Skip to content

Mobile Deep Agentic Scan

The Mobile Deep Agentic Scan is AI-powered penetration testing for your mobile applications. It:

  • reverse engineers the application, including its native code, before testing begins;
  • uncovers complex logical flaws and chains vulnerabilities into attack paths;
  • validates findings with proof-of-concept exploits to confirm their real-world impact;
  • prioritizes risks by how the weaknesses relate to each other;
  • runs every check of the Mobile Shielding Scan: obfuscation, anti-tampering, anti-debugging, and root and jailbreak detection.

To create a Mobile Deep Agentic Scan:

  1. Click "New Scan" in the top bar.

    New Scan

  2. Select where the application comes from: "PlayStore" or "AppStore" if it is available on the store, "Android App" or "iOS App" to upload an APK, AAB or IPA file, or "iOS TestFlight" to use a TestFlight link. For this example, we will select "PlayStore".

    Select Source

  3. Search for the application using its name, package name, or bundle ID, and select it. If the application is only accessible in a specific location or country, use the country menu to select the appropriate option. Click "Continue".

    Search Application

  4. The "Extra Context" step is optional: click "Continue" to skip it.

  5. Select "Mobile Deep Agentic Scan" as the scan profile and click "Continue".

    Select Scan Profile

  6. Review the "Guardrails". The scan runs within the approved scope and excludes the environments you specify.

    • "Approval of actions" (Approve the actions of an AI agent): what the AI agents do before a risky action, such as sending an SMS or publishing a file:
      • "Run without asking": they run it on their own.
      • "Ask me, block if no answer": they ask you first, and skip the action if nobody answers.
      • "Ask me, run if no answer": they ask you first, and run the action if nobody answers.
    • "Vulnerability scope" (optional): the domains and IPs the agent tests and reports vulnerabilities on. Leave it empty to report on every target.
    • "Blocked IPs" (optional): IPs and CIDR ranges the agent never reaches.
    • "Additional instructions" (optional): testing boundaries, environments to avoid or other safety requirements.

    Click "Continue".

    Guardrails

  7. Select the AI provider: "Cybermodels" runs the scan with your Cybermodels tokens, with no API key to manage, while "BYOK Simple" and "BYOK Advanced" use your own API key. See Cyber Models and Use your BYOK Scan Key in a Scan Profile. Click "Continue".

    AI Provider

  8. Set the "Effort": the exploration depth and the number of tokens allocated to the scan. Each level is compared to a manual pentest, meaning the time one pentester needs to assess the same number of risks:

    • "Core": about 1 week of pentest.
    • "Advanced": about 2 to 4 weeks of pentest.
    • "Elite": about 4 to 8 weeks of pentest.
    • "Custom Tokens": a token budget you set yourself.

    Click "Estimate this scan" to get a token estimate and an effort recommendation for your target. Click "Continue".

    Effort

  9. The next steps are optional. Prompts guide the Deep Agentic Scan on what to test, and test credentials enable authenticated testing. You can also configure advanced settings, such as "Scope URLs regexes" to whitelist specific URLs to be scanned, and tags.

  10. Click "Start scan" to start the scan.

    Start scan

  11. Follow the scan from "Scans" in the top bar, and open it when it is done.

    Open the Scan

  12. "Risks" lists every attack path the agents tested, with its risk rating and status.

    Risks

    Open a risk to explore its Transparent Attack Validation path: the exact decisions, tool outputs, and steps taken by the AI agent to validate vulnerabilities.

    Transparent Attack Validation

  13. Open the Scan Coverage Heatmap, which provides a visual view of testing coverage across application components and security categories. This helps teams understand which areas of the application received deeper analysis, where coverage was limited, and how coverage evolves across assessments.

    Scan Coverage Heatmap

    Note: Historical Scan Processing is enabled by default. The scanner remembers previous findings and validated attack paths, focusing subsequent scans on new or changed functionality for cumulative, incremental coverage.

This tutorial demonstrated how to create a Mobile Deep Agentic Scan from the store or through a file upload.