NIS2 for mobile apps.

An essential or important entity under NIS2? We test your app and its API, and give you the evidence for the security testing and effectiveness assessment the directive asks you to run.

Talk to our team All services

What NIS2 expects from your app.

For essential and important entities whose services rely on a mobile app and its backend.

Directive (EU) 2022/2555 (NIS2) makes you responsible for managing the security of the network and information systems behind your services. Article 21(2) lists risk-management measures that include:

Security in development and maintenance (letter e): security in the acquisition, development and maintenance of systems, including vulnerability handling and disclosure.
Assessing effectiveness (letter f): policies and procedures to assess the effectiveness of your cybersecurity risk-management measures.

NIS2 is an obligation on your organization, supervised by your national competent authority and transposed into national law. There is no product certificate here: you keep the evidence that you test your systems and check that the measures work. We produce that evidence for the mobile app and its API.

What we test.

Depending on the agreed scope, testing can cover:

The Android or iOS app: authentication and session handling, data stored on the device, platform attack surfaces and client-side controls.
The backend interfaces the app relies on, where included in scope, including whether one user can reach another user's data by changing an identifier in a request.
Vulnerability handling: the known vulnerabilities in the third-party components your app ships, so you can manage and disclose them.

How we work.

Call: you tell us about your app, its backend and the role it plays in your services.
Proposal: we set out the agreed scope, how often to test, what we need from you, the schedule and a fixed price.
Testing: you send us the builds and we start. If we find something critical, we let you know right away.
Report and review: we send you the report and go through it with your engineers.
Retest: once you have fixed the vulnerabilities, we confirm they are resolved in the new build.

What you receive.

Technical report

States what we tested and the result. Every finding includes evidence, reproduction steps, impact, a CVSS score and vector, CWE and OWASP MASWE references, and how to fix it.

Executive summary

Covers the scope and build tested, the results and the priorities, for management and non-technical readers.

Retest report

If you include the retest, we send a new version of the report with the status of each finding on the new build, as evidence that the measures were applied.

Why vulnit for NIS2.

Independent evidence

We are an external, independent team. The report sets out the scope, the tests and the results, so you can show your authority and your own management that the security of the app was tested and the measures were checked.

We contribute to OWASP MAS

We map your tests to OWASP MASVS and MASTG, the standard and testing guide our team helps write. OWASP recognized this work by naming vulnit an OWASP MAS Advocate.

Our own technology

Chameleon gives us deep visibility into what your app does inside the operating system, which makes the analysis faster and more thorough. Protections such as root, pinning and anti-instrumentation checks are handled at the OS level by default, so our time goes into finding issues in your app.

Meet the team

NIS2 frequently asked questions.

Does your report make us NIS2 compliant?

No single test makes you compliant. NIS2 is an obligation on your organization, supervised by your competent authority. Our report is the evidence for two of its measures: that the security of the app and its API was tested, and that you checked the effectiveness of your controls. You use it as part of your wider risk-management programme.

Is a certificate required?

NIS2 does not require a product certificate for the testing. It requires you to manage and assess the security of your systems. We produce the testing evidence; your programme and your authority cover the rest.

Are backend APIs included?

They can be, and we generally recommend it: much of a mobile app's risk lies in the APIs it uses. We decide it with you case by case, depending on the type of app and what its backend exposes.

Do you need source code?

No. By default, testing is black-box: we attack your app with the same information an attacker would have, using the same build you release. If you share the source code, we review it too.

Do you test iOS as well as Android?

Yes. We test both, to the same depth. On Android we work with Chameleon; on iOS we test on physical devices. If your app runs on both platforms, we deliver one report per platform.

Can I combine this with other testing?

Yes. It all starts from the same analysis of your app. Tell us what you need, for example a penetration test or an OWASP MASVS assessment, and we combine it into a single project.

How long does it take and what does it cost?

It depends on the number of apps and platforms, the complexity of your app and the backend interfaces in scope. We send you a proposal with a fixed price and the schedule. It usually takes one to two weeks per platform, report included.

What language is the report in?

English by default. If you need it in Spanish, just tell us.

How do you handle confidentiality?

We agree confidentiality terms before you share builds or documentation. We have a standard NDA, but if you prefer to use yours, we are happy to review it.

Testing your app for NIS2?

Tell us about your app and the services it supports. We reply within one business day to arrange a scoping call.

Talk to our team