July 21, 2026
Mobile application security has evolved significantly over the past decade. Modern applications routinely employ code obfuscation, runtime application self-protection (RASP), anti-tampering controls, jailbreak and root detection, debugger detection, certificate pinning, and a variety of other runtime defenses designed to protect intellectual property and sensitive user data.
Guardsquare is unique in how it applies mobile app security protections; our technology acts as a compiler, transforming code by applying multiple layers of obfuscation throughout your application, as well as injecting numerous small prefab security checks in diverse ways throughout your application. In order for this strategy to be successful, we rely on profiling data that is generated through an instrumented build of your application. This approach is necessary if you want the highest level of protection that will adequately delay attackers through complexities that hinder reverse engineering and tampering.
Yet many development teams still face a difficult tradeoff: how can they implement these meaningful security protections without negatively affecting application stability, performance, or user experience?
The answer begins with profiling. By knowing where in the application to target with obfuscations and security checks, we can scale those checks and layers of obfuscation up to the right level which provide meaningful, robust defenses.
The more insight that can be gained into the application, the more in-depth it can be protected. The relationship between time invested in profiling and protection level achieved have now fundamentally changed. With advances in AI-driven and agentic testing, you now have a realistic opportunity to automate the profiling of applications at scale, making it easier and faster than ever to deploy robust security protections with confidence.
The hidden cost of mobile security
Most security controls introduce some level of overhead.
Obfuscation performs transformations of code; these transformations can introduce breaking changes in cases where your application or an SDK makes use of reflection and, therefore, may not be safe to modify. Obfuscation and runtime checks can also impact performance of your application: if not addressed, it can lead to impacts to your app user experience. This is especially true if the app is not well optimized prior to protection or if you need to support an ecosystem of older devices that are more resource constrained. The better optimized your application is prior to protection and the more comprehensive the profiling data, the more room there is for additional integrity checks and the higher the level of protection that is possible for your app.
The challenge is not simply measuring whether an application launches successfully after security protections have been applied. The challenge is understanding how those protections affect the entire user experience and avoiding these pitfalls:
- Application startup time
- Screen rendering performance
- User interaction responsiveness
- Stability across devices and operating system versions
Without sufficient coverage of real user journeys in the instrumentation phase, teams are effectively deploying security changes blindly and limiting their potential for maximizing the security protection.
This is where profiling becomes critical.
Guardsquare builds an instrumentation and profiling phase into the workflow so the first time you configure protection, we generate an instrumented build for you and ask you to test the application sufficiently to generate the profiling data which we will use to guide the obfuscation and runtime check injection strategy.
Profiling before and verification after security integration
A successful mobile app security program will leverage instrumentation and profiling as a critical step.
Rather than assuming protections are harmless, teams perform in-depth testing of an instrumented app to generate a comprehensive profile that will identify stability points and performance sensitive areas of code. After applying security protections with good quality profiling data, the UX impact to the app is minimized and the best possible protection outcome can be achieved.
You can further verify this by examining key metrics for your app, through post-protection verification and production telemetry data:
- Cold start and warm start times
- CPU utilization
- Memory allocation patterns
- Frame rendering performance
- Battery consumption
- Crash frequency
- ANR (Application Not Responding) events
- User journey completion rates
The objective is straightforward: reduce any measurable impact introduced by security protections and address issues before you release, and verify the result after release through production monitoring and key performance metrics.
This approach enables organizations to confidently deploy stronger protections while maintaining the quality expectations users demand.
The reality: Most mobile teams lack complete test automation
Automated mobile app security testing provides a good solution to maximizing the generation of profiling data without requiring manual and repeated test efforts. A comprehensive automated test suite could execute every critical workflow, collect performance metrics, and compare behavior before and after security controls are enabled.
Unfortunately, many mobile teams still rely heavily on manual testing for release validation.
This isn't because teams don't understand the value of automation. Instead, mobile automation has historically been difficult to implement and hard to maintain.
Traditional UI automation frameworks often suffer from:
- Fragile selectors
- Frequent test breakage after UI updates
- Platform-specific implementations
- Significant maintenance overhead
- Long execution times
- High infrastructure costs
Over time, organizations frequently discover that maintaining the automation framework becomes nearly as expensive as the manual testing it was intended to replace.
