# Overview

Talsec offers a Subscription model for the Application Safety SDK Suite. It includes comprehensive mobile solution security elements that are unexampled on the market. Our Mobile Application safety suite includes RASP SDK (Runtime App Self Protection), Security Hardening SDK, API protection SDK and Audit/Monitoring web portal application intended for the visualization of threat insights, SIEM integration, data analytics, monitoring and incidents investigations.

{% hint style="info" icon="newspaper" %}

#### Talsec News

#### Apps Security Threats Report 2025

A data-driven look at the global state of
mobile app security. <https://www.talsec.app/talsec-global-threat-report-2025>
{% endhint %}

{% hint style="info" %}
Premium Users: View [premium documentation here](https://docs.talsec.app/premium-integration-documentations/).
{% endhint %}

<figure><img src="https://1666089280-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FxFHPMAbn16uoDyOtoiaC%2Fuploads%2F0gSMkjdU1KHnZNG2mDZN%2F816fdd78-a034-4d0f-aecc-9e651a5e21e6.png?alt=media&#x26;token=dd471a85-7390-4ef7-a1a3-1f74ce854cd3" alt=""><figcaption><p>Talsec Application Safety SDK Suite</p></figcaption></figure>

* **RASP+ SDK**. Provides in-App protection and shielding.  Talsec SDK combats reverse engineering, device/OS integrity compromise (like rooting, running in an emulator, using a debugger or dynamic hooking), and Malware attacks such as Accessibility services misuse, screen readers, and Overlay attacks. RASP SDK subscription includes SDK integration with the Audit portal based on the Elastic Cloud managed service controlled by the Customer.
* **AppiCrypt®**. It aims to combat API abuse, provides online Risk scoring, Fraud prevention, and implements RASP hardening by checking RASP suppression at the backend. It is efficient against manual and automatic API abuse like botnets, JSON injections, session hijacking, and more. The feature enables the implementation of the TLS session binding to the device and UserID binding to&#x20;
* **App Security Hardening SDK**
  * Dynamic TLS pinning SDK. Protect against a man-in-the-middle attack.
  * Secrets Vault for App Secrets protection inside SDK (e.g. encryption keys, API keys, hostnames, end-points) with remote management possibilities.
  * Usable for App Data encryption and decryption (e.g. to protect App assets or user’s data at rest on the device)&#x20;
  * Usable for Application Layer end-to-end encryption (e.g. to protect sensitive payload from MiTM or malicious admin on backend)
* **Malware Detection SDK** - active protection against known malware, ongoing malware campaigns, counterfeit app clones, and other potentially risky apps is essential for the overall security posture.
* **Maintenance updates  and support SLA** are included in the subscription.<br>

## Talsec's Multi-Layered App and API Protection Model

* **L0 - Detect Attacks**: Check app security state with [**freeRASP**](https://app.gitbook.com/s/Q2PxZTOjhquOxcxftTrm/freerasp/introduction) & [**Talsec Portal**](https://app.gitbook.com/s/Q2PxZTOjhquOxcxftTrm/freerasp/data-visualisation-portal) insights
* **L1 - Protect App**: Pass pentests, combat reverse engineering, and comply with regulations with [**RASP+**](https://docs.talsec.app/premium-products/product/rasp) and [**AppHardening (Secret Vault, Dynamic TLS Pinning)**](https://docs.talsec.app/premium-products/product/app-hardening-suite)
* **L2 - Protect Transactions**: Combat API abuse, bots, web-scraping and MiTM with [**AppiCrypt**](https://docs.talsec.app/premium-products/product/appicrypt)
* **L3 - Protect Users: Combat social engineering, phishing, malware with** [**Device Risk Scoring**](https://docs.talsec.app/premium-products/product-previews/ai-device-risk-summary-new) **and** [**Malware Detection**](https://docs.talsec.app/premium-products/product/malware-detection)

{% embed url="<https://youtu.be/cNY4bgUhWek>" %}

## The threats that Talsec helps to mitigate include but are not limited to:

* Reverse Engineering attempts
* App repackaging and cloning
* Session (or JWT) hijacking
* API-abuse, DDoS and botnets
* API attacks by App impersonation
* Man-in-the-middle attacks
* API brute forcing and Password enumeration attacks&#x20;
* Re-publishing of cloned apps to alt-stores
* Running the App in compromised OS environments (e.g., rooted/jailbroken OS, hooking frameworks like Frida and others)&#x20;
* Running App in emulators, simulators, and in debugging mode
* Unauthorized access to App’s data
* Dynamic attack or App hooking at runtime (using tools like Frida, Xposed, ...)
* Overlay and Cloak & Dagger attack prevention
* Misuse of Accessibility Services
* App instance relocation (device unbinding)
* SIM swapping

## Premium Products

Discover Talsec premium products: RASP+, AppiCrypt, MalwareDetection, and AppHardening (Dynamic TLS Pinning, Secret Vault).

