BrowserStack announced the launch of BrowserStack AI, a suite of AI agents integrated throughout the testing lifecycle to help software teams accelerate release cycles, improve test coverage, and boost productivity by up to 50%.
Mobile app security is broken. For example, in August, Mercator Advisory Group released a study showing that 70% of financial and money management apps fail to meet basic security standards. Another study from March, 2021 found 63% of more than 3,000 popular Android apps contained open source code with known vulnerabilities. It's a dangerous state of affairs for everyone: consumers, developers and publishers.
Consumers haven't yet revolted, but that's only because they can't differentiate between secure and insecure apps. A recent Appdome survey shows that 73% of consumers would stop using a mobile app if it left them unprotected against attack, and 46% would tell their friends to stop using it as well.
Big consumer technology companies know this, which is why Apple is in the midst of a huge push to market its devices, including the iPhone, on how well they protect consumers' privacy and security. There's a big opportunity for app publishers to do the same, by marketing the security of their apps. But to do so, they will need to deliver on their security promises, and with current methodologies, that's going to be almost impossible to accomplish.
Why Traditional Security Approaches Don't Work In Mobile Apps
The problem is that there's a massive mismatch between the way mobile apps are developed and the way developers implement security. Mobile DevOps uses CI/CD tools to automate the development of mobile apps and of their deployment into production. Security, however, is still almost entirely manual, which is very slow. Certainly, many organizations do use SDKs (software development kits) to try to speed the process up, but SDKs still require manual integration and implementation can be complex, especially when it comes to encryption.
The current process typically looks like this:
■ Security recommends security standards
■ Developers manually code some of the security into the app
■ Manual penetration testing and code scans reveal vulnerabilities
■ The app is sent back to developers to fix vulnerabilities, but, in the meantime, new features — and new vulnerabilities — have been added
As a result the app is, at best, delayed, which may cause it to miss a crucial market window, or more commonly it will be released with vulnerabilities. Developer laziness is not the reason most security requirements don't make it into releases — the system and tools used to implement security are simply not up to the task, nor can they match the pace of mobile DevOps.
The way forward is to automate the process of security implementation to achieve mobile DevSecOps. Here are five steps an organization can take to get there.
5 Steps to Achieving Mobile DevSecOps
Step 1: Clear Understanding of the Desired Security Outcome
All teams — developers, security and operations — have to come to an agreement about their expectations for mobile security. It has to be a priority. Many organizations model their requirements based on industry standards such as the Mobile AppSec Verification Standard (MASVS), the TRM Guidelines for Mobile App Security or the OWASP Mobile Top 10 Risks. But whatever standard the organization chooses, everyone needs to fully understand the impact the recommended solution will have on their workflows.
Step 2: Automate Security Implementation
Manually coding security is a titanic task. To speed implementation, organizations should evaluate and take advantage of automated, AI-powered systems that can integrate security into a mobile app. In many cases, these platforms are no-code, eliminating the need for any manual implementation at all.
Step 3: Integrate with Your Existing Workflows
Whatever platform the organization chooses to use, it must be integrated with continuous integration (CI) and continuous delivery (CD) processes to achieve an accelerated mobile app lifecycle. Additionally, the relevant development, security and operation teams should collaborate closely throughout sprints to complete mobile security projects. Through the creation of reusable mobile security templates and models that specify the security features required in each Android and iOS app, organizations can further accelerate security implementation.
Step 4: Instant Verification and Validation of the Desired Security Outcome
The last major roadblock to a successful mobile DevSecOps program is the conflict that can arise during the release meeting. Development teams are under enormous pressure to issue new releases at a rapid pace, and without instant verification and validation that the required security is, indeed, implemented in the app, security concerns can hold up a release. Make sure that verification and validation are automatically conducted and documented to avoid last-minute release hiccups.
Step 5: Budget Certainty (Fixed Cost)
A successful DevSecOps program provides budget certainty and predictability. Ideally, an automated approach will eliminate variable dev and headcount costs, as well as the uncertain outcomes often associated with manual coding of mobile app security.
Mobile apps must become more secure, but achieving this goal will require a different, automated approach that enables DevSecOps. For those organizations that succeed in this journey, however, they will be able to provide customers with a secure product, and with some savvy marketing, organizations that provide a high level of protection will be rewarded in the marketplace.
Industry News
Coder introduced a major platform upgrade designed specifically for enterprise teams working with AI coding agents.
LambdaTest has announced the release of SmartUI’s Smart Branching and Baseline Management.
Lens by Mirantis announced the availability of Lens Prism, a fully-integrated, production-grade artificial intelligence (AI) assistant embedded directly within the Lens integrated development environment (IDE).
vFunction announced GenAI-powered capabilities to refactor and rearchitect applications.
Payara announced a strategic partnership to help enterprises modernize their Java applications with a codeless, lift-and-shift migration solution, reducing infrastructure and cloud costs and boosting performance and scalability.
Backslash introduced a new, free resource for vibe coders, developers and security teams - the Backslash MCP Server Security Hub.
Google's Gemma 3n is the latest member of Google's family of open models. Google is announcing that Gemma 3n is now fully available for developers with the full feature set including supporting image, audio, video and text.
Google announced that Imagen 4, its latest text-to-image model, is now available in paid preview in Google AI Studio and the Gemini API.
Payara announced the launch of Payara Qube, a fully automated, zero-maintenance platform designed to revolutionize enterprise Java deployment.
Google released its new AI-first Colab to all users, following a successful early access period that had a very positive response from the developer community.
Salesforce announced new MuleSoft AI capabilities that enable organizations to build a foundation for secure, scalable AI agent orchestration.
Harness announced the General Availability (GA) of Harness AI Test Automation – an AI-native, end-to-end test automation solution, that's fully integrated across the entire CI/CD pipeline, built to meet the speed, scale, and resilience demanded by modern DevOps.
With AI Test Automation, Harness is transforming the software delivery landscape by eliminating the bottlenecks of manual and brittle testing and empowering teams to deliver quality software faster than ever before.
Wunderkind announced the release of Build with Wunderkind — an API-first integration suite designed to meet brands and developers where they are.
Jitterbit announced the global expansion of its partner program and new Jitterbit University partner curricula.