Otukan keeps protection light by design and proves it on your own app. You choose which checks run and at which moment, per user flow, so protection works hardest where the risk is. Otukan’s engineers then measure your protected build against its unprotected baseline: the same code, built and signed the same way, run through the same journeys on the same physical devices. You see start-up, size, CPU, memory, crashes, and ANRs on Android or hangs on iOS, as a spread per device rather than one average. Compatibility is proven the same way, on your devices, OS versions and SDKs.
Metrics
Otukan tracks the same measures for the baseline and the protected build, separately for Android and iOS.
| Metric | What is measured | Android tools | iOS tools |
|---|---|---|---|
| Start-up | Cold and warm start to first usable screen | Macrobenchmark, Perfetto | XCTest launch metrics, Instruments |
| App size | Download size and installed size | Play Console size reports, bundletool | App Store Connect size report, App Thinning Size Report |
| CPU | CPU time during start-up and key flows | Perfetto, Android Studio profiler | Instruments Time Profiler |
| Memory | Peak and steady memory in key flows | Android Studio memory profiler | Instruments Allocations, XCTest memory metrics |
| Crashes | Crash-free sessions per build | Android vitals, your crash tool | Xcode Organizer, MetricKit, your crash tool |
| Responsiveness | ANRs on Android, hangs on iOS | Android vitals | Xcode Organizer hang reports, MetricKit |
| Flow latency | Time for sign-in, payment or other sensitive flows | Custom trace sections, viewed in Perfetto | Signposts, viewed in Instruments |
Battery and network use are measured too wherever a check runs in the background or calls your server. A check that adds a server round trip is measured end to end.
Compatibility
A build that fails on some devices costs more than a slower one, so compatibility gets the same rigour as speed. For each protected build, and separately for Android and iOS, Otukan’s test plan covers:
- install and update success on each OS version you support
- behaviour on devices from each manufacturer your users have, and on older hardware
- each third-party SDK in your app, especially those that inspect or hook the app
- accessibility services, managed devices and enterprise profiles, where relevant
Method
- Fix the inputs. Baseline and protected releases come from the same commit, with the same compiler settings and release configuration, signed the same way.
- Choose the devices. Physical devices that match your user base, including a low-end device and an older OS version you still support. Android and iOS results stay separate.
- Control the device state. Same OS build, battery level, thermal state, network and installed apps, with a reboot between series.
- Script the journeys. Launch, sign-in and your most sensitive flows are automated, so each run does the same work.
- Repeat. Enough iterations to see the spread, the same number for both builds, alternating baseline and protected runs so that drift affects both.
- Record everything. App version, protection profile version, device model, OS version, tool versions, date and reviewer.
- Re-run after change. The same set runs again after a platform upgrade, a new protection profile or a framework update.
Framework apps get extra care. Flutter and React Native apps have their own start-up work, and a protected Dart or JavaScript layer behaves differently from native code, so Otukan measures both layers. For framework notes, see Flutter app security and React Native app security. Obfuscation has its own effect on size and speed. For that, see code obfuscation.
Interpretation
Report distributions
Averages hide the users who notice. Otukan reports the median and a high percentile for each metric, per device and per flow, for both builds, with the difference shown as a range and the number of runs behind it.
Find the cause, then fix it
If a protected build is slower in one place, a trace shows where. Checks that run once at start-up, checks that run on each sensitive call and checks that run continuously have different costs. Because Otukan lets you place each check per flow, a check that shows up can move to a less visible moment, and the next run confirms the change.
Results your team can repeat
A result belongs to one app version, one protection profile and one device set, and Android and iOS are measured on their own. That is why Otukan gives you the method, the devices and the raw numbers with every result: your team can repeat it, and trust it.
Step-by-step test guidance is in how to test app shielding performance. For how performance fits the wider protection model, return to mobile app security.