How NowSecure Is Using AI to Advance Mobile App Security Testing

During its recent hackathon, NowSecure’s research and engineering teams built working prototypes of AI-powered tools spanning the mobile app security lifecycle: agentic reverse engineering and finding validation, real-device exploit confirmation, AI-generated mobile device management (MDM) policy guidance and dramatically expanded vulnerability database coverage. Each prototype built on NowSecure’s research, specialized mobile application security testing tooling and domain expertise. The results show how AI extends what human security researchers can do, with conclusions validated against real code, real devices and real evidence.

[Important Note: NowSecure hackathon research does not use customer data.]

Why This Matters

Mobile app security testing requires deep, device-level expertise: reverse engineering compiled binaries, understanding platform-specific behavior across iOS and Android, and distinguishing theoretical weaknesses from vulnerabilities attackers can actually exploit. Generic AI models lack the specialized context needed to perform those tasks reliably.

AI is also changing the software itself. Generated code, embedded models, AI agents and increasingly complex third-party software are introducing new behaviors that security teams must analyze and validate. A new independent survey found AI is already present in most enterprise mobile apps, making those challenges increasingly common. 

NowSecure’s internal hackathon challenged engineers to explore how AI could improve mobile application security testing without sacrificing technical accuracy, transparency or trust. The projects featured here represent a sampling of that work, including reverse engineering, exploit validation, enterprise policy guidance and vulnerability intelligence. None relied on an LLM alone. Each combined AI reasoning with specialized tooling, curated mobile security expertise and independent validation.

Project 1: An Agentic AI Framework for Autonomous Mobile App Analysis

Sergi Alvarez, a senior research engineer known as Pancake, and Carlos Holguera, distinguished research engineer, teamed up to build a prototype orchestration framework that allows AI agents to work directly with real application binaries. The system reads disassembled code, reasons about how specific functions are used and evaluates that behavior against established mobile application security testing standards like OWASP.

Highlights

• AI agents evaluated individual security test cases against real iOS and Android application binaries and explained why a particular API or code path did or did not represent a genuine risk instead of simply flagging a pattern match.
• In side-by-side testing, the system correctly identified both true positives and false positives in real-world applications, including scenarios that required tracing execution paths to reach the correct conclusion.
• The framework integrates with specialized security tools and a curated mobile security knowledge base, giving the AI access to the same reference material and technical context a human researcher would use.
• The architecture was designed for reuse across research, internal tooling and potential future product capabilities.

One lesson stood out during the project: model selection mattered far less than the quality of the domain-specific knowledge and guardrails surrounding it. With the right tooling and reference material, even a lightweight, low-cost model performed complex mobile reverse engineering tasks surprisingly well.

The value isn’t the AI model itself, but the depth of domain-specific context and guardrails it’s given.

Project 2: An Agentic Harness for Confirming and Exploiting Security Findings

Finding vulnerabilities is only part of the problem. Security teams also need to know which findings are actually exploitable and worth fixing first. NowSecure Senior Research Engineer Chase Abel focused on helping customers distinguish practical risk from theoretical issues, reducing alert fatigue and making remediation decisions more straightforward.

Highlights

• The prototype uses an agentic workflow to prioritize findings based on exploitability and dependency, then attempts to build and execute real proof-of-concept exploit chains against physical devices instead of simulated environments.
• Before reporting a confirmed finding, a second AI agent independently attempts to reproduce the exploit using only the application and a description of the objective. This blind validation step helps identify hallucinations or unsupported conclusions before results reach customers.
• Each finding receives a clear outcome: confirmed and exploitable, unreachable, false positive or undetermined. An effort budget prevents the system from spending unlimited time attempting to validate a single issue.
• During a live demonstration, the agent navigated a test application on a real device, captured network traffic, identified leaked sensitive data and correlated that evidence with existing findings. The result was a plain-language report that non-technical stakeholders could understand alongside the supporting technical evidence.
• Research also evaluated pairing the agent with NowSecure AI Navigator — NowSecure’s existing AI-driven app navigation capability (see datasheet). When performing long navigation scenarios under heavy stress from runtime analysis, it made the navigation agent resilient to app slowdowns, crashes and unexpected behavior.

Unlike the first project, which focuses on discovering and explaining vulnerabilities within application code, this prototype concentrates on independently validating exploitability before findings are delivered to customers. Together, the two approaches move AI closer to supporting the complete mobile security testing workflow.

Project 3: AI-Generated MDM Policy Guidance for Enterprise App Management

Organizations that manage fleets of mobile devices depend on mobile device management (MDM) platforms to enforce security policy. Translating mobile application security intelligence into specific device controls, however, typically requires experienced administrators. Todd Sackett, Vice President of Engineering for NowSecure, explored whether AI could automate much of that work.

