A mobile security team should evaluate threat analytics by whether it turns runtime signals into decisions: which flows to tighten, which releases to investigate and which builds to retire. Otukan counts signals from your protected Android, iOS, Flutter and React Native apps by check, build, platform, OS version, install age and time, then highlights spikes against your app’s normal range and compares every release with the one before. Metrics are defined once and reported per platform. Detections, confirmed attacks and business incidents stay separate, so a chart of leads is not mistaken for a chart of losses.
What the numbers mean
Analytics is only as good as its definitions. Before anyone reads a trend, the team should agree what is counted, over which window and at which level.
Metric definitions
| Metric | What it counts | Dimensions | Read it as |
|---|---|---|---|
| Signal count | Times a check fired | Check, platform, OS version, build, time | Activity, not attacks |
| Affected installs | Distinct pseudonymous installs with at least one signal | Same as above | Spread of a condition across your user base |
| Release delta | Change in rate from the previous build | Check, platform | Whether a release shifted exposure |
| Cohort share | Signals on installs of a given age | Install age, check | Concentration on new installs |
| Confirmed share | Signals later linked to a confirmed attack | Check, flow | How often a check points to real abuse |
Severity and moment
Every counted signal keeps its severity and the moment it fired: launch, sign-in or a sensitive action. A chart of high-severity signals before transfers tells a very different story from a chart of all signals at launch, and Otukan lets you choose which one you are looking at.
Platform discipline
Android apps can see more of the system than iOS apps, so Android usually shows more categories and higher counts. Otukan keeps the two platforms in separate views and compares within a platform.
Reading a spike
A spike has three usual causes: a new attack tool, a new legitimate environment such as a system update or test fleet, or a change in your own app. Otukan’s views let you test each in turn. Check the release comparison first, then the OS version split, then whether the affected installs are new. Only when all three point outward is it time to call it an attack trend.
From trends to action
Numbers only help when someone owns the next step. Otukan’s views are designed around three recurring decisions.
Triage
A weekly review of top-firing checks and spikes gives the security team a short list. Most items are explained quickly, such as a new internal test device fleet; the rest become investigations. Case handling for those items is on threat investigation workflows.
Policy
Analytics tells you when a flow is ready for a stricter response and whether a change worked. If restrict on sign-in cuts emulator signals among new installs without raising support contacts, keep it; if not, revise it. Response rules are explained on threat response.
Escalation
Some patterns belong outside the security team. A cluster of integrity signals on payment flows goes to fraud; a surge on an old build goes to the release owner; a campaign using a repackaged copy goes to whoever handles store takedowns and customer warnings.
Release planning
Because every signal carries its build, analytics feeds release decisions directly. When attacks concentrate on versions few customers still use, raising the minimum supported build shrinks that exposure for everyone.
Handling the data
Leads and outcomes stay apart
A dashboard that mixes detections with confirmed attacks overstates risk and wears down trust. Otukan labels every signal as a detection first and only counts it as a confirmed attack or business incident when evidence agrees. Reports filter by label.
Aggregates over individuals
Most analytics questions are answered with counts and cohorts, not with individual installs. Otukan works on pseudonymous identifiers and aggregates, and account linkage stays with the small group that needs it for investigations.
Retention
How long raw signals and aggregates are kept is agreed with you before collection starts. Many teams keep aggregates longer than raw records, which preserves trends while reducing stored detail. Privacy considerations are set out on data privacy.
For an evaluation checklist, see the threat analytics solution guide. For the wider picture, return to mobile app threat monitoring.