As a result, many teams settle into a hybrid approach:
- Limited automated regression coverage
- Manual validation of critical user journeys
- Exploratory testing performed by QA teams
- Performance validation on an ad hoc basis
While this process may be sufficient for functional verification, it often falls short when the goal is collecting broad profiling coverage.
A new opportunity: LLM-powered exploratory testing
Recent advances in large language models (LLMs) are changing the conversation around mobile testing.
Unlike traditional automation frameworks that depend heavily on brittle UI selectors and hardcoded scripts, modern AI systems can reason about application interfaces in ways that more closely resemble human users.
Rather than instructing a test to:
"Click element ID button_checkout"
an agent can be given a higher-level objective:
"Add an item to the cart and complete checkout."
The agent can then observe the application, identify relevant UI elements, make decisions, and adapt as the interface changes.
This approach mirrors how human testers perform exploratory testing.
More importantly, it provides a path toward automating application exploration that previously required substantial manual effort.
For profiling use cases, this is particularly powerful.
Instead of focusing solely on pass/fail validation, organizations can use agentic testing systems to generate broad application coverage, generating good quality profiling data that is leveraged when applying security protections.
From test cases to application exploration
One of the most interesting developments in this space is the shift from individual test scripts toward application understanding.
Traditional automation answers the question:
"Can this specific workflow still execute?"
Agentic systems can answer a broader question:
"What areas of the application exist, and how can they be explored?"
This distinction matters enormously for app profiling.
When validating the impact of obfuscation, runtime checks, or other protections, teams often need coverage across many application states—not just a handful of predefined happy-path scenarios.
Modern AI-driven systems can discover navigation paths, identify screens, and explore workflows that may never have been explicitly encoded into a test suite.
The result is broader profiling coverage and a greater likelihood of identifying performance-sensitive code.
Revyl and the emergence of agentic mobile testing
One company helping drive this evolution is Revyl.
Revyl's platform uses AI-driven mobile testing approaches that allow teams to define workflows in natural language rather than relying exclusively on traditional selector-based automation. The platform executes workflows on iOS and Android environments while generating replayable evidence and execution reports.
Particularly interesting for profiling and security validation is Revyl Atlas, which creates runtime maps of mobile applications by observing tests and live sessions. These maps capture screens, navigation paths, transitions, and user journeys across the application.
For teams deploying security protections, this creates several advantages:
1. Automated journey discovery
Rather than manually documenting application flows, teams can automatically generate maps of how users traverse the application.
This helps identify high-value journeys that should be included in security profiling exercises.
2. Expanded coverage
Agentic exploration can reach areas of the application that may not exist in traditional regression suites.
Greater coverage leads to better outcomes when applying app protections.
3. Repeatable profiling
Once journeys have been discovered, they can be executed repeatedly across builds.
This allows teams to compare:
- Protected versus unprotected builds
- Different security configurations
- Platform releases
- Device classes
4. Continuous security validation
Profiling no longer needs to occur only before major releases.
Teams can continuously measure the impact of security controls throughout development and CI/CD pipelines.
Security and reliability are not opposing goals
A common misconception is that security and user experience are inherently in conflict.
In reality, the most successful mobile organizations treat them as complementary objectives.
Security protections that degrade application performance ultimately create business risk.
Likewise, highly performant applications that lack adequate protections expose users and organizations to security threats.
Profiling provides the bridge between these two priorities.
By measuring real user journeys under realistic conditions, teams can make informed decisions about which protections to deploy, how aggressively to configure them, and where optimization may be required.
The future of mobile security validation
As agentic testing continues to mature, the economics of profiling are changing.
Historically, achieving broad application coverage required large QA organizations, extensive automation engineering, or significant manual effort.
Today, AI-driven exploration is making it possible to generate meaningful application coverage with dramatically less overhead.
For mobile security teams, this is particularly significant.
The barrier to validating obfuscation, runtime protections, anti-tampering controls, and other security mechanisms is becoming lower.
Instead of asking whether security protections might impact the application, organizations can increasingly measure those impacts directly and continuously.
The result is a better outcome for everyone involved:
- Stronger security protections
- Higher confidence before release
- Reduced manual testing effort
- Earlier detection of regressions
- Improved user experience
- Faster development cycles
Security should never be deployed blindly. With modern profiling techniques and emerging agentic testing platforms, it no longer has to be.
Tag(s):
Technical
