NowSecure

NowSecure is a commercial mobile security platform that combines automated security testing with privacy analysis. It runs static, dynamic, and interactive analysis on iOS and Android applications, with a particular focus on tracking how apps handle user data.

The platform is used by 4 of the top 5 U.S. telecommunications companies, 3 of the top 5 U.S. banks, and several U.S. government agencies including the DOJ, DOD, and DOS. Named customers include Bell Canada, Warner Bros. Discovery, T-Mobile, and Genisys Credit Union.

NowSecure reports over 4 million automated mobile app assessments and 8 million automatically identified vulnerabilities across its customer base.

Key Features

What is NowSecure?

NowSecure is a mobile-only security platform. While many application security vendors treat mobile as an add-on to their web testing tools, NowSecure was built specifically for mobile apps from the start.

The platform comes in several forms:

• NowSecure Platform — Cloud-based automated testing with SAST, DAST, IAST, and privacy analysis
• NowSecure Guided Testing — Automated testing combined with expert analysis from NowSecure’s security team
• NowSecure Workstation — On-premises pen testing toolkit with Frida and Radare built in
• NowSecure PTaaS — Continuous penetration testing delivered as a managed service
• NowSecure MARI — Mobile App Risk Intelligence for vetting third-party apps in your enterprise

Privacy Analysis

This is where NowSecure stands apart from most mobile security tools. The privacy engine tracks how applications handle user data at runtime:

• Personal information collected by the app and its SDKs
• Third-party services receiving user data
• Data transmitted without encryption
• Information stored in unprotected locations on the device
• Tracking identifiers and fingerprinting techniques
• Compliance gaps with GDPR, CCPA, HIPAA, and NIST standards

Security Testing

The automated testing engine evaluates apps against OWASP MASVS requirements. It detects issues including:

• Insecure data storage (SharedPreferences misuse, Keychain issues)
• Weak or missing certificate pinning
• Sensitive data leaking into logs and crash reports
• Hardcoded credentials and API keys
• Improper session management
• Vulnerable third-party libraries and SDKs

Results come with remediation instructions and code samples. NowSecure Academy provides embedded training videos for development teams to learn how to fix the issues found.

Integrations

NowSecure plugs into the development pipeline through pre-built integrations:

CI/CD Platforms

GitHub Actions

Azure DevOps

Jenkins

CircleCI

GitLab

Bitrise

Issue Tracking & Alerts

Jira

GitHub Issues

Azure Boards

GitLab Boards

Slack

Security Ecosystem

Black Duck CodeDX

ThreadFix

Getting Started

CI/CD Integration

GitHub Actions

NowSecure provides an official GitHub Action (nowsecure/nowsecure-action, currently at v5):

name: NowSecure Mobile Security
on:
  push:
    branches: [main]
jobs:
  security-test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Build Android App
        run: ./gradlew assembleRelease
      - name: NowSecure Auto Scan
        uses: nowsecure/nowsecure-action@v5
        with:
          token: ${{ secrets.NOWSECURE_TOKEN }}
          app_file: app/build/outputs/apk/release/app-release.apk
          group_id: ${{ secrets.NOWSECURE_GROUP_ID }}

The action integrates with GitHub Advanced Security (GHAS) to display findings as code scanning alerts.

CLI Tool (ns-cli)

NowSecure distributes a standalone CLI (nowsecure-platform-cli) for use in any CI/CD system:

# Configure (one-time setup)
ns-cli configure

# Upload and scan an app
ns-cli app process --file app-release.apk

# List assessments
ns-cli assessment list --json

The CLI is available as a binary for macOS, Linux (deb), and Windows.

When to Use NowSecure

NowSecure fits best when mobile app privacy and data protection are top priorities:

• Regulated industries where GDPR, CCPA, or HIPAA compliance is mandatory
• Enterprise app vetting to understand what third-party mobile apps are doing with corporate data
• Large mobile portfolios that need automated, continuous security across many apps
• OTT applications on streaming devices, smart TVs, and gaming consoles
• Teams that want expert backup through guided testing or penetration testing as a service

For teams with limited budgets or those looking for open-source options, MobSF is a free alternative for basic static and dynamic analysis. For Android-specific vulnerability scanning, Oversecured focuses on deep binary analysis.

Frequently Asked Questions