Prepared for
Tech & Cyber
Hero Finding
The buyer is convinced the threat is rising. The wallet is already open. The competitive question is which platform earns the consolidated spend.
Sixty-seven percent of senior security leaders expect mobile app attacks to keep increasing over the next 12 to 24 months, and AI-enabled attack tooling is the dominant catalyst they cite. Reactive triggers like a data breach (82%) or a new compliance mandate (78%) drive the largest share of incremental spend. Fifty-four percent expect their mobile app security budget to grow over the same window, and only 3% report negligible dedicated spend today.
67%
Expect attacks to keep rising over 12 to 24 months
54%
Expect mobile app security budget to grow
76%
Rate their mobile app as very or extremely critical
97%
Report at least some dedicated mobile app security spend
Study Design
N=67 senior security and IT leaders · manager and above · 12-topic mixed-method survey.
The sample was designed to span four regions, three security approaches (third-party vendor, in-house, and platform-native), and a meaningful skew toward current customers of the mobile app security platform under diligence so the investment team could evaluate satisfaction, control adoption, and switching risk in addition to category-wide demand signals.
Sample segmentation
North America · 24
APAC · 18
EMEA · 14
LATAM · 11
Interview guide · core topics
- App mission criticality, sensitive data exposure, and on-device logic
- Incident history, financial impact, and broader business consequences
- Threat trend perception and forward-looking attack expectations
- Current security approach mix: third-party, in-house, platform-native
- Vendor landscape: aided and unaided awareness, evaluation set, switching
- Selection criteria, ranked importance, and platform versus best-of-breed
- Deployment model preference: low/no-code versus SDK and engineer control
- Regional and OS-level differences in controls and concern
- Spend levels, allocation across capabilities, and 12 to 24 month outlook
- Investment triggers, adoption barriers, and engineering friction points
Recruit criteria
- Manager level or above in security, IT, or engineering with security ownership
- Direct visibility into and influence over mobile app security decisions
- Organizations with 500+ employees and a mobile app exceeding 10,000 monthly active users
- Roughly one-third sourced as current customers of the platform under diligence
Key Findings
What the diligence surfaced.
Seven signals shaped the investment team's view of demand, the moat, and the risk register on the mobile app security platform.
76%
Apps are very or extremely critical to the business
67%
Expect attacks to keep increasing
79%
Already use a third-party mobile app security vendor
53%
Prefer low/no-code deployment
52%
Prefer a single platform over best-of-breed
54%
Expect budget growth in next 12 to 24 months
01
Mobile is now a primary revenue and identity channel, and buyers treat security spend accordingly.
Seventy-six percent of respondents rate their mobile app as very or extremely critical to revenue, customer engagement, or core operations. Eighty-two percent of apps support payments or money movement and 93% process personally identifiable information. The category is no longer competing for budget against peripheral tools.
02
The threat curve is rising, and AI is the catalyst buyers name without prompting.
Sixty percent report attacks have increased over the past 12 to 24 months and 67% expect that trajectory to continue. AI and automation lead as the cited driver at 47%, ahead of digital transformation (29%) and threat actor tool industrialization (20%). In-app fraud and data leakage are the single most cited top concerns.
03
Adoption is broad but maturity is uneven, leaving meaningful headroom for the platform.
Seventy-nine percent already use a third-party vendor, 76% rely on platform-native controls, and 67% maintain in-house capabilities, typically layered together. Only 36% rate their program as comprehensive while 57% describe it as moderate with acknowledged gaps, the cohort most likely to expand spend.
04
Selection criteria reward efficacy and integration, but compliance jumps to the top under forced ranking.
Efficacy and proof of protection (60%), integration with the existing security stack (57%), and breadth of protections (51%) lead on cited importance. When buyers rank the criteria they selected, compliance and regulatory reporting rises to the top at 44%, ahead of breadth (41%) and efficacy (35%), suggesting regulation is the closer.
05
A plurality favors a single platform and low/no-code deployment, validating the platform's positioning.
Fifty-two percent prefer a single platform covering the full defense stack versus 27% who favor best-of-breed. Fifty-three percent prefer a low/no-code deployment model versus 25% who prefer SDK-based integration. Speed (56%) and resource efficiency (44%) drive the low/no-code preference.
06
Customers of the platform under diligence report broader control adoption and higher self-assessed maturity.
Within this sample, current customers report statistically higher adoption than competitor-primary users in in-app fraud detection (72% vs 46%), app attestation (64% vs 36%), code obfuscation (60% vs 32%), mobile threat defense (56% vs 21%), and MDM/MAM (48% vs 18%). Fifty-two percent self-rate as comprehensive versus 29% for competitor-primary users.
07
Engineering friction is universal, and transparency is the platform's distinct soft spot.
Every respondent reported at least some significant deployment friction. For the platform under diligence, the top cited challenges in this sample center on transparency into the no-code architecture (24%), support quality gaps (24%), and integration friction (20%). Competitor SDK products see different patterns: cost, workflow overhead, and pricing pressure.
“The research gave us conviction that the demand signal is real and the deployment-model preference cuts in our direction. The harder question, and the one we want to operationalize post-close, is how the platform addresses the transparency gap before a competitor does.”— Vice President, Growth Equity Investment Firm
Crosstab · Selection Criteria by Vendor Cohort
What the platform's customers prioritize versus the rest of the category.
