools/mtd/zimperium.md); shared threat-intelligence corpus.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC, SAML
