Security Stack Logo
Promon Shield for Mobile logo

Mobile Security

Promon Shield for Mobile

Post-compile RASP and app shielding for Android and iOS apps, defending against tampering, reverse engineering, code injection, and malware without source code changes.

Runtime Application Self-Protection (RASP)

Promon Shield for Mobile Overview

Promon Shield for Mobile is a Runtime Application Self-Protection (RASP) and app shielding product that defends Android and iOS applications against tampering, reverse engineering, code injection, and malware. Its distinctive mechanism is post-compile integration: protection is wrapped around an already-built APK, AAB, or IPA in minutes, with no source code access or code changes. A cryptographic application binding ties the protection to the app, so attempts to remove or disable Shield cause the app to stop functioning.

The product layers multiple defenses into the application binary, providing protection both at rest and at runtime. It detects rooting, jailbreaking, debuggers, hooking frameworks, repackaging, screen overlays, and keyloggers, then responds according to configuration by blocking the action, terminating the app, or reporting the event to monitoring systems. Hardening includes execution flow control, process integrity checks, Android code obfuscation, and secure local storage. Coverage spans Android, iOS, Chrome OS, HarmonyOS, and Amazon Fire OS, and extends to protecting on-device AI models from tampering and theft. Raiffeisenbank uses Shield for Mobile to protect its eKonto banking app.

Promon maintains ISO 27001 and SOC 2 compliance, and its Trust Center documents DORA-aligned controls for EU financial services. The company was recognized in the Gartner Hype Cycle for Application Security 2024, and its protection technology originated from research at SINTEF and the University of Oslo. Shield for Mobile serves banks, fintechs, payment providers, gaming, and streaming companies, with Promon technology securing apps used by more than 2 billion people across over 500 customers.

Key Capabilities

mapped to solution categories
Runtime Application Self-Protection (RASP)

Applies name obfuscation, control-flow obfuscation, string and resource encryption, and code virtualization to impede static and dynamic reverse engineering of the protected application.

Instruments runtimes to intercept database queries, command execution, and deserialization across Java, .NET, Python, Node.js, PHP, Ruby, and Go, with coverage depth varying by product.

Detects compromised runtime environments at startup and during execution, including rooted Android devices, jailbroken iOS devices, emulators, and attached debuggers, and reacts per policy when an untrusted environment is found.

Verifies the integrity of application code, resources, and the execution environment at runtime, detecting repackaging, method hooking, and dynamic instrumentation such as Frida, and triggering a defensive response when tampering is detected.

Operate in monitor-only mode (log and alert), or active blocking mode (terminate request upon detection). Most deployments begin in monitor mode to establish a false positive baseline before enabling blocking.

Compliance

certifications
ISO 27001SOC 2 Type II

Integrations

compatible tools
Android StudioAzure DevOpsGitHub ActionsGradleJenkinsMavenVisual StudioXcode

Implementation & support

Deployment model
CloudOn-Premise
Pricing structure
Enterprise License
Support channels
DocumentationEmail SupportKnowledge Base

Info last updated on June 26, 2026