Highlights

• Given a specific mobile application, the prototype analyzes available iOS and Android device management controls and recommends policy changes that could reduce the risk associated with known security findings.
• It also generates plain-language guidance that IT administrators can share directly with employees, helping users understand practical steps they can take when using a particular application.
• Recommendations are generated on demand and cached for future use instead of requiring a manual review each time.
• Model selection significantly affected output quality and consistency. The project also discovered that combining AI-generated content with deterministic formatting logic produced more reliable results than relying on the model to generate both the recommendations and their presentation.

This remains an early research prototype rather than a planned product capability. Its purpose was to validate the approach and identify where AI can reduce manual effort without sacrificing consistency or quality.

Project 4: Expanding Vulnerability Database Coverage with AI

Every mobile application depends on third-party and open-source software. Accurately matching those components against public vulnerability databases remains a persistent industry challenge because component names and versions often vary across data sources. A hackathon team of Vulnerability Analysis Engineer Devin Basaraba and Senior Architect Dean Landolt tackled that long-standing mapping problem directly.

Highlights

• The prototype uses AI to reconcile inconsistent naming between NowSecure’s internal component inventory and public vulnerability databases, automating work that has traditionally required extensive manual effort while incorporating safeguards to reduce false positives.
• Testing against a representative set of real-world applications substantially increased vulnerability detection coverage compared to the previous mapping process. The team also identified a clear path for additional gains by incorporating more open-source vulnerability feeds.
• The project introduced early tooling that makes reference data and vulnerability information centrally searchable and browsable. That foundation supports more transparent citations behind future findings while providing the structured data AI-assisted analysis increasingly depends on.

The team viewed this project as solving a long-standing engineering problem. The challenge was not recognizing the gap, it was finding a practical way to bridge it. AI-assisted mapping appears to offer that path forward.

Project 5: Scaling Responsible Cloud-Exposure Research with AI

NowSecure Chief Technology Officer David Weinstein and NowSecure Senior Research Engineer Jake Van Dyke explored how AI-assisted analysis could uncover cloud-security risks across large volumes of mobile app findings. Mobile apps frequently contain Firebase configuration, Google API keys and cloud-storage references. Although these artifacts are not necessarily vulnerabilities on their own, overly permissive access controls can expose sensitive data or enable unintended use of cloud services.

Highlights

• The project correlated signals across iOS and Android apps, grouping applications by shared Firebase projects, Google Cloud infrastructure and storage resources.
• AI helped triage heterogeneous findings, while deterministic probes distinguished public-by-design configuration from open storage buckets, exposed Firebase backends and overly permissive Google API access.
• Validation used read-only or otherwise tightly scoped checks to confirm real-world impact without unnecessarily accessing data.
• Weinstein and Van Dyke reviewed confirmed issues and coordinated responsible disclosures with affected vendors, providing reproducible evidence and remediation guidance while protecting vendor and user identities.

By combining portfolio-scale intelligence, AI-assisted analysis, purpose-built validation and responsible disclosure, the project identified systemic risks that would be difficult to see in a single assessment. It demonstrates how NowSecure applies mobile security expertise not only to detect vulnerabilities, but also to proactively strengthen the broader mobile ecosystem.

NowSecure Agentic AI

Learn More

AI Works Best When It’s Grounded in Mobile Security Expertise

Across the projects highlighted here, one conclusion surfaced repeatedly. LLMs don’t become mobile security experts simply because they’re pointed at source code.

Every successful prototype combined AI with something more deterministic: mobile security testing standards, specialized tooling, curated reference data, independent validation or human judgment. That combination allowed the teams to move beyond simple code generation and into workflows that reason about real applications, verify exploitability and produce evidence engineers can trust. At portfolio scale, that same discipline meant pairing AI-driven triage with tightly scoped, read-only validation and human-reviewed responsible disclosure. This ensured cloud-exposure signals were confirmed and actionable before any vendor was contacted.

The projects also reinforced an important practical lesson. AI agents can make meaningful progress toward complex security goals, but they still benefit from domain-specific guardrails. Left completely open-ended, they can pursue dead ends or arrive at conclusions that require verification. Grounding them in structured knowledge and validating their output against real code, real devices and reproducible evidence consistently produced better results.

That philosophy reflects how NowSecure approaches AI. The objective isn’t to replace security researchers. It’s to extend their capabilities by automating repetitive work, accelerating analysis and helping experts focus on higher-value decisions. The hackathon offered an opportunity to test those ideas in practice, and the results suggest AI can become a powerful force multiplier when it’s built on years of mobile security expertise instead of generic prompts.

What’s Next

The projects featured here remain internal research prototypes, and they represent only a sampling of the work completed during the hackathon. Engineering teams will continue refining these ideas while evaluating where validated AI-assisted capabilities can strengthen future NowSecure products and research.

As AI continues to change how mobile applications are built, NowSecure is applying the same discipline to AI itself: validating what works, measuring results and building capabilities that earn trust through evidence.

The projects in this article explore how AI can strengthen mobile application security testing. Our latest Mobile App Risk Management Survey shows why that work matters, with new data on AI adoption, governance and security risk from 485 enterprise mobile security leaders.