A financial entity under DORA? We test the apps behind your critical and important functions, and their APIs, and give you an independent report for your digital operational resilience testing programme.
For financial entities in the EU and the ICT providers that build their apps.
The Digital Operational Resilience Act requires a digital operational resilience testing programme over the systems that support your business. For a mobile app behind a critical or important function, that means:
DORA is an obligation on your entity, not a product certificate. No accredited body issues a result: you run the programme and keep the evidence. We are an external, independent team, and our report is the evidence your programme uses for the mobile app and its API.
We cover the mobile app and its API; the rest of your systems are tested elsewhere in your programme. Depending on the agreed scope, testing can cover:
States the scope, the build and the interfaces tested, and the result, so it slots into your testing programme as evidence. Every finding includes evidence, reproduction steps, impact, a CVSS score and vector, CWE and, where they apply, OWASP MASWE references, and how to fix it.
Covers the scope and build tested, the results and the priorities, for management and non-technical readers.
If you include the retest, we send a new version of the report with the status of each finding on the new build.
DORA lets your resilience testing be run by independent parties, internal or external. We are an external, independent team, and the report sets out the scope, the tests and the results, so your programme and your auditors can rely on it.
Our team comes from security certification laboratories, with experience in schemes such as Common Criteria and EMVCo SBMP. We contribute to OWASP Mobile Application Security, and OWASP recognized this work by naming vulnit an OWASP MAS Advocate.
Chameleon gives us deep visibility into what your app does inside the operating system, which makes the analysis faster and more thorough. The controls that usually slow testing down, such as root, pinning and anti-instrumentation checks, are handled at the OS level by default, so our time goes into finding issues in your app instead of getting past them.
Meet the teamDORA requires applications that support critical or important functions to be tested at least once a year, and after major changes. We can run the testing on that cycle.
No. DORA requires the tests to be performed by independent parties, internal or external, and there is no product certificate or accredited laboratory that issues the result. We are an external, independent team, and our report is the evidence your programme keeps.
TLPT is a separate, advanced requirement that applies to entities the authorities designate, at least every three years, and the technical standards set qualification criteria for the testers. It is distinct from the yearly testing in Article 24. Tell us your situation and we can discuss whether and how we fit.
They can be, and we generally recommend it: much of a mobile app's risk lies in the APIs it uses. We decide it with you case by case, depending on the type of app and what its backend exposes.
No. By default, testing is black-box: we attack your app with the same information an attacker would have, using the same build you release to your users. DORA includes source code reviews among its tools, where feasible. If you share the code, we review it too.
Yes. Download our sample report, a real deliverable from a full assessment of a deliberately vulnerable app.
When needed. On Android we mainly work with Chameleon, our analysis environment: it gives us deep visibility into what the app does in the operating system, and handles root, pinning and anti-instrumentation checks at the OS level by default. If we hit a limitation that matters for your app, we use physical devices. On iOS we use physical devices.
It depends on the number of apps and platforms, the complexity of your app and the backend interfaces in scope. We send you a proposal with a fixed price and the schedule. It usually takes one to two weeks per platform, report included. We can usually start the same week you accept the proposal; the start date depends on our team's workload and is stated in the proposal.
Retesting is quoted separately at a reduced rate. In the proposal we give you two options, testing only or testing with one retest round, so you know the total cost from the start.
Yes. If you plan your yearly testing with us, we agree special conditions for the whole cycle.
You receive one report per platform, with every finding detailed. If you also want to use them in your own tools, we provide them as CSV or JSON too.
English by default. If you need it in Spanish, just tell us.
We agree confidentiality terms before you share builds or documentation. We have a standard NDA, but if you prefer to use yours, we are happy to review it.
Tell us about your app and the function it supports. We reply within one business day to arrange a scoping call.
Talk to our team