Quokka
What it is
Quokka provides mobile app security testing, app vetting, and Android firmware analysis for organizations assessing vulnerabilities, risky behavior, and compliance gaps. Q-mast examines iOS and Android app binaries for security, privacy, and compliance risks without source code. It combines static, dynamic, interactive, and forced-path analysis, including obfuscated and signed builds. Q-scout assesses mobile apps in the cloud and can integrate with MDM systems such as Microsoft Intune, Hexnode UEM, and Ivanti Neurons for MDM. It works off-device without agents or user disruption, and lets organizations set app rules based on behavior, permissions, SDKs, and network activity. Q-firm analyzes pre-installed, hidden, and privileged Android applications embedded in device firmware. Quokka also generates software bills of materials to identify embedded libraries, vulnerable components, and dependencies. Findings can be mapped to NIAP, NIST, OWASP MASVS, and GDPR requirements. The company says it is SOC 2 compliant and offers a free security report for an iOS or Android app, with findings, compliance mapping, and remediation guidance. Pricing is available on request, and a 30-day trial is listed.
For and against
For
- Q-mast analyzes binaries without source code
- Q-scout works off-device without agents
- Q-firm examines embedded Android applications
- Findings can map to security standards
- Free app security report is offered
Against
- Product pricing is available only on request
- No fixed product prices are listed
- Q-firm covers Android firmware analysis
The verdict
Quokka offers separate tools for app testing, mobile app vetting, and Android firmware review. Prospective customers must request pricing, while the free app report provides findings and remediation guidance.
Who it suits
Quokka is aimed at enterprise security teams, government agencies, and DevSecOps teams, including organizations in regulated industries. Its products cover app development testing, mobile app vetting, and Android firmware analysis.
Plans and prices
Q-firm
Android firmware and system app security analysis
Read 5 Oct 2026 · quokka.io
Q-mast
iOS and Android app security testing · scans in <60 minutes · no source code required · <1% false results
Read 5 Oct 2026 · quokka.io
Q-scout
iOS and Android mobile app vetting · agentless MDM integration
Read 5 Oct 2026 · quokka.io
On the record
- Company security
- Quokka states that it is SOC 2 compliant and says a copy of its SOC 2 report is available by contacting the company.quokka.io · read 5 Oct 2026
- Compliance
- Quokka says its findings can be mapped to NIAP, NIST, OWASP MASVS, and GDPR requirements.quokka.io · read 5 Oct 2026
- Free assessment
- Quokka offers a free security report for an iOS or Android app, including analysis findings, compliance mapping, and remediation guidance.quokka.io · read 5 Oct 2026
- Integrations
- Quokka lists Microsoft Intune, Hexnode UEM, and Ivanti Neurons for MDM for Q-scout, and Azure DevOps, GitHub, GitLab, Jenkins, Snyk, and Appium for Q-mast.quokka.io · read 5 Oct 2026
- Intended customers
- Quokka says it serves enterprise security teams, government agencies, and DevSecOps teams, including organizations in regulated industries.quokka.io · read 5 Oct 2026
- Intended users
- Quokka describes its audience as enterprise security teams, government agencies, and DevSecOps teams, including organizations in regulated industries.quokka.io · read 5 Oct 2026
- Pricing
- The product pages direct prospective customers to request a demo; they do not state product prices.quokka.io · read 5 Oct 2026
- Product
- Quokka provides mobile app security testing, mobile app vetting, and Android firmware security analysis.quokka.io · read 5 Oct 2026
- Products
- Its products include Q-mast for mobile app security testing, Q-scout for mobile app vetting, and Q-firm for Android firmware security analysis.quokka.io · read 5 Oct 2026
- Purpose
- Quokka provides mobile app security analysis to help organizations identify vulnerabilities, risky behavior, and compliance gaps.quokka.io · read 5 Oct 2026
- Q-firm
- Q-firm analyzes pre-installed, hidden, and privileged Android applications embedded in device firmware.quokka.io · read 5 Oct 2026
- Q-mast
- Q-mast analyzes iOS and Android app binaries for security, privacy, and compliance risks without requiring source code.quokka.io · read 5 Oct 2026
- Q-mast analysis
- Q-mast combines static, dynamic, interactive, and forced-path execution analysis, including tests of obfuscated and signed builds.quokka.io · read 5 Oct 2026
- Q-mast integrations
- Q-mast lists CI/CD integrations with GitHub, GitLab, Jenkins, and Azure DevOps, and DevSecOps connections with Appium and Snyk.quokka.io · read 5 Oct 2026
- Q-mast standards
- Q-mast checks against NIAP, NIST, OWASP MASVS, CVEs, and SARIF.quokka.io · read 5 Oct 2026
- Q-scout
- Q-scout vets mobile apps in the cloud and provides risk assessments for Android and iOS devices.quokka.io · read 5 Oct 2026
- Q-scout controls
- Q-scout lets organizations customize rules to allow or block apps based on app behavior, permissions, SDKs, and network activity.quokka.io · read 5 Oct 2026
- Q-scout deployment
- Q-scout integrates with MDM tools and analyzes apps off-device without agents or user disruption.quokka.io · read 5 Oct 2026
