OWASP MASVS

MASVS, the Mobile Application Security Verification Standard, is OWASP's framework of security requirements for mobile apps. While the OWASP Mobile Top 10 ranks which risks matter most, MASVS defines the specific, testable controls an app needs to address those risks. The current version, MASVS v2.1.0, organizes those controls into 8 categories.

MASVS is free, vendor-neutral, and maintained by the OWASP Mobile Application Security (MAS) project under a Creative Commons license. No vendor pays for placement, and no tool automatically makes an app "MASVS compliant": MASVS defines what to verify, not which product verifies it.

What does MASVS stand for?

MASVS stands for Mobile Application Security Verification Standard. It began as a mobile-specific fork of ASVS, OWASP's Application Security Verification Standard for web and API applications, adapted for realities that don't exist on the web:

• A compiled binary distributed through an app store,
• On-device data storage, and
• A runtime environment the developer doesn't control.

Why MASVS matters

A risk list tells a team where to look. It doesn't tell two different auditors what "secure" means in a way they'd agree on. That's the gap MASVS closes.

"The app should be secure" isn't a testable requirement. "The app implements MASVS-STORAGE-1" is.

MASVS gives procurement teams, auditors, and engineering a shared, versioned reference instead of a subjective judgment call. When a pentest report ties a finding to a MASVS control, that's a specific implementation gap measured against a published standard, not one tester's opinion of what feels risky.

The 8 MASVS categories (v2.1.0)

MASVS-STORAGE

MASVS-STORAGE checks whether sensitive data at rest on the device, such as credentials, tokens, or personal data, is protected against unauthorized access. This category was simplified the most in the v2.0 refactor, down to a small, focused set of controls.

MASVS-CRYPTO

MASVS-CRYPTO verifies whether the app uses appropriate cryptographic primitives and key management, and avoids deprecated algorithms or custom-rolled encryption.

MASVS-AUTH

MASVS-AUTH checks for authentication and session management: how the app verifies identity and maintains a session, both against its own backend and against the device's local authentication mechanisms, such as biometrics and PIN.

For a full breakdown of this category alone, token management, MFA, and platform-specific implementation on iOS and Android,

Read: Mobile App Auth Security: MASVS-AUTH Guide.

MASVS-NETWORK

MASVS-NETWORK looks for whether data in transit is encrypted and whether the app validates the server it's talking to: TLS configuration, certificate validation, and resistance to interception.

MASVS-PLATFORM

MASVS-PLATFORM helps detect how the app interacts with the underlying OS, including permission requests, interprocess communication, WebViews, and platform-provided storage mechanisms.

MASVS-CODE

MASVS-CODE checks for code-level quality and build configuration:

• Whether release builds strip debug symbols,
• Whether the app avoids known-insecure coding patterns, and
• Whether third-party components stay current.

MASVS-RESILIENCE

MASVS-RESILIENCE verifies whether the app resists reverse engineering and tampering, including obfuscation, anti-debugging, root and jailbreak detection, and integrity checks.

Unlike the other categories, resilience controls are typically scoped in only for apps handling high-value data or facing a sophisticated threat model, not applied universally.

MASVS-PRIVACY

MASVS-PRIVACY is the newest category, added in v2.1.0 in January 2024. It covers whether the app gives users control over their own data and limits collection to what it discloses, the same regulatory pressure, GDPR, CCPA, that pushed Inadequate Privacy Controls onto the OWASP Mobile Top 10 the same year.

24 controls in total are spread across these 8 categories, each with its own ID (MASVS-STORAGE-1, MASVS-AUTH-2, and so on) that a test case or audit finding can point to directly.

Want a working checklist for all 8 categories, prioritized by risk and effort?

See:The Ultimate MASVS Compliance Checklist for Security Teams.

What changed in the MASVS v2 refactor

MASVS underwent its most significant structural change in April 2023 with version 2.0.0.

Before v2.0.0, MASVS organized its requirements into eight numbered sections, V1 through V8: Architecture and Threat Modeling, Data Storage and Privacy, Cryptography, Authentication and Session Management, Network Communication, Platform Interaction, Code Quality and Build Settings, and Resilience Against Reverse Engineering.

It also defined three verification levels directly inside the standard:

• L1 as a baseline for every app,
• L2 for defense-in-depth in apps handling sensitive data, and
• R as an additional layer for apps facing reverse-engineering risk.

Version 2.0.0 removed those verification levels from MASVS itself. In their place, MASTG, the companion testing guide, now defines three security testing profiles, MAS-L1, MAS-L2, and MAS-R, that determine which MASVS controls are in scope for a given app. MASVS became a leaner set of abstract security controls. Deciding how much of it applies to any one app is now MASTG's job, not MASVS's.

Version 2.1.0, released in January 2024, added MASVS-PRIVACY as an eighth category, bringing the standard to its current form.

The practical effect: a pentest report, RFP, or vendor datasheet that talks about "MASVS L1" or "MASVS L2" as if those levels live inside MASVS itself is describing the standard as it existed before April 2023. In the current version, that scoping decision is made in MASTG.

