Quixxi Scan vs Quokka
Quixxi Scan
quixxi.com
Quokka
quokka.ioSide by side
| Figure | Quixxi Scan | Quokka |
|---|---|---|
| Price from | $24.92/mo | — |
| Free plan | — | — |
| Free trial | Yes | — |
| Open source | — | — |
| Web | Yes | Yes |
| iOS | Yes | Yes |
| Android | Yes | Yes |
| API | — | Yes |
| Plans published | 10 | 3 |
| Spec score · Mobile Application Security Testing Software | 7.8 (#9) | 7.7 (#10) |
| Compliance | The SAST page says the product aligns with GDPR guidelines, addresses OWASP Mobile Top 10 risks, assists with PCI DSS requirements, and incorporates NIST recommended practices. | Quokka says its findings can be mapped to NIAP, NIST, OWASP MASVS, and GDPR requirements. |
| Intended users | The partner page describes the services as intended for mobile app developers and organizations with significant numbers of mobile app users. | Quokka describes its audience as enterprise security teams, government agencies, and DevSecOps teams, including organizations in regulated industries. |
| Product | Quixxi Scan provides static and dynamic security assessments of mobile apps with recommendations to address vulnerabilities. | Quokka provides mobile app security testing, mobile app vetting, and Android firmware security analysis. |
| Support | The support portal provides a knowledge base and ticket submission, and the pricing article lists support by email or live chat. | Quokka provides a customer support link from its website navigation. |
Plans
Quixxi Scan
- API Scan — One-off$29, paid once
- SAST Scan — One-off$29, paid once
- API Scan — Monthly$49 a month
- SAST Scan — Monthly$49 a month
- DAST Scan — One-off$199, paid once
- API Scan — Yearly$299 a year
- Shield — One-off$399, paid once
- SAST Scan — Yearly$499 a year
- Shield — Monthly$599 a month
- Shield — Yearly$5,999 a year
In their own words
Quixxi Scan
Quixxi Scan assesses Android and iOS app security through static and dynamic analysis, with recommendations for addressing vulnerabilities. SAST analyzes apps to identify risks, explain them and suggest fixes; automated continuous scanning can be integrated into a CI/CD pipeline. DAST examines app behavior, including SSL pinning, root detection, sensitive data, endpoint identity, encryption, copy and paste, and screenshots. A separate API Scan checks for issues such as injection attacks, authentication flaws, cross-site scripting and insecure direct object references. The service runs in the cloud and is available on Android, iOS and the web. The site offers a free SAST trial and a free app scan link, but does not state a trial duration. One-off SAST and API scans cost $29 as a one-time purchase; DAST costs $199, paid once. Monthly SAST and API scans cost $49 a month. The pricing article says there is no unlimited monthly DAST plan, and custom plans can be based on selected apps and modules. Quixxi says the product aligns with GDPR guidelines, addresses OWASP Mobile Top 10 risks, assists with PCI DSS requirements and incorporates NIST practices.
Quokka
Quokka is a cloud platform for mobile application security testing, app vetting, and Android firmware analysis. Q-mast examines iOS and Android binaries without source code, combining static, dynamic, interactive, and forced-path execution, including obfuscated and signed builds. It checks standards and formats including NIAP, NIST, OWASP MASVS, CVEs, and SARIF, and connects with GitHub, GitLab, Jenkins, Azure DevOps, Appium, and Snyk. Q-scout performs cloud-based risk assessments for Android and iOS apps, works off-device without agents, integrates with Microsoft Intune, Hexnode UEM, and Ivanti Neurons for MDM, and supports rules based on behavior, permissions, SDKs, and network activity. Q-firm analyzes pre-installed, hidden, and privileged Android firmware applications. Quokka also creates software bills of materials identifying libraries, vulnerable components, and dependencies. Findings can map to NIAP, NIST, OWASP MASVS, and GDPR requirements. The company states SOC 2 compliance and offers a free app security report. Pricing is available on request, with a 30-day trial.