OWASP MASTG

Expanded Definition

OWASP mastg, or the OWASP Mobile Application Security Testing Guide, is a testing methodology and reference body for evaluating mobile app security across Android and iOS. It is not a compliance standard in itself; rather, it gives teams a shared structure for testing common weakness areas such as insecure local storage, weak cryptography, poor transport handling, logging exposure, authentication flaws, and runtime tampering resistance.

Its value lies in translating abstract mobile risk into repeatable test cases that developers, appsec teams, and assessors can apply consistently. The guide is most useful when a team needs to verify how an app behaves on a real device, under instrumentation, or after adversarial modification. Definitions and implementation practices continue to evolve across mobile ecosystems, so teams should treat MASTG as a practical baseline rather than a final answer for every platform pattern.

The most common misapplication is treating MASTG as a simple checklist for release approval, which occurs when teams skip threat modelling and only test the same controls without considering app-specific attack paths.

Examples and Use Cases

Implementing OWASP MASTG rigorously often introduces test effort and device coverage overhead, requiring organisations to weigh release speed against a more realistic view of mobile risk.

• Testing whether sensitive data is written to local storage in plaintext or protected only by weak application logic.
• Reviewing how an app handles certificates, TLS validation, and API traffic interception during debugging or hostile network conditions.
• Checking whether logs, screenshots, backups, or crash reports expose tokens, personal data, or session context.
• Assessing whether jailbreak or root detection meaningfully raises attacker cost, rather than serving as a cosmetic control.
• Validating runtime protections against repackaging, tampering, and code injection, especially for apps handling high-value transactions.

For teams building mobile experiences that support identity verification, session initiation, or device-bound access, the guide helps expose where trust assumptions break down on the endpoint. It also pairs well with broader identity guidance such as the OWASP Non-Human Identity Top 10 when mobile clients are used to mint, store, or present credentials that later authorize machine or service access.

Why It Matters for Security Teams

Mobile apps often become the weakest link in otherwise mature security programs because they run in hostile environments and are easy to reverse engineer, instrument, and modify. OWASP MASTG gives security teams a shared way to identify weaknesses before attackers exploit them in account takeover, session theft, data extraction, or fraud workflows. For identity-heavy applications, this matters because mobile clients frequently carry authentication state, enrollment flows, push-based approval logic, or device-bound secrets that can be abused if the app is not tested carefully.

The guide also helps teams move beyond surface-level assurance. A feature may appear secure in code review but fail under instrumentation, debug hooks, or repackaging. That gap is especially important when mobile apps interact with agents or automated workflows, where a compromised client can become a launch point for broader compromise. Where agent-driven mobile interactions are present, it is increasingly useful to compare findings with the OWASP Agentic AI Top 10 to understand how client-side compromise can cascade into misuse of tool access or delegated authority.

Organisations typically encounter the real cost of MASTG-relevant failures only after a mobile breach, at which point secure storage, runtime hardening, and traffic protections become operationally unavoidable to address.

Related resources from NHI Mgmt Group

• What are the core risks identified by the OWASP Agentic Top 10?
• How should IAM and AppSec teams work together on OWASP Top 10 findings?
• How should security teams choose an OWASP scanner for modern application delivery?
• When does an OWASP scanner fail to provide meaningful risk reduction?