MASVS vs. MASTG vs. MASWE

These three make up the OWASP MAS (Mobile Application Security) project, and each answers a different question.

MASVS is the standard: the security controls above, 8 categories and 24 controls, each with a testable ID.

MASTG, the Mobile Application Security Testing Guide, is the how: a manual with specific test cases, one or more per MASVS control, describing exactly how to verify each requirement on iOS and Android.
MASTG is also where the MAS-L1, MAS-L2, and MAS-R testing profiles now live, deciding which controls actually apply to a given app.

MASWE, the Mobile Application Security Weaknesses enumeration, is the what-can-go-wrong: a catalog of specific weakness patterns, each mapped back to the MASVS control it violates and the MASTG test case that would catch it.

In practice: MASVS sets the requirement, MASTG tells you how to test for it, and MASWE names the specific way it tends to fail.

For a category-by-category walkthrough of the v2 refactor with practical examples,

Check out: An Actionable Guide to OWASP MASVS v2.

 

---

 

For the MASTG side,

See: How OWASP MASTG and MASVS Redefine Mobile App Security.

MASVS vs. the OWASP Mobile Top 10

The two are frequently paired, and for good reason: MASVS was built to give the Top 10 something to test against.

The Mobile Top 10 ranks risk. It tells a team that insecure authentication, for instance, is one of the ten categories most likely to cause damage, but it doesn't specify what a compliant authentication implementation looks like.

MASVS answers that second question. Improper Credential Usage and Insecure Authentication/Authorization, the first and third risks on the Mobile Top 10, both map to MASVS-AUTH. A team using both together gets prioritization from the Top 10 and a testable definition of "fixed" from MASVS.

For the full 10 risk categories and how each maps to real testing,

See: What is OWASP Mobile Top 10?

MASVS vs. ASVS

MASVS is a fork of ASVS, OWASP's equivalent standard for web and API applications.

ASVS, currently at version 5.0, spans roughly 350 requirements across 17 chapters, reflecting the much larger surface area of server-rendered pages, session handling, and API endpoints.

MASVS remains smaller and mobile-specific: 8 categories built around a compiled binary running on a device the organization doesn't control, rather than a request/response cycle on a server it does control.

How Appknox maps to MASVS

Appknox maps every finding to the specific MASVS control ID it violates: MASVS-STORAGE-1, not just MASVS-STORAGE. That granularity matters for compliance evidence. An auditor asking which of the 24 controls are actually met needs an answer at the control level, not the category level.

The scan itself combines binary SAST, AI-led DAST on real iOS and Android devices, and API security testing into a single CI/CD-integrated pass.
KnoxIQ then scores which findings are actually exploitable, so a team can prioritize the controls that carry real risk ahead of the ones that are technically unmet but practically low-stakes.

See the full testing methodology: Appknox Automated Vulnerability Assessment

Frequently asked questions

What does MASVS stand for?

MASVS stands for Mobile Application Security Verification Standard, OWASP's framework of security requirements for mobile apps.

What are MASVS L1, L2, and R?

L1, L2, and R were verification levels built into MASVS before version 2.0.0 (April 2023). L1 was the baseline for all apps, L2 added defense-in-depth requirements for apps handling sensitive data, and R covered resilience against reverse engineering. As of v2.0.0, these levels were removed from MASVS itself and now exist as MAS-L1, MAS-L2, and MAS-R testing profiles defined in MASTG, the companion testing guide.

How many categories does MASVS have?

The current version, MASVS v2.1.0, organizes its requirements into 8 categories and 24 controls: Storage, Cryptography, Authentication, Network, Platform, Code, Resilience, and Privacy.

What's the difference between MASVS and MASTG?

MASVS defines the security requirements. MASTG, the Mobile Application Security Testing Guide, defines how to test for each one, including the MAS-L1/L2/R profiles that determine which requirements apply to a given app.

What's the difference between MASVS and the OWASP Mobile Top 10?

The Mobile Top 10 ranks the risks that matter most. MASVS defines the specific, testable controls needed to address those risks. Most compliance programs use both together.

Is MASVS free to use?

Yes. MASVS is published by OWASP under a Creative Commons Attribution-ShareAlike 4.0 license and is free for any organization to adopt.

Related: What is OWASP Mobile Top 10? | What is MAST? | An Actionable Guide to OWASP MASVS v2 | OWASP MASVS & MASTG Guide | MASVS-AUTH Guide | MASVS Compliance Checklist | Appknox Automated Vulnerability Assessment

By Aadarsh Anand, Security Researcher, Appknox Security Research Team

Appknox is an enterprise mobile application security testing platform. This page was written by Appknox's security research team, based on direct experience mapping findings from automated and manual testing to MASVS and OWASP Mobile Top 10 control requirements across financial services, healthcare, and enterprise mobile app portfolios.This page was drafted with AI assistance and reviewed and verified by the Appknox security research team.