Android Security Verification (MASVS)

It evaluates an Android app against the OWASP Mobile Application Security Verification Standard using the MASTG as the testing method, verifying each control group — storage, cryptography, authentication, network, platform, code, resilience, and privacy — and reporting where the app meets the standard and where it does not.

MASVS is the standard — the list of security requirements a mobile app should meet. MASTG is the testing guide — the concrete techniques and test cases used to verify those requirements. We verify against MASVS and test with MASTG.

L1 is the standard set of controls every app should meet; L2 adds defense-in-depth controls for apps handling sensitive data; R (resilience) adds controls against reverse engineering and tampering, relevant when the app itself must resist a determined attacker. We pick the profile with you during scoping.

At minimum the release-configuration build (APK or AAB) and a test account. Access to the source and build configuration makes the static analysis deeper and faster (a grey- or white-box test). We test on our own devices; if the app targets specific hardware or an in-house device fleet, tell us during scoping.

We use both. A rooted device with instrumentation lets us inspect storage, memory, and traffic to verify the controls thoroughly; we also test on a standard device to confirm behavior real users see. For resilience (R) work, defeating root detection is part of the test, not a shortcut around it.

MASVS covers the app on the device and its network communication, but many mobile risks live in the API behind it. We recommend pairing this with an API assessment; a combined mobile-plus-API engagement is available for exactly this reason.

Each failed control gets a CVSS score for a common baseline, adjusted by the real impact in your context — what data it exposes and how reachable it is. A control can fail the standard yet be low risk, or pass technically yet leave a real gap; the report makes that distinction explicit.

Yes. After you remediate, we re-verify the failed controls to confirm each fix holds and update their status in the compliance matrix.

It depends on the profile and the app's complexity; a comprehensive verification typically runs about two to three weeks. We give a firm estimate after scoping.