$ pentest --target=mobile

iOS and Android mobile app pen test. Per-platform pricing with a backend-API scope question that often dwarfs the mobile layer itself.

$ answer --question="What does a mobile app pen test cost?"

A single-platform mobile pen test (iOS or Android) runs $6,000 to $20,000 in 2026 from mid-market vendors, sourced from vendor-published cost guides. Combined iOS+Android engagements typically discount the standalone sum by 15 to 25%. Backend-API scope (where the real business-logic risk usually sits) is normally a separate cost line.

Last verified June 2026

$ stat --slot=1

$6-20K

Single-platform band

iOS or Android

$ stat --slot=2

15-25%

Combined discount

vs standalone sum

$ stat --slot=3

OWASP MASVS

Coverage framework

Mobile App Security Verification

$ stat --slot=4

Separate

Backend API scope

Usually billed separately

$ drivers --price

Platform count
iOS, Android, or both. Combined cheaper than standalone sum.
Binary protections
Code-obfuscation, anti-tamper, jailbreak detection. Each layer adds reverse-engineering effort.
Local-storage and crypto review
Keychain, KeyStore, SQLCipher use. Common attack surface.
Backend API scope
Usually the largest add-on. See API pen test for that side.
Inter-app communication
Universal Links, deep links, intent handling.