Mobile threat defense (MTD) is the set of controls that detects attacks on mobile devices, the apps on them and their network connections, and turns each detection into a response and a signal someone can act on. Evaluate it by naming the flow you must protect, deciding whether the app, the operating system or your backend owns each part of the decision, and testing on your supported platforms without harming legitimate users. MTD reports risk; it does not replace device management or server-side checks. Otukan builds mobile threat defense into your own Android and iOS apps, at the point where the attack meets your data.
The threat and the trust boundary
The term covers two delivery models. One is a separate security app installed on devices an organisation manages. The other embeds detection in the app you publish, so it reaches customer devices you will never manage. For banking, payments, health and public-service apps, the second is usually the one that matters. How in-app signals sit next to device-level detection is covered on mobile endpoint detection signals.
Start from the flow, not the threat list. Each flow crosses a different trust boundary.
| Affected flow | Typical threat | Boundary crossed |
|---|---|---|
| Sign-in | Credentials read by an overlay or a non-assistive accessibility service | User input to app |
| Payment approval | Remote control of the session, automated taps | App to backend request |
| Onboarding | Emulator farms, altered camera input | Device sensors to app |
| Stored tokens | Access from a rooted or jailbroken device | App sandbox |
| Any network call | Traffic routed through an interception proxy | App to server connection |
Control fit
What the app does
Checks inside the app see what the attacker is doing to it: hooking, debugging, overlays, capture and a modified operating system. Only the app can apply a response in the moment, such as hiding a sensitive screen or pausing a transfer.
What the operating system does
Android and iOS each enforce a sandbox and code signing, and each offers its own attestation service: Play Integrity on Android and App Attest on iOS. These give your server a verdict about the device and the app, but they report different things on each platform, and neither applies a response inside your app at the moment of an attack.
What your backend does
Your server is the only party the attacker cannot touch. It should receive threat signals with each sensitive request and make the final decision, combining them with account history and transaction risk.
Evaluation
- Platforms. Ask for scope per detection, separately for Android and iOS, and for each framework you ship.
- Evidence. Reproduce each threat on physical devices and confirm that the signal reaches your backend with the request.
- User impact. Run clean devices and assistive tools as a baseline, and start in observe mode before you restrict any flow.
- Telemetry. Check what each signal contains and how long it is kept.
How Otukan applies mobile threat defense
Otukan builds threat detection into your own Android, iOS, Flutter and React Native apps. It detects hooking, debuggers, emulators, rooted and jailbroken devices, overlay and accessibility abuse on Android and intercepted connections, applies the response you set for each flow and attaches the signal to sensitive requests so your server makes the final call. It fits your existing build and release pipeline, and your signing keys stay with you.
For the product view, see mobile threat defense in apps. Signal monitoring is covered on threat monitoring, and related definitions are in the mobile security glossary.