Promon gives mobile payment apps, wallets, and payment SDKs the client-side protections EMVCo labs expect - so you can reduce certification risk, shorten evaluation cycles, and keep launches on schedule.
Book an EMVCo SBMP readiness session with Promon:
As mobile payments scale, SBMP is increasingly a prerequisite for major card schemes and a credible signal that your app can withstand real-world attacks. When requirements tighten, “good enough” client-side controls become a launch risk.
What's at stake?
Promon provides EMVCo-evaluated app shielding and layered client-side defenses designed to hold up under SBMP-grade static and dynamic attacks.
This helps to ensure your app presents the multi-layer protections evaluators expect to see consistently across builds and environments.
| What labs typically test | Promon features |
| Labs run the app in untrusted conditions (emulators, rooted or jailbroken devices) and attempt to observe or influence sensitive flows via OS-level abuse. |  Emulator detection Root or jailbreak detection Detection and blocking of untrusted keyboards, keyloggers, screen readers, and abuse of OS accessibility services |
| Labs modify the app (patching, repackaging, runtime modification) and check whether integrity protections detect and respond reliably across devices and builds. |
|
| Labs inspect the binary to understand sensitive logic, extract assets/configuration, and evaluate how easily protections can be undone offline. |
|
| Labs attach debuggers and instrumentation to trace, manipulate, and observe behavior at runtime using common toolchains and techniques. |
|
This guide offers a global view of what labs typically focus on during an EMVCo SBMP evaluation, why mobile apps struggle, and how teams can build readiness directly into their development and compliance roadmap.
Promon’s SBMP guidance is built for teams that need to prove mobile payment security in real-world conditions, not just in the lab.
Whether you are preparing for your first SBMP evaluation or tightening controls after a gap, this is for organizations securing payment functionality on-device and across the wallet ecosystem.
Trusted by Tier 1 banks and enterprises, protecting over 2 billion users and transactions daily with no impact on app performance or user experience.
20 years of innovation in app shielding and RASP, backed by a world-class research team, delivering advanced, field-proven protection against evolving threats.
Fully on-premise and CI/CD-ready. No code changes or dependencies — harden your app fast with full control.
One integration process, identical results for iOS and Android — saving time, reducing complexity, and ensuring consistent protection quality.
