MAST (Mobile Application Security Testing)

MAST (Mobile Application Security Testing) is the discipline of testing iOS and Android applications for security vulnerabilities across the full mobile attack surface: the compiled binary artifact, runtime device behavior, backend API communication, and post-release distribution.

MAST is distinct from general application security testing because mobile apps run on devices you do not control, link third-party SDKs you did not write, and ship as a compiled binary that anyone can download and analyze. The attack surface differs structurally from that of web applications, and so do the testing requirements.

What does MAST stand for?

MAST stands for Mobile Application Security Testing. The acronym describes the category of security testing disciplines applied specifically to iOS and Android mobile applications. This is distinct from web application security testing, backend API testing, or infrastructure security testing.

The OWASP Mobile Application Security Verification Standard (MASVS) and the OWASP Mobile Top 10 2024 are the primary frameworks that define what MAST programs test against.

What does MAST cover?

MAST combines four testing layers, each addressing a different part of the mobile attack surface.

Binary static analysis (SAST)

Examines the compiled .apk (Android) or .ipa (iOS) artifact without executing it. Tests binary hardening properties: whether android:debuggable is disabled, whether android:allowBackup is false, whether code obfuscation is applied effectively, as well as third-party SDK vulnerabilities and build configuration misconfigurations.

Source code access is not required for binary SAST.

Dynamic analysis (DAST)

DAST tests the running application on real devices or emulators with authenticated sessions. It identifies runtime vulnerabilities, such as certificate pinning failures, insecure session handling, cleartext transmission, and API authentication weaknesses that only manifest when the app is executing.

Real-device DAST produces more accurate results than emulator-based testing for hardware-dependent behaviors.

API security testing

It tests the backend endpoints the mobile app communicates with for authentication gaps, authorization bypass, and data exposure. Mobile apps frequently call API endpoints that are not documented or tested alongside web app testing programs, making mobile-specific API security testing a distinct requirement.

Post-release monitoring

This tests the distribution surface after the app ships and helps identify fake apps, phishing clones, unauthorized repackaged binaries, and orphaned app versions with known vulnerabilities that persist on app stores after a new release.

How is MAST different from web application security testing?

Web application security testing focuses on server-side code, browser behavior, and HTTP-level interactions. MAST focuses on compiled mobile binaries, device execution environments, and mobile-specific attack patterns applicable to iOS and Android apps.

Three specific differences define MAST's scope:

The compiled binary is the test artifact

Web apps execute on servers you control. Mobile apps run on devices you do not control, as compiled binary files that anyone can download and reverse-engineer. MAST tests the artifact itself, not the server-side code.

Third-party SDKs are part of the attack surface

Mobile apps embed analytics, payment, authentication, and advertising SDKs as compiled libraries. Those SDKs may carry vulnerabilities, collect data without disclosure, or expose the app to supply chain risk. MAST audits these components as part of the binary.

The device is part of the threat model

Data stored on the device, credentials in the keychain or secure enclave, and IPC between apps are mobile-specific security controls that have no equivalent in web application testing. MAST tests these controls on real hardware.

MAST and OWASP Mobile Top 10 2024

The OWASP Mobile Top 10 2024 defines the ten most critical mobile application security risks. MAST programs test apps against all ten:

• M1: Improper Credential Usage
• M2: Inadequate Supply Chain Security
• M3: Insecure Authentication / Authorization
• M4: Insufficient Input / Output Validation
• M5: Insecure Communication
• M6: Inadequate Privacy Controls
• M7: Insufficient Binary Protections
• M8: Security Misconfiguration
• M9: Insecure Data Storage
• M10: Insufficient Cryptography

OWASP MASVS (Mobile Application Security Verification Standard) provides detailed technical requirements for each risk category and defines verification levels (L1 and L2) for use as evidence of compliance.

Where Appknox fits

Appknox is an enterprise MAST platform that combines binary SAST, AI-led automated DAST on real iOS and Android devices, and mobile API security testing in a single CI/CD-integrated platform.

Key capabilities:

• Binary SAST and AI-led automated DAST on real physical devices. Source code is not required.
• Integrated manual penetration testing by certified security researchers for business-logic flaws that automated tools cannot find
• Storeknox for post-release app store monitoring
• KnoxIQ for AI-powered exploitability validation, reducing false positives to below 1%
• Compliance mapping to OWASP MASVS, OWASP Mobile Top 10 2024, PCI-DSS, HIPAA, GDPR, SAMA, MAS TRM, RBI, and CBN
• SBOM is generated from the binary for every release

 See the full testing methodology: Appknox Automated Vulnerability Assessment. 

Frequently asked questions

What is MAST in cybersecurity?

MAST (Mobile Application Security Testing) is the category of security testing applied to iOS and Android mobile applications. It covers binary static analysis, real-device dynamic analysis, API security testing, and post-release monitoring. It tests the compiled artifact and runtime behavior, not source code alone.

Is MAST the same as mobile app penetration testing?

No. Penetration testing is a manual, expert-led assessment of specific attack paths in a mobile app. MAST is the broader discipline that includes automated binary scanning, dynamic testing, and API security testing alongside manual penetration testing. Penetration testing is one component of a MAST program, not the full scope.

What is the difference between MAST and SAST?

SAST (Static Application Security Testing) analyzes source code for vulnerability patterns before compilation. MAST is broader: it includes binary analysis of the compiled artifact without requiring source code, dynamic testing of the running app on real devices, and API security testing. A source code SAST tool covers one layer of the mobile attack surface. A MAST platform covers all layers.

What frameworks do MAST tools test against?

The primary frameworks for mobile app security testing are the OWASP Mobile Top 10 2024 and OWASP MASVS (Mobile Application Security Verification Standard). Enterprise MAST platforms also map to PCI-DSS, HIPAA, GDPR, and regional frameworks, including SAMA, MAS TRM, RBI, and CBN.

Does MAST require source code access?

No. Binary SAST, the primary MAST testing method, analyzes the compiled .apk or .ipa artifact without requiring source code. This makes MAST the appropriate testing approach for third-party, contractor-built, and vendor-provided apps when source code is not available.

Related: What is Penetration Testing? | What is Binary-Based SAST? | Appknox vs Code-Centric SAST Tools

By Aadarsh Anand, Security Researcher, Appknox Security Research Team

Appknox is an enterprise mobile application security testing platform. This page was written by Appknox's security research team based on direct experience conducting mobile application security testing across iOS and Android portfolios for financial services, healthcare, and enterprise organizations, using binary SAST, real-device DAST, and OWASP MASVS compliance mapping.

This page was drafted with AI assistance and reviewed and verified by the Appknox security research team.