How to use this checklist

A resilience pentest checks whether your mobile app can keep running safely when attackers try to tamper with it, reverse-engineer it, or run it on unsafe devices. This checklist helps you confirm that the app’s built-in protections work, so you can find and fix weak points before external testers do.

Use this checklist to ensure your app meets OWASP MASVS-R security principles before a resilience pentest begins.

Core mobile app resilience controls

Protecting data at rest and runtime

Following OWASP MASVS-R basics

Preparing the build for testing

Before the resilience test begins

Are you ready for your resilience pentest? If you can tick most boxes, your app is ready for a resilience pentest that follows OWASP MASVS-R principles. Close any remaining gaps by confirming the runtime protections, attestation and secure stprage all behave as expected on real devices.