Mobile Application Assessments By The Numbers: A Whole-istic View
summary
Sixty-one assessments across twenty apps yield 957 recorded issues and a clear claim: most serious flaws live on corporate web services not the device — about 70% of critical/high findings on the server, versus 25% on-device. Methodology combines automated static tools (Fortify, Checkmarx), dynamic tools (AppScan, Burp, ZAP) and manual pen testing; automated static finds lots of low-noise results while manual dynamic testing finds many of the actionable high-severity bugs.
AI-written summary · about
chapters (12)
- 0:00Start
- 4:40Introduction
- 6:45Mobile Application Threat Model
- 9:47Assessment Methodology
- 13:29Assessment Data
- 17:51Compare to OWASP Top 10 Mobile Risks
- 20:13Where Did We Find Overall Vulnerabilities?
- 27:33Static vs. Dynamic Method of Finding Vulnerabilities
- 28:37Critical and High Risk Vulnerabilities
- 30:15Automated vs. Manual Method of Finding Vulnerabilities
- 33:09vs. Dynamic for Critical and High Vulnerabilities
- 39:12Questions
related talks
33mBest Practices for Mobile App Security Testing
46mBenchmarking AppSec Across Industries
43mSecurity Testing Tools: Can I Touch You There?
39mMobile App Security
48mHow to Meet the New Mobile Application Security Imperative
21mUnlocking Mobile App Security- Key Insights for Navigating a Rapidly Evolving Threat Landscape
37mMobile DevSecOps: 5 Tips from Building Mobile Apps Used by Millions
43m Web Application Vulnerability Scanners: An Intro & Discussion