Your first mobile app security scan will almost certainly produce dozens of findings. Some will be Critical. Some will be Informational. Most will fall somewhere in between. The question that follows immediately is: which ones do we fix first? Severity ratings are a starting point, but they are not the full picture. A Critical finding...

Here is the timeline that most organisations follow when they publish a mobile app update: the development team completes the build, QA runs their functional tests, the product manager approves the release, and the APK is submitted to the Google Play Store. Within hours, the new version is live and accessible to every user who...

If your organisation holds a licence from the Saudi Arabia Monetary Authority, you are subject to the SAMA Cybersecurity Framework (CSF). And if your organisation publishes a mobile banking or payment application which, in 2026, means virtually every SAMA-licensed institution that application is within scope for quarterly compliance reporting. This post breaks down the specific...

NESA auditors are no longer satisfied with a generic vulnerability scan and a checklist. When they assess your mobile applications, they are looking for specific evidence of security controls mapped to recognised standards and they know what the most common failures look like. This post describes seven vulnerability classes that we see consistently in mobile...

Most people who have never used a mobile application security testing tool imagine something complicated. A command-line interface. Weeks of configuration. A team of security experts interpreting raw output. The reality is significantly simpler and significantly faster. This post walks you through exactly what happens when you scan a mobile application with HEXMobileSuite, from the...

There is a number that most CISOs in the UAE know by heart: AED 5.9 billion. That is the estimated annual cost of cyberattacks to UAE organisations. What most CISOs do not know is how much of that cost is attributable to mobile applications because the honest answer is that nobody is tracking it yet....

Third-Party SDKs: The Supply Chain Risk Hiding Inside Your Mobile App When the OWASP Foundation published the updated Mobile Top 10 for 2024, the most significant change was the elevation of supply chain risk to the number two position. Not authentication. Not data storage. Supply chain specifically, the security of third-party SDKs and libraries embedded...