baselineRFIWhat analysis methods are used — static (SAST) binary/source analysis, dynamic (DAST) runtime instrumentation, and interactive (IAST) — and which are available for iOS versus Android given platform differences in what's inspectable?weight 3
Answer key — what a strong answer shows
iOS's sandboxing limits certain dynamic techniques compared to Android — look for an honest per-platform breakdown of what each analysis type can actually see, not a single unified claim.
baselineRFPDescribe the OWASP MASVS/MASTG coverage — which verification requirements does the platform test against by default, and can results be exported mapped directly to MASVS control IDs for compliance evidence?weight 3
Answer key — what a strong answer shows
MASVS is the accepted mobile security standard; look for named, mapped coverage and exportable evidence, not a generic vulnerability list requiring manual re-mapping.
baselineRFIHow does the platform detect insecure data storage and transmission specifically — hardcoded API keys/secrets in the binary, weak/absent certificate pinning, insecure local storage of sensitive data — with concrete detection examples?weight 3
Answer key — what a strong answer shows
These are the most common real mobile app findings; look for specific detection classes named, not a vague 'data security scanning' claim.
baselineRFIWhat runtime application self-protection (RASP) capability exists for mobile — jailbreak/root detection, anti-tampering, anti-debugging, code obfuscation verification — and can this be embedded via SDK into the app build pipeline?weight 3
Answer key — what a strong answer shows
Look for SDK-embeddable RASP that ships inside the app itself, not just pre-release scanning that says nothing about runtime attack resistance in production.
baselineRFPDetail CI/CD integration — can scans run automatically on every build (not just periodic manual submission), what is the typical scan turnaround time, and does the platform provide developer-actionable findings (file/line-level) versus a generic report?weight 3
Answer key — what a strong answer shows
Look for automated per-build scanning with a stated turnaround and file/line-level findings — periodic manual scanning misses vulnerabilities introduced between scan cycles.
baselineRFIHow does the platform handle third-party SDK risk — can it identify which bundled SDKs (ad networks, analytics, crash reporting) access sensitive permissions or exfiltrate data, and flag SDKs with known vulnerabilities?weight 3
Answer key — what a strong answer shows
Third-party SDKs are a major, often-invisible attack surface in mobile apps — look for explicit SDK inventory and risk-flagging, not just first-party code analysis.
baselineRFPExplain API security testing for the mobile app's backend communication — can the platform test the APIs the app calls for authorization flaws (e.g., IDOR) that are only reachable by reverse-engineering the mobile client's API calls?weight 3
Answer key — what a strong answer shows
Mobile backends are frequently tested less than the app itself, since testers need to reverse-engineer client-side API calls first — look for this specific capability, not just client-side analysis.
baselineRFIWhat compliance-specific testing is supported — Apple App Store/Google Play privacy-label accuracy verification, COPPA (if child-directed), and region-specific requirements — with evidence suitable for app-store submission?weight 3
Answer key — what a strong answer shows
App-store privacy-label mismatches cause real rejections/removals; look for verification that declared data collection matches actual app behavior, not just generic security scanning.
baselineRFIWhat is the pricing model — per app, per scan, or per developer seat — and how does cost scale for an organization with a growing portfolio of apps and frequent release cadences?weight 3
Answer key — what a strong answer shows
Look for transparent, predictable scaling economics tied to realistic app-portfolio growth and release frequency, not just a per-scan price that becomes expensive at real CI/CD scale.
baselineRFPDescribe incident-response support for a confirmed compromised mobile app already live in an app store (e.g., a malicious update was published, or a real vulnerability is being actively exploited) — can the platform help coordinate an emergency patch and app-store takedown, and what is a customer-referenced example?weight 3
Answer key — what a strong answer shows
Strong answers describe real emergency-response support with a customer example, not just pre-release scanning capability.
baselineRFIHow well does the platform's analysis work on apps built with cross-platform/hybrid frameworks (React Native, Flutter, Xamarin) versus pure native code — do findings correctly map back to the original source given the transpilation/bridging layer these frameworks introduce?weight 3
Answer key — what a strong answer shows
Cross-platform framework code often confuses tools built primarily for native binary analysis — ask for a specific answer on hybrid-framework support, not an assumption that native-focused analysis extends cleanly.
baselineRFIWhat historical trend reporting exists on app security posture across successive releases (vulnerability count trend, MASVS compliance trend), suitable for demonstrating program maturity to leadership?weight 3
Answer key — what a strong answer shows
Trend-over-time reporting across releases is a distinct capability from a single scan report — confirm this exists as a maintained, exportable report.
baselineRFPWhat is the measured false-positive rate on findings specifically, and what mechanism exists for developers to correct and permanently suppress a confirmed false positive without it reappearing on every subsequent scan?weight 3
Answer key — what a strong answer shows
A high false-positive rate creates real developer alert fatigue and erodes trust in the tool — ask for a real, customer-validated accuracy figure and a persistent suppression mechanism.
baselineRFIHow does the platform integrate with (versus duplicate) the customer's existing vulnerability management and ASPM tooling so mobile findings feed into the same unified risk view rather than a disconnected mobile-specific dashboard?weight 3
Answer key — what a strong answer shows
Look for genuine integration into a unified risk view; a standalone mobile dashboard disconnected from the broader AppSec/VM picture creates real reconciliation burden.
baselineRFPWhat developer-facing remediation guidance is provided beyond flagging a finding — concrete fix suggestions, code examples, or auto-generated remediation PRs — and does this reduce measured time-to-fix with a customer reference?weight 3
Answer key — what a strong answer shows
Actionable, specific remediation guidance (not just a finding description) materially speeds real fixes — ask for a customer-validated time-to-fix improvement figure.
baselineRFIDoes the platform verify build-pipeline integrity and code-signing for the mobile app itself — detecting if a published app binary has been tampered with post-release or if signing keys are exposed — distinct from source/binary vulnerability scanning?weight 3
Answer key — what a strong answer shows
Supply-chain integrity for the app's own release process (signing key security, tamper detection) is a distinct concern from vulnerability scanning of the app's code — ask for a specific answer on this scope.
baselineRFPTest web, mobile, and cloud applications for common vulnerabilities (e.g., injection, XSS, auth/session flaws, insecure APIs) (Application Security Testing).weight 3
baselineRFPPerform application penetration test services on mobile applications as requested.weight 3
These questions and weights are the reviewed standard for this category — start scoring straight away. To change them, or to import your own questions from a spreadsheet and reuse them on every evaluation, create a free buyer account.
