MASTG is OWASP’s testing guide for mobile applications. It explains how to test for common weaknesses and what evidence to gather, making it useful for security testing teams, developers, and assessors who need repeatable methods rather than informal review notes.
Expanded Definition
OWASP’s Mobile Application Security Testing Guide, or MASTG, is a practical testing guide rather than a formal standard. It helps teams assess mobile apps across client-side code, runtime behaviour, data storage, communication paths, authentication flows, and platform-specific controls. In the mobile security domain, its value is that it turns broad assurance goals into repeatable checks that can be applied during development, release validation, and independent assessment.
MASTG is closely associated with OWASP’s mobile security ecosystem, including the OWASP MASTG and companion mobile guidance. It is especially useful where teams need a common test vocabulary between developers, security engineers, and assessors. Definitions vary across vendors on how much coverage is needed for a “complete” mobile test cycle, so MASTG is best understood as a methodical baseline, not a guarantee of full assurance.
The most common misapplication is treating MASTG like a compliance checklist, which occurs when teams run a limited set of tests once and assume the mobile app is secure without retesting after code, dependency, or backend changes.
Examples and Use Cases
Implementing MASTG rigorously often introduces time and environment constraints, requiring organisations to weigh deeper test coverage against release speed and device diversity.
- Testing local storage for sensitive data exposure, such as tokens or session material retained in logs, caches, or backups, using the structured methods described in OWASP mobile guidance.
- Inspecting transport security to confirm certificate validation, TLS configuration, and resistance to interception on hostile networks, especially for apps that handle credentials or personal data.
- Reviewing authentication and session handling to see whether the app properly enforces timeout, reauthentication, and token lifecycle expectations under normal and adverse conditions.
- Assessing runtime protections and tamper resistance to understand how the app behaves on rooted or jailbroken devices, where controls may be bypassed or instrumented.
- Validating the app’s interaction with APIs and backend services, because a mobile weakness often becomes more serious when combined with weak server-side authorization or poor token handling.
For teams aligning testing with broader security governance, MASTG can sit alongside the NIST Cybersecurity Framework 2.0 to support consistent risk treatment and verification expectations across application security work.
Why It Matters for Security Teams
Mobile applications often contain privileged pathways into identity, payments, customer records, and internal services, so weak testing creates business risk well beyond the handset itself. MASTG matters because it gives security teams a shared way to evidence weaknesses instead of relying on ad hoc inspection or undocumented reviewer judgment. That is particularly important when mobile apps are part of broader identity journeys, where session handling, device binding, secrets storage, and API authorization can all affect trust in the user experience.
For organisations working under formal governance, MASTG helps translate security expectations into repeatable test activity that supports remediation tracking and release gates. It also reduces ambiguity when third parties build or assess mobile software, because the same control area can be examined with a common set of checks. Where mobile apps are used to access cloud services, enterprise SSO, or sensitive NHI-adjacent workflows, consistent testing becomes a prerequisite for confidence, not an optional enhancement.
Organisations typically encounter MASTG as an urgent reference only after a mobile breach, a failed assessment, or exposure in app store review, at which point repeatable testing becomes operationally unavoidable to restore trust and prove remediation.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 address the attack surface, NIST CSF 2.0, NIST SP 800-53 Rev 5 and NIST SP 800-63 set the technical controls, and ISO/IEC 27001:2022 define the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | OWASP mobile guidance is part of the broader OWASP security testing ecosystem. | |
| NIST CSF 2.0 | PR.DS | Data security outcomes map to the mobile testing focus on storage, transmission, and exposure. |
| NIST SP 800-53 Rev 5 | CA-2 | Security assessments and testing are core to validating mobile application controls. |
| ISO/IEC 27001:2022 | A.8.29 | Security testing in development and acceptance supports controlled validation of mobile apps. |
| NIST SP 800-63 | Mobile apps often mediate authentication flows tied to digital identity assurance. |
Use OWASP test methods to assess mobile attack surfaces that expose credentials, tokens, and identity flows.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on August 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