<table data-card-size="large" data-view="cards"><thead><tr><th></th><th></th><th></th><th data-hidden data-card-cover data-type="image">Cover image</th><th data-hidden data-card-target data-type="content-ref"></th></tr></thead><tbody><tr><td>RASP+ SDK. Provides in-App protection and shielding.</td><td></td><td></td><td><a href="https://1666089280-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FxFHPMAbn16uoDyOtoiaC%2Fuploads%2FTjJ2fgyiqhHvqYe25GSN%2FRasp%2B.png?alt=media&#x26;token=d8300c47-5d62-479f-92da-7011853f3a88">Rasp+.png</a></td><td><a href="../product/rasp">rasp</a></td></tr><tr><td>AppiCrypt® aims to combat API abuse.</td><td></td><td></td><td><a href="https://1666089280-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FxFHPMAbn16uoDyOtoiaC%2Fuploads%2Fyu17Nyh07p89TGPfZtyt%2FAppiCrypt.png?alt=media&#x26;token=35219596-3537-4004-910e-5e5d9ba8c663">AppiCrypt.png</a></td><td><a href="../product/appicrypt">appicrypt</a></td></tr><tr><td>Active protection against known malware, counterfeit app clones and other potentially risky apps.</td><td></td><td></td><td><a href="https://1666089280-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FxFHPMAbn16uoDyOtoiaC%2Fuploads%2FQxYcuAvI73bVMCSbe1IG%2FMalwareDetection.png?alt=media&#x26;token=04ce942c-4daf-46ef-93d5-9ae6bd36a364">MalwareDetection.png</a></td><td><a href="../product/malware-detection">malware-detection</a></td></tr><tr><td>AppHardening includes Dynamic TLS Pinning and Secret Vault.</td><td></td><td></td><td><a href="https://1666089280-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FxFHPMAbn16uoDyOtoiaC%2Fuploads%2FG0vffQULslfNgbWkDakU%2FAppHardering.png?alt=media&#x26;token=d0381a5e-2a3b-4610-846a-d6fef8796122">AppHardering.png</a></td><td><a href="../product/app-hardening-suite">app-hardening-suite</a></td></tr><tr><td>AppiCryptWeb aims to combat API abuse from Web</td><td></td><td></td><td><a href="https://1666089280-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FxFHPMAbn16uoDyOtoiaC%2Fuploads%2F7V7iK7yBUYkdgLWfJFwN%2FImage%2007.11.2025%20at%2012.15.jpg?alt=media&#x26;token=6fc59e36-6c5e-406a-8aad-6c2330c4774f">Image 07.11.2025 at 12.15.jpg</a></td><td><a href="https://docs.talsec.app/premium-products/product/appicryptweb">https://docs.talsec.app/premium-products/product/appicryptweb</a></td></tr></tbody></table>

## Product Previews🆕

Get an exclusive peek at what’s next—future products, early previews, and insights from our roadmap. Connect with our experts to learn more.

<table data-card-size="large" data-view="cards"><thead><tr><th></th><th data-hidden data-card-cover data-type="files"></th><th data-hidden data-card-target data-type="content-ref"></th></tr></thead><tbody><tr><td>AI Device Risk Summary 🤖</td><td><a href="https://1666089280-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FxFHPMAbn16uoDyOtoiaC%2Fuploads%2FcxJjc71qi0YvdcsSzMgD%2FAppHardering.png?alt=media&#x26;token=c8de5c23-f25d-4120-9769-d3a32c1f7054">AppHardering.png</a></td><td><a href="../product-previews/ai-device-risk-summary-new">ai-device-risk-summary-new</a></td></tr></tbody></table>

### OWASP Mobile top 10 risks mapping

OWASP community published the top 10 mobile App risks. All of them represent a risk of certain fraudulent behaviour or attack.  In the table below we map which of these issues Talsec RASP SDK and AppiCrypt®  SDK help to address.&#x20;

