The attacker starts where you end up: with your code in hand, without time pressure and without you seeing it. We test your mobile app from precisely this attack angle. And only when it turns out that yields nothing, are we done.
Mobile application pen test
Our ethical hackers test your iOS and Android app like an attacker would: the data the app stores on the device, the login process, and the traffic to your backend. You receive a report with evidence, remediation steps, and a retest.
Schedule a no-obligation consultationDownload Buyer’s Guide
Retest standard included·Reporting within 5 working days·According to the CCV certification mark
SOME OF OUR CLIENTS
| Characteristic | Warpnet | Other parties |
|---|---|---|
| Approach |  Tested manually on real iOS and Android devices |  Only an automated scan of the app |
| Device storage | Saved data, keys, and logs checked | Not or superficially tested |
| Login & sessions | Tokens, biometrics and session management tested | Only the standard login screen |
| Backend APIs | Intercepted traffic and manually tested APIs | The app viewed independently of the backend |
| Code analysis | App files scanned for secrets and vulnerabilities | Not included |
| Reporting | Executive summary and developer report | Technical report without context |
| Retest | Included so you can be sure fixes work | Not included or available at an additional cost |
Certifications & methodologies
CCVOSCPOSSTMMPTESOWASPMeow
Developers of cable and asset management solutions
Right in the middle of the process toward ISO 27001 certification, Patchmanager wanted to structurally strengthen the digital resilience of both the organization's internal network and the product — with regular, in-depth pentests as the foundation.
The collaboration began with three black-box penetration tests and, as trust grew, expanded to include gray-box and white-box testing. During the white-box test, Warpnet was granted full access to the architecture, source code, and accounts to identify risks.
Each test delivered a clear, risk-based report that allowed Patchmanager to get to work immediately. The collaboration evolved into 24/7 SOC services featuring continuous monitoring, response, and the complete remediation of risks and incidents.
“We are very happy with the collaboration with Warpnet. The team has in-depth expertise and truly looks at how they can help us. They communicate well, are flexible, and always do more than they are supposed to do.”
Jerry SeagerCertifications & Accreditations
Frequently Asked Questions
Yes. After your developers have implemented the recommendations, we will perform a retest upon request to confirm that the vulnerabilities have indeed been resolved. This way, the process does not end with a report, but with demonstrable assurance.
Yes. We test both platforms, including apps built with frameworks like Flutter, React Native, or Xamarin. We test every app on real devices, supplemented by the analysis of the app files (IPA and APK) and the traffic between the app and your backend.
An average of five to ten business days per platform, depending on the functionality, the number of user roles, and the connected APIs. You will receive the report within five business days after the test is completed. During the intake, you will receive a concrete schedule.
Not necessarily. For a grey box test, a test build (IPA or APK) with test accounts and access to a test or acceptance backend is sufficient. With the source code included (white box), we can take a deeper look at cryptography, storage, and the implementation of security measures. During the intake, we will determine together what is needed for your goal.
After a no-obligation intake, you will receive a quotation, and that is the price you will pay. The price depends on the number of platforms, the functionality of the app, and the linked APIs. Reporting, explanation, and retesting are included as standard. Below you will find general price indications for a one-off pentest and Pentesting as a Service (continuous pentesting).
One-time pentestVAT: €3,200
Pentesting as a Service: i.e. €1,250 per month
We follow the OWASP Mobile Application Security Verification Standard (MASVS): data storage on the device, encryption, login and session management, the security of the connection to your backend, how the app interacts with the operating system and other apps, and the app's resilience against tampering. In addition, we test the APIs with which the app communicates, as that often poses the greatest risk.
