Notifications
Clear all
Topic starter
19/08/2026 3:59 pm
TL;DR: Mobile app security is shifting toward server-side attestation, layered runtime protection, and threat-informed fraud controls as organizations face an average of nine incidents a year and nearly $7 million per incident, according to Guardsquare’s analysis of Enterprise Strategy Group data. The gap between 93% confidence and rising attack pressure shows why mobile app integrity is becoming a governance problem, not just an engineering one.
NHIMG editorial — based on content published by Guardsquare: Mobile App Security Predictions for 2026: Balancing Security, UX, and Trust
By the numbers:
- Developers are building an average of 13 apps per year, which widens the mobile attack surface quickly.
Questions worth separating out
Q: How should security teams use app attestation in mobile identity flows?
A: Security teams should use app attestation as a gate for high-risk mobile actions, not as an optional telemetry signal.
Q: Why do mobile apps create problems for IAM and fraud teams?
A: Mobile apps sit in the middle of authentication, identity proofing, and transaction approval, so compromise of the app can undermine every downstream decision.
Q: What breaks when mobile security only looks at the device and not the apps?
A: Teams miss the behaviours that actually move data, tokens, and sensitive content off the device.
Practitioner guidance
- Make app attestation mandatory for high-risk flows Require server-side attestation before payments, account recovery, identity verification, and sensitive API transactions.
- Use adaptive decisioning instead of binary device blocks Replace blanket rooted-device or jailbreak denials with risk-based routing that can send users into assisted verification, additional checks, or limited-function access.
- Layer MAST, hardening, and runtime protection Test the app before release, harden the binary, and enforce runtime protections after installation so attackers cannot simply remove safeguards.
What's in the full article
Guardsquare's full blog post covers the operational detail this post intentionally leaves for the source:
- Threat signal combinations used to make server-side decisions in mobile risk flows
- Implementation detail on app attestation and how it changes API enforcement
- Practical examples of code hardening, RASP, and MAST across the mobile lifecycle
- How mobile teams can balance user retention with stronger trust enforcement
👉 Read Guardsquare's mobile app security predictions for 2026 →
App attestation and mobile trust: are your controls keeping up?
Explore further
19/08/2026 4:36 pm
App attestation is becoming the new trust boundary for mobile identity flows. Mobile apps increasingly mediate banking, healthcare, and verification journeys, which means the app itself now influences whether an identity transaction should be trusted. When only 41% of organisations use attestation, the gap is not just technical, it is governance-related. Practitioners should treat app integrity as part of access assurance, not as a niche mobile control.
A question worth separating out:
Q: Who should own mobile app integrity controls in an enterprise?
A: Mobile app integrity should be shared across mobile engineering, IAM, fraud, and security operations because the control affects access, verification, and abuse prevention. No single team owns the entire risk. The right model is a common policy for attestation signals, escalation paths, and exception handling.
👉 Read our full editorial: Mobile app security predictions for 2026 hinge on trust and attestation