<table data-header-hidden><thead><tr><th width="241.857421875"></th><th width="100.4951171875"></th><th width="119.142578125"></th><th width="147.1552734375"></th><th width="121.203125"></th></tr></thead><tbody><tr><td><p><mark style="color:red;">Mobile OWASP</mark> </p><p><mark style="color:red;">Top10 2024</mark></p></td><td><mark style="color:green;">RASP+</mark></td><td><mark style="color:green;">AppiCrypt</mark></td><td><mark style="color:green;">App Hardening</mark></td><td><mark style="color:green;">Malware Detection</mark></td></tr><tr><td><strong>M1</strong>: Improper Credential Usage</td><td>Mitigates</td><td>Mitigates</td><td>Mitigates</td><td><br></td></tr><tr><td><strong>M2</strong>: Inadequate Supply Chain Security</td><td>Mitigates</td><td><br></td><td><br></td><td><br></td></tr><tr><td><strong>M3</strong>: Insecure Authentication / Authorization</td><td>Mitigates</td><td>Mitigates</td><td><br></td><td><br></td></tr><tr><td><strong>M4</strong>: Insufficient Input/Output Validation</td><td><br></td><td>Mitigates</td><td><br></td><td><br></td></tr><tr><td><strong>M5</strong>: Insecure Communication</td><td><br></td><td><br></td><td>Mitigates</td><td> </td></tr><tr><td><strong>M6</strong>: Inadequate Privacy Controls</td><td>Mitigates</td><td>Mitigates</td><td>Mitigates</td><td>Mitigates</td></tr><tr><td><strong>M7</strong>: Insufficient Binary Protection</td><td>Mitigates</td><td>Mitigates</td><td><br></td><td><br></td></tr><tr><td><strong>M8</strong>: Security Misconfiguration</td><td>Mitigates</td><td>Mitigates</td><td>Mitigates</td><td><br></td></tr><tr><td><strong>M9</strong>: Insecure Data<br>Storage</td><td><br></td><td><br></td><td>Helps</td><td><br></td></tr><tr><td><strong>M10</strong>: Insufficient Cryptography</td><td><br></td><td><br></td><td>Helps</td><td><br></td></tr></tbody></table>

<br>

## Additional Trending Attack Vectors

Talsec also covers the following attack types that are not directly part of OWASP Top10 but still actual and exploitable as Telsec team believes.

| <mark style="color:red;">**Fraudsters Attack vectors**</mark> | **Talsec RASP+** | **AppiCrypt®** | **AppHardening** | **Malware Detection** |
| ------------------------------------------------------------- | ---------------- | -------------- | ---------------- | --------------------- |
| <p><strong>Session hijacking</strong></p><p><br></p>          | Mitigates        | Mitigates      | <p><br></p>      | <p><br></p>           |
| <p><strong>Man in the middle</strong> </p><p><br></p>         | <p><br></p>      | <p><br></p>    | Mitigates        | Mitigates             |
| <p><strong>SIM swapping</strong></p><p><br></p>               | <p><br></p>      | Mitigates      | <p><br></p>      | <p><br></p>           |
| **API-abuse**                                                 | <p><br></p>      | Mitigates      | <p><br></p>      | <p><br></p>           |
| **JSON injections**                                           | <p><br></p>      | Mitigates      | <p><br></p>      | <p><br></p>           |
| **Fraudulent Apps (malware)**                                 | Mitigates        | Mitigates      | <p><br></p>      | Mitigates             |
| **Untrusted install sources**                                 | Mitigates        | Mitigates      | <p><br></p>      | <p><br></p>           |

