Do You Know If Your Mobile App Is Under Attack Right Now?

Earlier this week, Guardsquare hosted a webinar titled "Under Attack and Unaware: What's Really Happening to Your Mobile App Right Now." We ran it in two time zones for the first time, one session for APAC and one for ET and CET. The turnout and the questions in both sessions told us the same thing— teams want to know what happens to their apps after they ship.
Here is the short version of what we covered. 

Locks and cameras

Think about securing a house. You install strong locks and reinforce the door. That is protection. In mobile, it means obfuscation, string encryption, and runtime checks that detect root, block function hooks, and stop dynamic instrumentation. These controls make attacks harder.

But a lock never tells you that someone tried the handle 30 times last night. For that, you need a camera.

Mobile app protection works locally. The app detects a threat, reacts on the device, and that is the end of it. Monitoring takes the same event and sends it somewhere you can process and store it. Protection stops the attacker. Monitoring shows you who showed up, how often, and whether they came alone.

"If my app is protected, why monitor?"

We asked ourselves this question during the session, because it is the one we hear most.

Every event in a monitoring dashboard has already been handled. The root detection fired and the session ended. Nothing needs fixing. The value sits in what those events tell you together. One blocked attempt is noise. Hundreds of them, sorted by threat type, app version, and device, give you a picture of where attackers focus.

That picture helps you in three ways:

• Assess the risk: Which threats are most common? How many devices are involved, and are they new or recurring?

• Evaluate your reaction: Block too aggressively and you may lock out legitimate users. React too passively and real threats slip through.

• Adjust for the next release: Reaction strategies change per build, so what you learn today shapes what you ship next.

Why this matters more now

LLMs changed the economics of attacking apps. They lower the cost of reverse engineering and runtime tampering, and they lower the bar for inexperienced attackers. Agents can also automate the try-fail-retry cycle. They observe, act, intercept, and switch tactics when an approach goes nowhere.

Back to the house analogy, one burglar with a crowbar is a problem you can plan for. A crew that adapts to every lock you add, and never gets tired, is a different problem. You need footage to see it coming.

What a pattern looks like

In the demo, we showed a view of threats grouped by user. Each profile showed around 30 threat events across 8 to 12 different device models, from a single IP address on a single app version. No individual event looks alarming. Together, they show one person cycling through devices and probing your defenses. A local reaction can never show you that.

We also covered privacy, which came up in both sessions. You can track activity with a meaningless identifier, such as an internal customer number, or a hashed value of an email address. Events that happen before authentication still matter too, and a device ID helps you connect them.

The cost of finding out late

If your fraud team or your users tell you about an attack, the damage is already done. The goal is to shift security left and spot patterns before they spread. Monitoring helps you answer three questions:

1. Is my app under attack, and should I change my reaction strategies?

2. Is one of my builds compromised?

3. Which protections should I focus on in future releases?

The takeaway

While protection is essential and a must to lay down your mobile app security foundation,  monitoring takes your security posture further, because real-time data helps you prevent attacks and limit their impact.

Protection does its job quietly, and it cannot tell you how attacks against your app are changing. Monitoring closes that gap. It turns individual blocked attempts into a feedback loop, so you harden your app based on what attackers actually try, not on what you guess they might.

That matters because attacking apps keeps getting cheaper and faster. Defenses that never change fall behind. Every release gives you a chance to adjust, and monitoring tells you where to spend it, which reactions to tighten, which to relax for legitimate users, and which builds deserve a closer look.

Nobody argues against locks. But a locked door with no camera leaves you guessing whether anyone ever tried it. The teams that stay ahead will know who is at the door before the fraud team calls.

Protection tells your app how to react. Monitoring tells you whether those reactions are working.

Watch our on-demand webinar now.