How OWASP MASTG Shapes the Scope of Your Mobile App Penetration Test

Why OWASP MASTG matters when you buy a mobile app penetration test

OWASP MASTG matters because methodology is the biggest variable in what a mobile app penetration test delivers, and the Mobile Application Security Testing Guide is how you tell rigorous manual testing apart from an automated scan before you sign. Two proposals can carry the same price and describe different work.

If you are a founder, CTO or product owner commissioning a test, the contrast can be as wide as one firm running an automated scanner against your APK while another reverse engineers the binary, intercepts API traffic, tests local data storage on a jailbroken device and verifies your cryptographic implementations.

MASTG is published by OWASP, the non-profit foundation behind the better known OWASP Top 10. It is a detailed technical manual of test cases for iOS and Android applications, paired with its sister project, the Mobile Application Security Verification Standard (MASVS), which defines what a secure mobile app should do. Together they turn a vague request for “a mobile pen test” into a defined, checkable scope.

Is MASTG mandatory? An honest answer

No. MASTG is voluntary. No UK regulator or law requires your mobile app to be tested against it, and OWASP itself does not certify or enforce anything. It is a testing methodology and a body of accepted evidence, not a compliance obligation.

That said, it has become the reference point that everyone else leans on. Enterprise vendor security reviews frequently ask whether your app has been tested “against OWASP MASVS” or “using MASTG”. Frameworks that do carry obligations, such as PCI DSS for payment apps or contractual security schedules from banking and healthcare clients, rarely name their own mobile test cases; assessors and procurement teams accept MASTG-aligned reports as credible evidence instead. So while nothing forces you to test against MASTG, choosing a provider who does gives you a report that travels: it satisfies the customer due diligence questionnaires and audit requests you will meet later, without re-testing.

If a proposal does not mention MASTG, MASVS or an equivalent published methodology, ask what the tester will actually do. Our penetration testing checklist covers the wider questions worth asking any provider before you commit.

How MASTG and MASVS define your scope

MASVS defines the requirements; MASTG defines the tests that verify them. MASVS groups its controls into seven categories, and each category translates directly into scoped testing activity:

• MASVS-STORAGE: how the app stores sensitive data on the device, including keychains, keystores, caches, logs and backups.
• MASVS-CRYPTO: whether cryptography is implemented with proven primitives and correct key management.
• MASVS-AUTH: authentication and session handling between the app and its backend.
• MASVS-NETWORK: transport security, certificate validation and pinning.
• MASVS-PLATFORM: safe use of platform APIs, WebViews, IPC mechanisms and deep links.
• MASVS-CODE: secure coding practices, dependency hygiene and update mechanisms.
• MASVS-RESILIENCE: defence against reverse engineering and tampering, relevant for apps that handle payments, DRM or fraud-sensitive logic.

MASVS also defines testing profiles. MASVS-L1 covers the baseline every app should meet. MASVS-L2 adds defence-in-depth controls for apps handling sensitive data, such as finance or health apps. MASVS-R covers resilience controls for apps that must resist a hostile device owner. Deciding which profile fits your app is the first real scoping decision, and it moves the day count more than any other factor.

One point buyers often miss: your mobile app is only half the attack surface. Most meaningful mobile findings sit in the backend APIs the app talks to. A MASTG-aligned engagement should pair device-side testing with API penetration testing of the services behind the app, because an attacker will not politely restrict themselves to the handset.

How a MASTG-aligned engagement runs

A MASTG-aligned engagement runs in five stages: scoping, environment setup, testing, reporting and retesting. Scoping agrees platforms (iOS, Android or both), the MASVS profile, backend API coverage and whether you will supply source code, which makes testing faster and deeper.

Environment setup covers test builds, test accounts and, ideally, a staging backend so testing never touches production customer data. Testing combines static analysis of the binary and any supplied source, dynamic analysis on instrumented physical devices, traffic interception between app and backend, and manual exploitation of anything the tooling surfaces. Reporting maps each finding to the relevant MASVS control, with severity, evidence and remediation guidance your developers can act on, and retesting of fixed issues is included as standard.

In practice, the environment stage is where timelines slip. Missing test accounts, wrong build types or a rate-limited backend all eat days, so a good provider sends a pre-engagement checklist to make sure day one is spent testing, not waiting.

