Quixxi Scan

Quixxi Scan is a cloud service for security checks on mobile apps and APIs. It is best suited to mobile developers and organizations responsible for multiple app users. Its separate SAST, DAST and API scans offer useful coverage, but buyers should weigh the higher DAST cost and lack of an unlimited monthly DAST plan.

Overview

Quixxi Scan combines static and dynamic assessments of Android and iOS apps with API scanning. Its SAST checks explain vulnerabilities and suggest fixes, while DAST covers runtime concerns and API Scan targets common API weaknesses. That combination can serve teams looking across several parts of an app’s security, but the scans are sold separately, so buyers need to match each plan to an app or domain and the kind of assessment they need.

The service aligns with GDPR guidelines, addresses OWASP Mobile Top 10 risks, assists with PCI DSS requirements and incorporates NIST-recommended practices. These are useful reference points for teams working against those frameworks, rather than a substitute for evaluating their own compliance needs.

Key features

Static and dynamic analysis

SAST analyzes Android and iOS apps, explains identified vulnerabilities and recommends actionable fixes. Continuous scanning can be integrated into a CI/CD pipeline, making it a relevant option for teams that want checks incorporated into development workflows.

DAST tests apps dynamically, including SSL pinning, root detection, sensitive data, endpoint identity, encryption, copy and paste, and screenshots. This extends coverage beyond static analysis, but its $199 one-off price per app makes it a more substantial purchase than SAST, especially for teams assessing several apps.

API scanning

API Scan checks for injection attacks, authentication flaws, cross-site scripting and insecure direct object references. Its per-domain pricing makes it a separate cost from app scans, but the monthly and yearly options offer unlimited scans for a domain.

Access and support

Support includes a knowledge base and ticket submission, with email or live chat support also offered. Security questions and reports can be sent to [email protected].

Pricing

Quixxi Scan is freemium, with paid plans starting at $29. Its free access includes a SAST trial and a free app scan. Paid plans distinguish one-off scans from recurring unlimited scan plans, and price by app or domain. Monthly plans marked auto-renewing require particular attention to ongoing spend.

PlanPrice and coverageSAST Scan — One-off$29, paid once; $29 per scan, Android & iOS, per app.API Scan — One-off$29, paid once; $29 per scan, per domain.API Scan — Monthly$49 a month; $49, unlimited scans per domain; auto-renewing.SAST Scan — Monthly$49 a month; $49, unlimited scans for Android & iOS per app; auto-renewing.DAST Scan — One-off$199, paid once; $199 per scan, Android or iOS, per app.API Scan — Yearly$299 a year; $299, unlimited scans per domain.Shield — One-off$399, paid once; $399 per shield, Android & iOS, per app.SAST Scan — Yearly$499 a year; $499, unlimited scans for Android & iOS per app.Shield — Monthly$599 a month; $599, unlimited Shield for Android & iOS per app; auto-renewing.Shield — Yearly$5,999 a year; $5999 unlimited for Android & iOS per app.The $29 one-off SAST and API plans suit an occasional check without a recurring commitment, but are charged per scan. Monthly and yearly SAST or API plans make more sense for repeated checks on the same app or domain; their unlimited scans are bounded by that per-app or per-domain scope. DAST is sold as a one-off scan at $199, with no unlimited monthly DAST plan, so teams needing regular dynamic assessments should account for that per-scan cost. Shield plans are also offered, but the plan names alone do not establish what Shield includes. Custom plans are based on apps and selected modules, with bundles described as offering savings.

Platforms

Quixxi Scan runs as a cloud service and supports Android, iOS and web. Its app analysis is focused on Android and iOS, while API Scan is priced per domain. The included-app allowance is one, so organizations assessing more apps should consider the custom plans based on app count and selected modules.

Who it's for

Quixxi Scan is a fit for mobile developers who want vulnerability explanations and actionable SAST recommendations, particularly if they can connect continuous scanning to a CI/CD pipeline. Organizations with significant numbers of mobile app users may also value the mix of static, dynamic and API checks. It is less compelling for buyers who need unlimited recurring DAST or broad multi-app coverage at a predictable single-plan price.

Pros and cons

Pros: SAST covers both Android and iOS and pairs findings with suggested fixes, making results more actionable than a bare vulnerability list.

Pros: CI/CD integration for continuous SAST supports checks within a development pipeline.

Pros: API plans include unlimited scans per domain at monthly or yearly terms, useful for repeated checks without a per-scan charge.

Cons: DAST costs $199 per scan per app and has no unlimited monthly option, a meaningful constraint for frequent testing.

Cons: SAST and API plans are scoped per app or domain, so the low entry prices do not cover an unrestricted portfolio.

Cons: Monthly SAST, API and Shield plans auto-renew, which buyers should factor into ongoing costs.

Alternatives

Mobile Application Security Testing Software is a useful starting point for comparing the category. Choose Ostorlab instead if its free Community plan for unlimited mobile app scans, attack surface discovery, remediation and ticketing better fits the need, or if its AppSec Web/API plan at $299 a month suits the budget. AppSweep is a strong alternative for teams seeking a free plan with unlimited Android and iOS scans, unlimited team members, static and interactive analysis, CI CLI, OWASP MASVS alignment and PDF findings reports.

SEBASTiAn is another alternative. Consider Cellebrite Inseyets if its web and Windows platform fit the workflow. Reversense Security offers a free Android-focused Dexcalibur Community Edition, while its Pro option is also available. Zimperium zScan is a paid alternative with a free trial. Appknox is a paid alternative with a free trial, and Data Theorem Mobile Secure is another paid option.

Verdict

Quixxi Scan is best for mobile developers and app-owning organizations that want SAST recommendations, optional CI/CD integration, and separately priced dynamic and API assessments. Its $29 entry plans and unlimited SAST or API subscriptions can suit focused, repeated checks. Look elsewhere if regular DAST is central to the job: the $199 per-scan price and absence of an unlimited monthly DAST plan make that need harder to budget.