Zimperium

Detects compromised runtime environments at startup and during execution, including rooted Android devices, jailbroken iOS devices, emulators, and attached debuggers, and reacts per policy when an untrusted environment is found.

Applies name obfuscation, control-flow obfuscation, string and resource encryption, and code virtualization to impede static and dynamic reverse engineering of the protected application.

Detects exploitation of unknown vulnerabilities by analyzing runtime behavior rather than matching known attack signatures, protecting against vulnerabilities before CVE publication.

Verifies the integrity of application code, resources, and the execution environment at runtime, detecting repackaging, method hooking, and dynamic instrumentation such as Frida, and triggering a defensive response when tampering is detected.

Performs in-process interception and threat analysis with minimal latency impact, keeping the agent viable in production workloads with overhead varying by product.

Detects and blocks injection at the sink where untrusted input reaches dangerous operations, covering SQL and NoSQL injection, command injection, XXE, path traversal, and SSRF.

Operate in monitor-only mode (log and alert), or active blocking mode (terminate request upon detection). Most deployments begin in monitor mode to establish a false positive baseline before enabling blocking.

Instruments runtimes to intercept database queries, command execution, and deserialization across Java, .NET, Python, Node.js, PHP, Ruby, and Go, with coverage depth varying by product.

Blocks exploitation of known vulnerabilities at runtime without source code changes, reducing exposure during the gap before a deployed fix, especially on legacy or hard-to-patch applications.

Detects novel mobile threats using behavioral heuristics and ML models without requiring known signatures, relevant for targeted attacks against specific organizations.

Detects device integrity compromise (jailbroken iOS and rooted Android), and can enforce conditional access policy or quarantine the device via MDM/UEM integration.

Checks each device for outdated OS versions, missing security patches, risky system parameters, and insecure configuration, flagging the vulnerabilities and misconfigurations that raise device risk.

Intercepts and evaluates URLs in SMS, email clients, messaging apps, and browsers, blocking malicious links regardless of which app the user opens them in.

Identifies connection to malicious or impersonation Wi-Fi networks (including captive portal attacks and SSLstrip-capable access points), and can block connection or alert the user.

Integrates with Jamf, Microsoft Intune, VMware Workspace ONE, and other UEM platforms to trigger automated response actions (wipe, quarantine, access revocation) upon threat detection.

Runs threat detection locally on the device for off-network protection and privacy, with optional cloud-assisted analysis where policy allows.

Analyzes installed application binaries for malicious behavior, excessive permission requests, data exfiltration patterns, and policy violations beyond what app store review catches.