What it costs and how scope drives the price

UK mobile app penetration testing is priced on tester days. Typical day rates from a CREST-accredited firm run £1,100 to £1,400, and the MASVS profile, platform count and API surface set the day count:

Scope	Typical days	Typical cost
Single platform, MASVS-L1	4 to 6	£4,400 to £8,400
Single platform plus backend API, L1 with selected L2 controls	6 to 8	£7,200 to £11,200
Dual platform plus backend API, MASVS-L2	7 to 10	£7,700 to £14,000
Dual platform plus API, MASVS-L2 and MASVS-R resilience testing	10 to 14	£12,000 to £19,600

These are typical UK ranges rather than fixed prices; the exact figure depends on your app’s size, the number of user roles and how much of the backend is in scope. For a wider view of what drives pen test pricing across engagement types, see our guide to penetration testing costs in the UK, or get an exact figure through our quote form.

How EJN Labs approaches MASTG-based mobile testing

EJN Labs is a UK-based, CREST-accredited penetration testing firm, and our mobile application penetration testing service is built directly on MASTG. When we scope a mobile engagement, we start from the MASVS profile that matches the data your app handles, then walk your architecture with you: platforms, backend services, identity providers and where sensitive data actually lives. That conversation regularly reduces quoted days, because it separates what genuinely needs manual testing from what does not.

Testing is carried out by UK-based testers on physical instrumented devices, not emulators alone, because storage, keystore and biometric behaviour differs on real hardware. Every finding in our reports is mapped to the MASVS control it fails, which means your report doubles as evidence for customer security reviews and framework audits without rework. We operate under ISO 27001 and Cyber Essentials Plus ourselves, so your test builds and data are handled inside an independently certified security management system. If you are comparing firms, our guide to choosing the best UK penetration testing provider sets out what to look for.

Frequently Asked Questions

Is OWASP MASTG mandatory for mobile app penetration testing?

No, OWASP MASTG is not mandatory. It is a voluntary methodology published by OWASP, and no UK law or regulator requires it. It has become the de facto standard, though, so a MASTG-aligned test report satisfies far more downstream due diligence requests than one without it.

Because of that status, enterprise customers, assessors and procurement teams widely accept MASTG-aligned reports as evidence of mobile app security, even though choosing a provider who tests against it remains optional.

What is the difference between OWASP MASTG and MASVS?

MASVS is the standard and MASTG is the testing guide. MASVS defines the security requirements a mobile app should meet, and MASTG provides the technical test cases used to verify each requirement on iOS and Android. Put simply, MASVS says what good looks like, MASTG says how the tester proves it.

MASVS groups its requirements into categories such as storage, cryptography, authentication and resilience, and a well-scoped engagement uses the two documents together.

What does an OWASP MASTG penetration test cost?

Expect £4,400 to £8,400 for a single-platform app scoped to MASVS-L1, which usually takes 4 to 6 days at UK CREST-accredited day rates of £1,100 to £1,400. A dual-platform app with backend APIs at MASVS-L2 usually takes 7 to 10 days, so £7,700 to £14,000.

The exact price depends on app size, user roles and API surface, so request a scoped quote.

Which MASVS level does my app need?

Most apps need MASVS-L1, the baseline level. Choose MASVS-L2 if your app handles sensitive data, such as finance, health or apps serving regulated clients, and add MASVS-R where the device owner may be the attacker, for example payment, DRM or anti-fraud apps.

MASVS-L2 adds defence-in-depth controls on top of the baseline, while MASVS-R adds resilience against reverse engineering and tampering. Many engagements combine L2 with selected resilience controls.

How long does a MASTG-based mobile app penetration test take?

Allow one to three weeks of testing time for most MASTG-based engagements. A single-platform MASVS-L1 test typically takes 4 to 6 days, while dual-platform tests with backend API coverage take 7 to 10 days or more, before lead time and reporting are added.

On top of the testing window, add a few days of lead time for environment setup, test accounts and builds, and around a week after testing for the report and a remediation retest.

Get a MASTG-aligned mobile app test scoped properly

If your customers are asking for evidence of mobile app security, or you want your next release tested against the methodology their security teams already trust, we can scope it in one short call. Tell us your platforms, backend and data sensitivity through our CREST penetration testing quote form and we will come back with a defined MASVS profile, day count and fixed quote.