OWASP released MASTG v2.0.0 on 30 June 2026. The mobile testing guide is now split into modular components (the release notes count about 860, including 77 tests and 72 demos), each cross-linked to MASVS controls. That makes it easier to write a scope sheet that names what will be tested, instead of asking a vendor to "test the app".
What's affected
Any company shipping an iOS or Android app that must show a mobile penetration test to a customer. The most common gap is that the test covers the app binary but not the API behind it, or the reverse.
What to do now
- Name the builds. Give the vendor the exact version and build number for each platform, signed the way production is signed, plus a debuggable build if you want white box work.
- List the platforms and devices. Say which OS versions are in scope and whether the tester should use their own devices or yours. Say whether jailbroken or rooted devices are fine.
- Include the backend. Every API the app calls is in scope or explicitly out. Link to your API scope sheet.
- Pick MASVS groups. MASVS has eight control groups: STORAGE, CRYPTO, AUTH, NETWORK, PLATFORM, CODE, RESILIENCE and PRIVACY. MASVS v2.1.0 (January 2024) added PRIVACY. Tick the groups you want covered. RESILIENCE (reverse engineering and tamper resistance) matters more for payments and DRM than for most business apps, so choose it deliberately.
- Provide accounts and data. Two tenants, each with seeded synthetic data. No production customer records.
- Decide on third-party SDKs. Say whether analytics, ad and payment SDKs are in scope. Tests of third-party servers generally need that party's permission.
- Agree the output. Findings should name the MASVS group and the test case used, so you can map each one to your backlog.
How to avoid this trap
- Do not rely on the app store build alone. Provide the signed release build and say what changed since.
- Do not leave the backend out of scope because a different team owns it. Many mobile findings are API findings.
- Re-scope when the app adds a login method, a payment flow or a new SDK.
Quick check
Which MASVS control group was added in v2.1.0?
MASVS-PRIVACY, which sets a baseline for user privacy with four controls.
