Skip to content
SPECIFICTION
Get listed

Quokka

quokka.io

WebiOSAndroidAPI
Visit quokka.io
Spec score 7.7 #10 of 21 in Mobile Application Security Testing Software

What it is

Quokka is a cloud platform for mobile application security testing, app vetting, and Android firmware analysis. Q-mast examines iOS and Android binaries without source code, combining static, dynamic, interactive, and forced-path execution, including obfuscated and signed builds. It checks standards and formats including NIAP, NIST, OWASP MASVS, CVEs, and SARIF, and connects with GitHub, GitLab, Jenkins, Azure DevOps, Appium, and Snyk. Q-scout performs cloud-based risk assessments for Android and iOS apps, works off-device without agents, integrates with Microsoft Intune, Hexnode UEM, and Ivanti Neurons for MDM, and supports rules based on behavior, permissions, SDKs, and network activity. Q-firm analyzes pre-installed, hidden, and privileged Android firmware applications. Quokka also creates software bills of materials identifying libraries, vulnerable components, and dependencies. Findings can map to NIAP, NIST, OWASP MASVS, and GDPR requirements. The company states SOC 2 compliance and offers a free app security report. Pricing is available on request, with a 30-day trial.

Spec sheet

Purpose
Quokka provides mobile app security analysis to help organizations identify vulnerabilities, risky behavior, and compliance gaps.Read 5 Oct 2026 · quokka.io
Product
Quokka provides mobile app security testing, mobile app vetting, and Android firmware security analysis.Read 5 Oct 2026 · quokka.io
Intended users
Quokka describes its audience as enterprise security teams, government agencies, and DevSecOps teams, including organizations in regulated industries.Read 5 Oct 2026 · quokka.io
Integrations
Quokka lists Microsoft Intune, Hexnode UEM, and Ivanti Neurons for MDM for Q-scout, and Azure DevOps, GitHub, GitLab, Jenkins, Snyk, and Appium for Q-mast.Read 5 Oct 2026 · quokka.io
Compliance
Quokka says its findings can be mapped to NIAP, NIST, OWASP MASVS, and GDPR requirements.Read 5 Oct 2026 · quokka.io
Support
Quokka provides a customer support link from its website navigation.Read 5 Oct 2026 · quokka.io
Founded
2011Read 28 Sep 2026 · quokka.io
Company security
Quokka states that it is SOC 2 compliant and says a copy of its SOC 2 report is available by contacting the company.Read 5 Oct 2026 · quokka.io
Free assessment
Quokka offers a free security report for an iOS or Android app, including analysis findings, compliance mapping, and remediation guidance.Read 5 Oct 2026 · quokka.io
Intended customers
Quokka says it serves enterprise security teams, government agencies, and DevSecOps teams, including organizations in regulated industries.Read 5 Oct 2026 · quokka.io
Pricing
The product pages direct prospective customers to request a demo; they do not state product prices.Read 5 Oct 2026 · quokka.io
Products
Its products include Q-mast for mobile app security testing, Q-scout for mobile app vetting, and Q-firm for Android firmware security analysis.Read 5 Oct 2026 · quokka.io
Q-firm
Q-firm analyzes pre-installed, hidden, and privileged Android applications embedded in device firmware.Read 5 Oct 2026 · quokka.io
Q-mast
Q-mast analyzes iOS and Android app binaries for security, privacy, and compliance risks without requiring source code.Read 5 Oct 2026 · quokka.io
Q-mast analysis
Q-mast combines static, dynamic, interactive, and forced-path execution analysis, including tests of obfuscated and signed builds.Read 5 Oct 2026 · quokka.io
Q-mast integrations
Q-mast lists CI/CD integrations with GitHub, GitLab, Jenkins, and Azure DevOps, and DevSecOps connections with Appium and Snyk.Read 5 Oct 2026 · quokka.io
Q-mast standards
Q-mast checks against NIAP, NIST, OWASP MASVS, CVEs, and SARIF.Read 5 Oct 2026 · quokka.io
Q-scout
Q-scout vets mobile apps in the cloud and provides risk assessments for Android and iOS devices.Read 5 Oct 2026 · quokka.io
Q-scout controls
Q-scout lets organizations customize rules to allow or block apps based on app behavior, permissions, SDKs, and network activity.Read 5 Oct 2026 · quokka.io
Q-scout deployment
Q-scout integrates with MDM tools and analyzes apps off-device without agents or user disruption.Read 5 Oct 2026 · quokka.io
Q-scout integrations
Q-scout names Microsoft Intune, Hexnode UEM, and Ivanti Neurons for MDM as integrations.Read 5 Oct 2026 · quokka.io
Security compliance
Quokka says it is SOC 2 compliant and invites customers to contact it for a copy of its SOC 2 report.Read 5 Oct 2026 · quokka.io
Supply chain
Quokka generates software bills of materials to identify embedded libraries, vulnerable components, and dependencies.Read 5 Oct 2026 · quokka.io

Plans and prices

Q-firm Priced on request Android firmware and system app security analysis Read 5 Oct 2026 · quokka.io
Q-mast Priced on request iOS and Android app security testing · scans in <60 minutes · no source code required · <1% false results Read 5 Oct 2026 · quokka.io
Q-scout Priced on request iOS and Android mobile app vetting · agentless MDM integration Read 5 Oct 2026 · quokka.io

Every Quokka plan and price →

Strong points and limits

Strong points

  • Analyzes binaries without requiring source code
  • Combines static, dynamic, interactive, and forced-path analysis
  • Agentless MDM integration for off-device vetting
  • Firmware analysis covers hidden and privileged Android apps
  • Free security report includes findings and remediation guidance

Limits

  • Product pricing is available only on request
  • Q-firm focuses on Android firmware and system apps
  • Cloud deployment may not suit on-premises requirements

Who it suits

Quokka is aimed at enterprise security teams, government agencies, DevSecOps teams, and regulated organizations assessing mobile risk and compliance. It supports Android and iOS workflows through cloud deployment and integrations.

Verdict

Quokka separates app testing, app vetting, and firmware review into Q-mast, Q-scout, and Q-firm. Its standards mapping, integrations, and free assessment support enterprise evaluation, while pricing requires a sales request.

Where Specifiction places it

Alternatives to QuokkaAll alternatives →