Reversense Security vs Zimperium zScan

Reversense Security analyzes mobile and embedded application binaries without requiring source code or manual reverse engineering. It can assess binaries and packaged apps from app stores or CI/CD pipelines, using IAST and fuzzing to uncover exploitable vulnerabilities and runtime attack paths. Its Dexcalibur engine combines static, dynamic, and symbolic analysis for deobfuscation and tailored investigations, including highly obfuscated apps. An integrated Dalvik virtual machine supports symbolic and concrete execution of bytecode that needs implicit context. Teams can monitor application-level network traffic, including HTTPS, without changing device network settings or bypassing SSL pinning; they can also monitor and tamper with application-level NFC commands. Multiple devices and apps can be instrumented within one project. Other functions include automated privacy reports for Android and iOS against GDPR, CRA, PCI, and CCPA referentials, and digital forensics to find where mobile apps store identity information. The free Dexcalibur Community Edition costs nothing and supports Android instrumentation generation and dynamic deobfuscation.

Zimperium zScan scans mobile applications for security, privacy, protection, and compliance gaps. It uses static, dynamic, and interactive analysis, with the product page saying results are available in 15–30 minutes. Teams can submit IPA, APK, or AAB files, or an App Store URL; native and hybrid app stacks are supported. Findings may include descriptions, code snippets, affected locations, and recommendations, with reports available in a dashboard and as PDF or machine-readable JSON. An AI Insights panel offers contextual guidance and configuration fixes. zScan examines third-party components, SDKs, and SBOMs for supply chain risks and unexpected AI usage. It also checks whether anti-tampering, obfuscation, runtime protection, encryption, and SSL pinning are effectively implemented. Zimperium describes CI/CD workflows with automated testing and security gates; GitHub Actions can scan merges and pull requests and surface findings in GitHub Advanced Security code scanning alerts. The cloud service is described as requiring no infrastructure setup or tuning. Pricing is on request, and the free 30-day trial offers unlimited mobile app scans, with account access provided after approval.