A specialist service that hardens high-risk mobile apps and SDKs? against reverse engineering, tampering, and runtime manipulation before they ship.
Added Jul 17, 2026
Banks, payment providers, healthcare companies, and SDK? vendors increasingly put sensitive business logic on user-controlled mobile devices. Many teams rely on basic tools like ProGuard or wrapper-based protections, but those leave apps exposed to decompilation, Frida-style runtime manipulation, debugger attachment, and tampering. The buyer problem is not general security awareness; it is getting a specific Android or iOS release hardened without breaking the build, app performance, or store release process.
Start as a productized mobile hardening service for Android apps and SDKs?, then expand to iOS. The first offer is a fixed-scope assessment and hardening implementation: reverse-engineer the client app, identify exposed logic and runtime attack paths, apply layered obfuscation and RASP configuration using commercial or open-source tooling, and deliver a hardened build pipeline. Over time, the repeatable pieces can become scripts, CI templates, test harnesses, and managed monitoring packages rather than a generic SaaS? dashboard.
More critical workflows are moving into mobile apps, while LLMs? and better decompilation tools make reverse engineering faster. Companies with payment, banking, healthcare, and embedded SDK? exposure need deeper hardening than name obfuscation or one-layer binary wrapping.
Showing 1-7 of 7 signals
Think about your mobile app source code. Once it hits the app store, it's out in the wild. And without the right protection, decompiling is easy for malicious actors looking to steal your IP or tamper with your software. That's where GuardSquare comes in. GuardSquare provides the highest level of mobile app security for Android and iOS applications and SDKs. Their advanced tools integrate seamlessly into your CICD pipeline. We're talking polymorphic multi-layered code hardening techniques and automated runtime application self-protection, paired with mobile application security testing and real-time threat monitoring to deliver the highest level of mobile app security without compromise.
Mobile apps have become a primary interface for critical services, including banking, payments, and healthcare. Unlike web applications, much of the logic and intellectual property in a mobile app lives directly on the user's device, which is an environment the developer doesn't control. That makes mobile apps uniquely exposed to reverse engineering, runtime manipulation, and fraud. As more critical functionality shifts to mobile, the need to harden apps against sophisticated attackers continues to grow. GuardSquare builds tools to protect and test mobile applications against both static and dynamic threats. Its platform has features including layered code obfuscation, runtime application self-protection, mobile-specific security testing, threat monitoring, and API attestation. Ryan Lloyd is the Chief Product Officer at GuardSquare. In this episode, he joins Gregor Vand to discuss why mobile security differs from desktop and web security, how reverse engineering tools have evolved, the role of compiler-based obfuscation and runtime protections, common mobile app vulnerabilities, and how LLMs are reshaping the attacker landscape. Gregor Vand is a security-focused technologist, having previously been a CTO across cybersecurity, cyber insurance, and general software engineering companies. He is based in Singapore and can be found via his profile at van. hk or on LinkedIn. Hello, and welcome to Software Engineering Daily. My guest today is Ryan Lloyd. Hi there. Great to be here.
So we think mostly about the commercial tools around mobile app security. And first of all, mobile app security is a broad umbrella. But within that, the area where we really started from was mobile app protection. And so protection for us means protecting the application from reverse engineering and tampering. And there's two primary axes for reverse engineering and application. What we call static techniques and attacks and then dynamic techniques and attacks. And there's different capabilities and protection features that are necessary for each of those. So maybe if we just start with the static side first. So static analysis of a binary is all about you download the binary and you can use any number of decompiling tools that turn machine code back into readable, interpretable, human readable code. So that you can understand the logic, the behaviors and spot IP or secrets or information that can be useful knowledge to an attacker. And the primary mechanism for defending against that is code obfuscation. So obfuscating is all about taking that code and manipulating it in different ways to make it so that it's not readable. So that when it's decompiled, it's very difficult for someone to understand. And that's not to say that it's irreversible, but the complexity becomes so high with good quality obfuscation that the time it would take someone to really make sense of the code is often no longer kind of worth the effort and time that they would spend.
And that's the key difference between ProGuard and our open source approach is a lot of companies initially thought, hey, well, let's use ProGuard. It has name obfuscation. Great. Now our code's safe. But a lot of times when you're analyzing an application, you don't necessarily need the real names of a class or a method to understand the behavior and what's going on. I mean, if you're familiar enough with code, you can kind of put two and two together. Sometimes there's decompiling tools that will conveniently, based on the logic contained within a class, it will assign a name of meaningful value and then find all the other things with that same name and rename them for you. So there's a lot of convenience mechanisms if you rely solely on name obfuscation as the primary technique. So yeah, the layers are super important to work together to really provide strong defense. Yeah. And on that last point, LLMs, I'm sure, are very, very good at that as well. The obfuscation deriving meaning from it, I'm sure. So yeah, layering is very important. This, I guess, could be the approach of, I'll just say DexGuard for now. I know we're going to talk about the fact there is both DexGuard and IxGuard, but it's a compiler-based approach, which is different to wrapper-based. And I think that's maybe some developers already understand or have encountered wrapper-based approaches.
+5 more signals