## **Platform availability information**

<table data-header-hidden data-full-width="false"><thead><tr><th></th><th align="center"></th><th width="182" align="center"></th><th align="center"></th><th align="center"></th></tr></thead><tbody><tr><td><br></td><td align="center"><strong>Android (smartphone, tablet, Android TV)</strong></td><td align="center"><strong>iOS (iPhone, iPad)</strong></td><td align="center">FLUTTER</td><td align="center">CORDOVA / REACT NATIVE / CAPACITOR</td></tr><tr><td><strong>MOBILE APP ATTACK DETECTION</strong></td><td align="center"><br></td><td align="center"><br></td><td align="center"><br></td><td align="center"><br></td></tr><tr><td>Root/jailbreak detection</td><td align="center"><ul><li><br></li></ul></td><td align="center"><ul><li><br></li></ul></td><td align="center"><ul><li><br></li></ul></td><td align="center"><ul><li><br></li></ul></td></tr><tr><td>Debug mode detection</td><td align="center"><ul><li><br></li></ul></td><td align="center"><ul><li><br></li></ul></td><td align="center"><ul><li><br></li></ul></td><td align="center"><ul><li><br></li></ul></td></tr><tr><td>Emulator/Simulator detection</td><td align="center"><ul><li><br></li></ul></td><td align="center"><ul><li><br></li></ul></td><td align="center"><ul><li><br></li></ul></td><td align="center"><ul><li><br></li></ul></td></tr><tr><td>Tamper and repackaging detection (signature, package name, bundleID, etc.)</td><td align="center"><ul><li><br></li></ul></td><td align="center"><ul><li></li></ul></td><td align="center"><ul><li></li></ul></td><td align="center"><ul><li></li></ul></td></tr><tr><td>Hook detection</td><td align="center"><ul><li><br></li></ul></td><td align="center"><ul><li><br></li></ul></td><td align="center"><ul><li><br></li></ul></td><td align="center"><ul><li><br></li></ul></td></tr><tr><td>Device binding</td><td align="center"><ul><li><br></li></ul></td><td align="center"><ul><li><br></li></ul></td><td align="center"><ul><li><br></li></ul></td><td align="center"><ul><li><br></li></ul></td></tr><tr><td>Overlay detection</td><td align="center"><ul><li><br></li></ul></td><td align="center">N/A</td><td align="center">Android</td><td align="center">Android</td></tr><tr><td>Accessibility Services misuse protection</td><td align="center"><ul><li><br></li></ul></td><td align="center">N/A</td><td align="center">Android</td><td align="center">Android</td></tr><tr><td>Unofficial installation source detection</td><td align="center"><ul><li><br></li></ul></td><td align="center"><ul><li><br></li></ul></td><td align="center"><ul><li><br></li></ul></td><td align="center"><ul><li><br></li></ul></td></tr><tr><td>Obfuscation issues detection</td><td align="center"><ul><li><br></li></ul></td><td align="center">N/A</td><td align="center">Android</td><td align="center">Android</td></tr><tr><td><strong>DEVICE &#x26; OS SECURITY CHECK</strong></td><td align="center"><br></td><td align="center"><br></td><td align="center"><br></td><td align="center"><br></td></tr><tr><td>Keystore/Keychain</td><td align="center"><ul><li><br></li></ul></td><td align="center"><ul><li><br></li></ul></td><td align="center"><ul><li><br></li></ul></td><td align="center"><ul><li><br></li></ul></td></tr><tr><td>Device lock</td><td align="center"><ul><li><br></li></ul></td><td align="center"><ul><li><br></li></ul></td><td align="center"><ul><li><br></li></ul></td><td align="center"><ul><li><br></li></ul></td></tr><tr><td>Mobile Services</td><td align="center"><ul><li><br></li></ul></td><td align="center">N/A</td><td align="center">Android</td><td align="center">Android</td></tr><tr><td>Last security patch</td><td align="center"><ul><li><br></li></ul></td><td align="center">N/A</td><td align="center">Android</td><td align="center">Android</td></tr><tr><td>System VPN</td><td align="center"><ul><li><br></li></ul></td><td align="center"><ul><li><br></li></ul></td><td align="center"><ul><li><br></li></ul></td><td align="center"><ul><li><br></li></ul></td></tr><tr><td>Developer mode</td><td align="center"><ul><li><br></li></ul></td><td align="center">N/A</td><td align="center">Android</td><td align="center">Android</td></tr><tr><td>AppiCrypt® - App Integrity Cryptogram</td><td align="center"><ul><li><br></li></ul></td><td align="center"><ul><li><br></li></ul></td><td align="center"><ul><li><br></li></ul></td><td align="center"><ul><li><br></li></ul></td></tr><tr><td><strong>HARDENING SDK - tools to increase app security</strong></td><td align="center"><br></td><td align="center"><br></td><td align="center"><br></td><td align="center"><br></td></tr><tr><td>Dynamic certificate pinning</td><td align="center"><ul><li><br></li></ul></td><td align="center"><ul><li><br></li></ul></td><td align="center"><ul><li><br></li></ul></td><td align="center"><ul><li><br></li></ul></td></tr><tr><td>Secret vault</td><td align="center"><ul><li><br></li></ul></td><td align="center"><ul><li><br></li></ul></td><td align="center"><ul><li><br></li></ul></td><td align="center"><ul><li><br></li></ul></td></tr></tbody></table>

&#x20;  &#x20;

> ### [<mark style="color:green;">TALSEC PLANS COMPARISON TABLE</mark> ](https://www.talsec.app/plans-comparison)