Cited importance of selection criteria, split between current customers of the platform under diligence and customers primarily using a category competitor. Highlighted row = the criterion with the largest gap and the clearest signal for product positioning.
| Platform customers | Competitor customers | Total sample | Gap (pp) | Signal | |
|---|---|---|---|---|---|
| Speed / ease of deployment | 52% | 14% | 33% | +38 | Platform-favored |
| Integration with security stack | 44% | 71% | 57% | -27 | Competitor-favored |
| Efficacy / proof of protection | 64% | 57% | 60% | +7 | Even |
| Breadth of protections | 55% | 50% | 51% | +5 | Even |
| Compliance / regulatory reporting | 41% | 46% | 44% | -5 | Even |
| Engineer control & configurability | 36% | 61% | 47% | -25 | Competitor-favored |
Speed and ease of deployment is the platform's clearest positioning lever (+38pp)Integration depth and engineer control are competitor-favored selection driversEfficacy, breadth, and compliance are table stakes across the category
Voice of Customer
What senior security leaders actually said.
Verbatim excerpts from the full sample, selected for range across regions, regulatory exposure, and vendor cohorts.
Regulated · APAC · Mission Criticality
“Close to 98% of all customer transactions and engagement with the bank happens through the mobile app. So mobile apps, which are what we call digital channels, are the primary extension of the brand for engaging and serving customers.”
— Security leader, regulated industry, APAC
Regulated · EMEA · AI as Catalyst
“The biggest reason is AI. Now attackers have the power of AI, they can run multiple different kinds of intelligent attacks that go at a very high speed with the availability of AI and shared CPU and GPU infrastructure.”
— Security leader, regulated industry, EMEA
Regulated · North America · Low/No-Code
“It's a pretty clear reason as to why we want low-code and no-code. One, we want speed in deployment. Two, we want efficiency in deployment. Three, we don't want too much dependency on specialized skills.”
— Security leader, regulated industry, North America
Regulated · LATAM · Transparency Gap
“There is a low level of transparency in how it provides defense for the applications we build. It acts like a black box, and we don't know exactly how the protection is acting on the code level.”
— Security leader, regulated industry, LATAM
Non-Regulated · LATAM · Incident Pressure
“There was a breach of one of our security modules, which allowed a hacker to try and clone our application with hundreds of devices. That forced our engineers to drop everything to manage the patches and handle a flood of locked-out and panicking online users.”
— Security leader, non-regulated industry, LATAM
Counter-intuitive
The buyers most aligned with the platform's positioning are also the ones who articulate its sharpest competitive risk.
The study validated three of the platform's core thesis pillars: a plurality of buyers favor a single-platform approach, a majority prefer low/no-code deployment, and current customers report broader control adoption and higher maturity than competitor-primary peers. The counter-intuitive finding is that those same advocates name transparency into the no-code architecture as the single most cited challenge with the platform in this sample. The deployment model that wins on speed and ease is the same model that creates a black-box concern for the security architects who own the relationship. That tension defines the post-close product roadmap as much as any greenfield expansion does.
Strategic Implications
Three priorities from the diligence.
The research grounded the investment team's view of where the platform needs to invest in the first 12 to 24 months to defend share, capture the budget tailwind, and neutralize competitor positioning.
01
Lead with regulated verticals and APAC, where adoption depth and spend tier are highest.
Regulated industries show significantly deeper adoption across nearly every control category, including RASP (77% vs 36%) and root/jailbreak detection (68% vs 36%). APAC respondents skew highest on spend tier, with notably higher representation in the top spend band versus North America. Concentrate enterprise account depth in regulated APAC and EMEA before expanding the mid-market motion.
02
Close the transparency gap before SDK-native competitors weaponize it.
Twenty-four percent of current customers in this sample cite transparency into the no-code architecture as a challenge, and 47% of the broader sample rates engineer control and configurability as very important. A configurable visibility layer for security architects, paired with proof of protection telemetry, neutralizes the black-box objection without diluting the speed advantage that drives the platform's win rate.
03
Anchor the price story to compliance reporting and proof of protection.
Compliance and regulatory reporting tops the forced ranking of selection criteria at 44%, and efficacy and proof of protection leads on cited importance at 60%. Cost and unclear ROI is the leading adoption barrier at 67%. Embedding compliance-ready reporting and quantified efficacy telemetry into the platform addresses the closer (compliance) and the blocker (ROI clarity) in the same release cycle.
Success criteria · 12 months
- Platform NPS maintained or improved across the regulated APAC and EMEA cohorts
- Customer-cited transparency challenge reduced to under 10% in next-cycle research
- Compliance reporting and efficacy telemetry shipped within 12 months of close
- Net revenue retention in regulated enterprise accounts at 115% or above
Risk register
| Transparency gap exploited by SDK-native competitors | HIGH |
| Cost / unclear ROI persists as the top adoption barrier (67%) | HIGH |
| Engineer control preference shifts the category toward SDK | MED |
| Platform-native (OS-level) controls erode mid-market demand | MED |
| Build-in-house preference among well-resourced regulated teams | LOW |