Q-mast
Quokka lists offices in San Jose, California, and Arlington, Virginia.
What it is
Q-mast is Quokka’s automated security testing solution for iOS and Android applications. It analyzes compiled binaries without source code, including obfuscated, protected, and signed builds. Testing combines static, dynamic, interactive, and forced-path execution analysis, while device observation covers non-rooted and non-jailbroken devices. Quokka says scans take less than 60 minutes and report less than 1% false results. For software supply-chain review, Q-mast generates version-precise SBOMs and examines SDK behavior, vulnerable dependencies, and risky third-party code. Checks include NIAP, NIST, OWASP MASVS, CVEs, and SARIF. Listed connections include GitHub, GitLab, Jenkins, Azure DevOps, Appium, and Snyk, with API support for CI/CD and DevSecOps integration. Quokka positions the product for developers adding security testing to the software development lifecycle. The paid product has pricing on request, and prospective customers can request a personalized demo. Quokka states that it is SOC 2 compliant and makes its report available by contacting the company. Customer credentials are required for its knowledge base library.
For and against
For
- Analyzes binaries without source code
- Supports protected, signed, and obfuscated builds
- Combines static and dynamic testing methods
- Generates version-precise SBOMs
- Integrates with common CI/CD tools
Against
- Pricing is available only on request
- Knowledge base access requires customer credentials
- Focused on iOS and Android applications
The verdict
Q-mast covers binary, runtime, and supply-chain checks within a mobile development workflow. Its paid, demo-led access and credentialed support library should be considered before adoption.
Who it suits
Q-mast suits developers integrating mobile security checks into software development and DevSecOps workflows. It is relevant when teams need binary, dependency, and runtime analysis for both major mobile platforms.
On the record
- Analysis methods
- Q-mast combines static, dynamic, interactive, and forced-path execution analysis.quokka.io · read 7 Oct 2026
- API
- The product page lists API support for CI/CD and DevSecOps integration.quokka.io · read 7 Oct 2026
- Binary scanning
- It analyzes compiled app binaries without requiring source code, including obfuscated builds.quokka.io · read 7 Oct 2026
- Binary support
- It analyzes compiled, obfuscated binaries and scans protected and signed builds.quokka.io · read 7 Oct 2026
- Device testing
- The product page says Q-mast observes app behavior on non-rooted, non-jailbroken devices.quokka.io · read 7 Oct 2026
- Integrations
- Quokka lists GitHub, GitLab, Jenkins, Azure DevOps, Appium, and Snyk integrations for Q-mast.quokka.io · read 7 Oct 2026
- Intended users
- Quokka presents Q-mast for teams testing mobile apps they build and for DevSecOps teams integrating app testing into CI/CD workflows.quokka.io · read 7 Oct 2026
- Pricing
- The Q-mast product page directs prospective customers to request a personalized demo; it does not state a price.quokka.io · read 7 Oct 2026
- Protected builds
- Quokka says Q-mast supports protected and signed builds, including signed iOS builds.quokka.io · read 7 Oct 2026
- Purpose
- Q-mast is an automated mobile app security testing solution that analyzes iOS and Android apps without requiring source code.quokka.io · read 7 Oct 2026
- SBOM
- Q-mast generates version-precise software bills of materials and analyzes SDK behavior and vulnerable dependencies.quokka.io · read 7 Oct 2026
- Scan speed
- Quokka says scans take less than 60 minutes and report less than 1% false results.quokka.io · read 7 Oct 2026
- Scan time
- Quokka says scans take less than 60 minutes and report less than 1% false results.quokka.io · read 7 Oct 2026
- Security
- Quokka states that it is SOC 2 compliant.quokka.io · read 7 Oct 2026
- Security assurance
- Quokka says it achieved SOC 2 compliance and that its SOC 2 report is available by contacting the company.quokka.io · read 7 Oct 2026
- Standards
- Quokka says Q-mast checks against NIAP, NIST, OWASP MASVS, CVEs, and SARIF.quokka.io · read 7 Oct 2026
- Supply chain
- It generates version-precise SBOMs and analyzes SDK behavior, vulnerable dependencies, and risky third-party code.quokka.io · read 7 Oct 2026
- Support
- Quokka directs customers to log in with customer credentials to access its knowledge base library.quokka.io · read 7 Oct 2026
