Guardsquare

A new survey of DevSecOps professionals by GitLab (via Dark Reading) shows that AI coding tools have thus far exceeded ROI expectations at more than half of organizations. However, 82% agree that risks from AI-generated code are creating a new form of technical debt that many organizations are not yet prepared to manage. When asked what parts of the software delivery process had seen the least positive impact from AI, “compliance & audit” (42%) and “security scanning & vulnerability management” (41%) were the top responses. The next phase of investment in AI-based coding will largely focus on governance–starting with automated security scanning capabilities–so AI-generated code can be held to the same standard as human-written code. For mobile applications in particular, this requires purpose-built scanning tools designed for integration with CI/CD pipelines. https://hubs.la/Q04pRNGy0

🚀 droidcon USA kicks off today, and the Guardsquare team is ready! If you're attending, make sure to come say hello to our team at booth #19 to talk all things mobile application security, code hardening, and threat monitoring. 🎯 Highlight of the day: Don't miss the session at 2:05 PM by Guardsquare Security Researcher, Jan Seredynski: 🎤 Recent Mobile App Security Incidents from Real-World Cases Jan will dive deep into real-world vulnerabilities and share actionable strategies to protect your apps from modern threats. See you on the floor! 👋 #droidcon #AndroidDev #AppSecurity #MobileSecurity

Sometimes a seemingly isolated fraud attempt against your mobile application is actually the first sign of a broader threat campaign. How can you tell? This banking use case demonstrates how real-time threat monitoring adds another dimension to mobile application security. It can help you see what’s happening, anticipate what’s coming, and then adjust protections accordingly. Watch Guardsquare’s latest video to learn more: https://hubs.la/Q04pMdM20

Many governments, including the EU, United States, and United Kingdom have already made or are currently making the transition to mobile ID wallets that serve the function of physical identification like passports and driver’s licenses. But like any other mobile apps that contain sensitive info, mobile ID wallets are heavily targeted by threat actors. Due to this, specific security regulations and standards for ID wallets are being defined in most regions. Compliance with these regulations requires comprehensive security at the application level, with coverage across the software development lifecycle. Read our blog on how you can secure your mobile ID wallets today: https://hubs.la/Q04pDc3y0

Think your mobile app is safe because Android and iOS have built-in security? Most security leaders do, too. This misconception is why mobile apps keep getting compromised. In fact, 72% of organizations say they experienced a mobile app security incident in 2025. OS-level protections are designed with a primary goal in mind: protection of the user and their device. So, if iOS and Android aim to protect the user, who is protecting your mobile app’s code, your IP and the sensitive data of users passing through the app? This blog explains why you need a dedicated mobile application security strategy to protect your IP, sensitive data, and your reputation. Read the full blog: https://hubs.la/Q04prMVJ0

DevSecOps programs have introduced security into the planning, coding, testing, deployment, and maintenance stages of application development. But many traditional DevSecOps programs still have one critical blind spot: mobile apps. Unlike server-side applications, mobile apps are shipped into environments that the organization doesn’t control, changing the security model. What traditional DevSecOps can miss: - Reverse engineering - Tampering - Runtime attacks - API abuse Read more in this VMblog article about how teams can implement mobile DevSecOps: https://hubs.la/Q04p8Pd10

After three years of development, OWASP® Foundation has released v2.0 of their Mobile Application Security Testing Guidelines (MASTG). MASTG covers both how to test and what to test for prior to release. MASTG v2 uses a modular “knowledge graph” approach that allows individually addressable, cross-linked components to be independently maintained and updated for currency and relevancy. The new structure divides tests into individual pages, each with its own ID and links to relevant techniques and tools. This encapsulation ensures that each test is easily referenced and promotes reusability across all MAS components. The OWASP Mobile Application Security Project is led by a task force of industry leaders and mobile app security experts (including Guardsquare). https://hubs.la/Q04p2fZw0

Traditional server-side defenses don’t take into account the unique risks and threat models facing mobile applications. From running on rooted and jailbroken devices to reverse engineering and repackaging attacks, mobile apps require different security measures to keep critical business logic and workflows secure. Guardsquare’s Chief Product Officer, Ryan Lloyd, joined the Application Security Weekly podcast to discuss some current mobile threats, why mobile app security requires a defense-in-depth strategy, and how you can implement multi-layered protections. Listen to the full interview here: https://hubs.la/Q04p03LT0

🚨 We are 2 weeks out from the CyberSecIndonesia Summit 2026 in Jakarta! As proud sponsors and attendees, the Guardsquare team is looking forward to connecting with local security leaders to talk about the escalating threat landscape surrounding mobile applications. Be sure to catch our very own Ewout Dhont live on stage at 2:40PM. He will be delivering an essential solo session tracking exactly how to secure your mobile apps and the critical APIs they interact with.   Will you be at #CSID2026 on July 22? Let's connect! 👇 https://hubs.la/Q04nWNcs0   #AppSec #MobileSecurity #APISecurity #Cybersecurity #Infosec #JakartaTech

Mobile apps operate outside of traditional backend defenses, in environments that your team doesn’t control. Attackers no longer need to breach your fortified backend to access critical systems when they can simply reverse engineer and repackage your mobile apps, getting past defenses that were never designed to question if the app is authentic. Guardsquare Senior Product Manager, Joel DeStefano, sat down with VMblog to discuss what modern mobile app attacks look like, and why scanning alone isn’t enough to secure a mobile app. Read the full interview here: https://hubs.la/Q04nWjbP0