Evaluate mobile endpoint detection signals by asking what the device looks like from inside the app you need to protect, at the step where risk turns into loss. Otukan reports endpoint conditions from within your protected Android, iOS, Flutter and React Native apps: remote control of the session, harmful app behaviour on Android, intercepted connections, failed attestation and a weakened operating system. These signals sit beside the device-level detection you may already run; they add app context rather than replace it. Otukan does not scan the whole phone. It reports what your app can observe within each platform’s rules, at the moment a sensitive flow runs.
The flow and the trust boundary
Where endpoint risk becomes loss
A compromised phone matters most at a few steps: sign-in, adding a payee, sending money, changing the email or phone number on an account, and recovering access. These are the steps attackers aim for, and they are where Otukan runs its endpoint checks.
Why the app is the right vantage point
Device-level tools see phones your organisation manages. Your customers’ phones are not managed by you, and many employees use personal devices for work apps. The one thing you control on every one of those phones is your app. Otukan uses that position to report device condition exactly where it affects your service.
The boundary that matters
The device is on the attacker’s side of the line; your backend is on yours. Otukan’s endpoint checks gather evidence on the device, and your server makes the decision. A signal that an attacker silences on the phone still leaves a gap your server can notice.
Managed and unmanaged phones together
Employee apps often run on a mix of company phones and personal ones. On a managed phone, device-level findings and Otukan’s in-app signals describe the same moment from two angles. On a personal phone, the in-app view may be the only endpoint evidence you have, which is why Otukan reports the same way on both.
Who is responsible for what
Endpoint security on mobile is shared between the operating system, your app and your backend. Otukan owns the app’s part of that split and hands clear evidence to the other three.
| Layer | What it does | Where Otukan fits |
|---|---|---|
| Operating system | Sandboxes apps, enforces signing, offers platform attestation | Otukan reads what the platform exposes and tells you when its protections look weakened |
| Your app | Runs the flow the user sees | Otukan checks the device, the screen and the connection at marked steps and applies your rule |
| Your backend | Holds accounts, money and data | Receives endpoint signals with the request and makes the final decision |
| Device-level tools | Watch managed phones as a whole | Their findings and Otukan’s in-app signals sit side by side in your analysis |
Android
On Android, an app can learn more about its surroundings. Otukan reports overlays on sensitive screens, accessibility services performing gestures, screen capture, root traces and proxy or user-installed certificate settings.
iOS
On iOS, the sandbox keeps apps from seeing each other. Otukan concentrates on screen capture and mirroring, jailbreak traces, the app’s own connection and attestation evidence your server verifies with App Attest.
Evaluating endpoint signals
A good evaluation checks three things: that each signal fires when it should, that it stays quiet when it should, and that real customers are not harmed along the way.
Evidence per signal
For each endpoint condition, Otukan and your engineers reproduce it in an authorised lab and confirm the signal, repeat the same journey on a clean device and confirm silence, then re-run install, update, sign-in and the protected flow. Results are recorded with device models, OS versions and the reviewer.
User-impact checks
Some legitimate setups look unusual. Screen readers use accessibility services, some employers inspect network traffic, and enthusiasts enable developer settings. Test these cases on purpose, start in observe mode, and let the numbers from your real users decide when a flow moves to a stricter rule. Response design is covered on threat response.
Platform scope
Ask for the conditions reported on Android and on iOS as two separate lists. Otukan provides them that way, so you never assume an Android signal exists on iOS or the reverse.
What your analysts receive
Each endpoint signal names the condition, the step it was seen on, the build, platform and OS version, with a pseudonymous install identifier. Ask to see a redacted example from both platforms during evaluation, and check that your team can read it without help from engineering.
Where these signals end up for analysts is covered on SIEM integration. How endpoint signals feed monitoring is covered on mobile app threat monitoring.