Q-mast
Q-mast is an automated security testing tool for iOS and Android apps, designed to analyze compiled binaries without source code.
What Q-mast is
Q-mast is an automated security testing tool for iOS and Android apps, designed to analyze compiled binaries without source code. It can inspect obfuscated, protected, and signed builds, including signed iOS apps, and observe behavior on non-rooted or non-jailbroken devices. Its methods include static, dynamic, interactive, and forced-path analysis. Quokka says scans take less than 60 minutes and produce fewer than 1% false results. For supply-chain review, Q-mast creates version-specific software bills of materials and examines SDK behavior, vulnerable dependencies, and risky third-party code. It checks against NIAP, NIST, OWASP MASVS, CVEs, and SARIF. Listed connections include GitHub, GitLab, Jenkins, Azure DevOps, Appium, and Snyk, alongside API support for CI/CD and DevSecOps workflows. Quokka positions the product for developers adding security checks to the development lifecycle. It is paid, with pricing available on request, and prospective customers can request a personalized demo. Quokka states it is SOC 2 compliant; its report is available by contacting the company.
Good
- Analyzes compiled binaries without source code.
- Supports protected, signed, and obfuscated builds.
- Combines static, dynamic, interactive, and forced-path analysis.
- Generates version-precise software bills of materials.
- Lists API and development-tool integrations.
Watch out
- Pricing is available only on request.
- A personalized demo requires contacting Quokka.
Who it suits
Q-mast suits developers who need to assess iOS or Android app binaries as part of their software development lifecycle. It may also fit teams reviewing mobile-app dependencies and SDK behavior.
Verdict
Q-mast brings several forms of mobile-app analysis and supply-chain review into one security testing product.
The facts
Each one read from Q-mast's own pages, with the date it was checked.
What it does
- Analysis methods
- Q-mast combines static, dynamic, interactive, and forced-path execution analysis.checked 7 Oct 2026
- API
- The product page lists API support for CI/CD and DevSecOps integration.checked 7 Oct 2026
- Binary scanning
- It analyzes compiled app binaries without requiring source code, including obfuscated builds.checked 7 Oct 2026
- Binary support
- It analyzes compiled, obfuscated binaries and scans protected and signed builds.checked 7 Oct 2026
- Integrations
- The product page lists GitHub, GitLab, Jenkins, Azure DevOps, Appium, and Snyk integrations or connections.checked 7 Oct 2026
- Intended users
- Quokka presents Q-mast for teams testing mobile apps they build and for DevSecOps teams integrating app testing into CI/CD workflows.checked 7 Oct 2026
- Pricing
- The Q-mast product page directs prospective customers to request a personalized demo; it does not state a price.checked 7 Oct 2026
- Protected builds
- Quokka says Q-mast supports protected and signed builds, including signed iOS builds.checked 7 Oct 2026
- Purpose
- Q-mast is an automated mobile app security testing solution that analyzes iOS and Android apps without requiring source code.checked 7 Oct 2026
- SBOM
- Q-mast generates version-precise software bills of materials and analyzes SDK behavior and vulnerable dependencies.checked 7 Oct 2026
- Scan speed
- Quokka says scans take less than 60 minutes and report less than 1% false results.checked 7 Oct 2026
- Scan time
- Quokka says scans take less than 60 minutes and report less than 1% false results.checked 7 Oct 2026
- Security
- Quokka states that it is SOC 2 compliant.checked 7 Oct 2026
- Security assurance
- Quokka says it achieved SOC 2 compliance and that its SOC 2 report is available by contacting the company.checked 7 Oct 2026
- Standards
- Quokka says Q-mast checks against NIAP, NIST, OWASP MASVS, CVEs, and SARIF.checked 7 Oct 2026
- Supply chain
- It generates version-precise SBOMs and analyzes SDK behavior, vulnerable dependencies, and risky third-party code.checked 7 Oct 2026
- Support
- Quokka directs customers to log in with customer credentials to access its knowledge base library.checked 7 Oct 2026
Where it runs
- Device testing
- The product page says Q-mast observes app behavior on non-rooted, non-jailbroken devices.checked 7 Oct 2026
The company
- Founded
- 2011checked 28 Sep 2026
- Headquarters
- Quokka lists offices in San Jose, California, and Arlington, Virginia.checked 7 Oct 2026
Alternatives to Q-mast
- 1
AppSweep
Free planAndroidiOSWebAPI7.8Free plan - 2
Ostorlab
Free planAndroidiOSWebAPI7.3From $299 a month - 3
Oversecured
AndroidiOSWebAPI6.8$1,000 usage-based - 4
Quixxi Scan
AndroidiOSWeb6.8From $299 a year - 5
6.6From $599 a year - 6
Silker AI Mobile Security
AndroidiOSWeb6.6From $19.50 a month