Common Criteria and EUCC pre-evaluation for mobile apps.

Heading into a Common Criteria or EUCC evaluation of your mobile product? We find the vulnerabilities and close the gaps before the accredited laboratory does, so you reach the evaluation ready instead of fixing findings while the clock runs.

Talk to our team All services

An accredited laboratory evaluates. We get you ready.

Common Criteria (ISO/IEC 15408, evaluated with the method in ISO/IEC 18045) certifies a product against a Security Target at a chosen assurance level. In the EU, the EUCC scheme (Regulation (EU) 2024/482) runs Common Criteria under the Cybersecurity Act.

The evaluation is performed by an accredited laboratory (an ITSEF) and the certificate is issued by a certification body or national cybersecurity certification authority. vulnit is not an accredited ITSEF, so we do not perform the evaluation or issue the certificate.

What we do is the work before that: a pre-evaluation of your mobile product, so you reach the laboratory with the vulnerabilities fixed and the gaps closed. Findings surfaced during the formal evaluation have to be fixed while it is in progress, which can delay certification, and the laboratory cannot tell you how to fix them, because it cannot take part in developing a product it evaluates.

What we test.

We work from your Security Target or Protection Profile and the target assurance level, and attack the product the way the evaluation's vulnerability analysis will. Depending on the target of evaluation, testing can cover:

The security functions the Security Target claims: authentication, cryptography, key handling, access control and the rest of the declared behavior.
Vulnerability analysis and penetration testing of the mobile app or SDK against attackers at the relevant attack potential (the AVA_VAN family).
The protections and cryptography the product relies on, such as anti-tampering, runtime checks and white-box cryptography.
Source code and implementation review, where the assurance level requires it. At EAL4 and above (AVA_VAN.3 and higher), the assurance families call for design and implementation analysis, so black-box testing alone is not enough and we include a code review.

How we work.

Call: you tell us about your product, its Security Target, the target assurance level and your evaluation date.
Proposal: we set out the agreed scope for the assurance level, what we need from you, the schedule and a fixed price.
Testing: gap analysis against the Security Target, vulnerability analysis and penetration testing, plus a code review where the assurance level requires it. If we find something critical, we let you know right away.
Report and review: we send you the report and go through it with your engineers.
Retest: once you have fixed the vulnerabilities, we confirm they are resolved, so you hand the laboratory a product that is ready.

What you receive.

Technical report

States what we tested against your Security Target and assurance level. Every finding includes evidence, reproduction steps, impact, a CVSS score and vector, CWE and, where they apply, OWASP MASWE references, and how to fix it.

Executive summary

Covers the scope and build tested, the results and the priorities, for management and non-technical readers.

Retest report

If you include the retest, we send a new version of the report with the status of each finding on the new build, before you submit your product to the laboratory.

Letter for your customers

On request, at no extra cost, we provide a signed letter with what we tested, the version, the date and the result, for your customers or auditors. After the retest, we update it with the new results.

Why vulnit for Common Criteria.

We have been evaluators

Our team comes from security certification laboratories, with hands-on experience in Common Criteria, the Spanish LINCE scheme and mobile payment standards such as EMVCo SBMP. We know how an evaluation reads your evidence and where the AVA_VAN vulnerability analysis bites.

Specialists in mobile security

Our team contributes to OWASP Mobile Application Security, the main reference for testing mobile apps. OWASP recognized this work by naming vulnit an OWASP MAS Advocate.

We help you fix what we find

We explain how to fix each finding and, if you include the retest, check the fixes before you submit your product to the laboratory.

Meet the team

Common Criteria frequently asked questions.

What is Common Criteria, and what is EUCC?

Common Criteria (ISO/IEC 15408) is an international standard for evaluating and certifying the security of IT products against a Security Target at a chosen assurance level. EUCC is the European scheme (Regulation (EU) 2024/482) that runs Common Criteria across the EU under the Cybersecurity Act.

Do you issue the Common Criteria or EUCC certificate?

No. The evaluation is performed by an accredited laboratory (an ITSEF) and the certificate is issued by a certification body or national authority. We are not an accredited ITSEF. We perform the pre-evaluation so you reach that process ready.

Why pre-evaluate before the laboratory?

Because vulnerabilities found during the formal evaluation have to be fixed while it is in progress, which can delay certification, and the laboratory cannot tell you how to fix them. We find and help you fix them first.

Do you need source code?

It depends on the assurance level. By default, testing is black-box. At EAL4 and above (AVA_VAN.3 and higher), the assurance families require design and implementation analysis, so there we include a source code review. Below that, black-box testing is enough and source review is optional.

Do you test on physical devices?

When needed. On Android we mainly work with Chameleon, our analysis environment: it gives us deep visibility into what the product does in the operating system, and handles root, pinning and anti-instrumentation checks at the OS level by default. On iOS we test on physical devices.

What do you need from us?

The builds of your product, the Security Target or Protection Profile and the target assurance level, test accounts and access to the environments in scope, and the source code where the assurance level calls for it. The proposal sets out the details.

How do you handle confidentiality?

We agree confidentiality terms before you share builds, documentation or source code. We have a standard NDA, but if you prefer to use yours, we are happy to review it.

Is this the same as a general mobile penetration test?

No. A general mobile application penetration test investigates vulnerabilities in an agreed app scope. This service is scoped to your Security Target and assurance level, and aimed at getting your product through the Common Criteria or EUCC evaluation. We do not perform the formal evaluation.

Preparing for a Common Criteria or EUCC evaluation?

Tell us about your product, its Security Target and your evaluation date. We reply within one business day to arrange a scoping call.

Talk to our team