Mobile RASP Guide
What is mobile RASP
(runtime application self-protection)?
Mobile RASP is security code built into a mobile app that detects and responds to attacks while the app is running. It checks for rooted or jailbroken devices, debuggers, code hooking such as Frida, repackaged apps and screen-sharing tools, then blocks, degrades or reports the session.
How does mobile RASP work?
RASP ships as an SDK inside the app. At runtime it inspects the device, the integrity of the app's own code and the processes around it, and raises signals. The app or a backend decides the response: allow, step up authentication, limit, or block.
Because the checks run on the device, RASP sees attacks that never reach a server, such as a debugger attached to the app or a hooking framework rewriting a function.
What does mobile RASP detect?
- Rooted or jailbroken devices, where an attacker has system-level control.
- Code hooking and instrumentation, such as Frida and Xposed, used to rewrite app behaviour at runtime.
- Debuggers and emulators, used to inspect or automate the app.
- Repackaged or cloned apps, where a tampered copy of the app is distributed or signed with a different key.
- Screen sharing, mirroring and overlays, used in remote-access scams and tap-jacking.
- Proxy and man-in-the-middle setups, used to read or alter app traffic.
What are the limits of RASP?
RASP is a control inside an environment the attacker owns. On a rooted device a skilled attacker can try to bypass individual checks, so RASP is strongest when its signals are verified on the server and paired with hardware-backed attestation, rather than trusted on their own. Be wary of any vendor that presents RASP as a complete answer.
It also does not replace secure coding, testing or server-side fraud controls. It is one layer.
Mobile RASP vs WAF vs app shielding
A WAF filters traffic at the network edge. App shielding hardens the app binary before release (obfuscation, build-time anti-tamper). RASP watches behaviour at runtime, on the device. They overlap but do not replace each other. Read the full comparison →
Is mobile RASP required by Indian regulators?
For UPI apps it is. NPCI circular NPCI/2025-26/IS/003, dated 19 May 2025, mandates mobile application security controls and RASP enhancements for all UPI applications, with annual certification by a CERT-In empanelled auditor. NPCI UPI app security circular →
For banks, the RBI's 2026 Digital Payment Security Controls Directions set mobile payment application controls, some mandatory and some advisory. RBI Digital Payment Security Controls →
SEBI and DPDP also set app and endpoint security expectations. See compliance.
How do you choose a mobile RASP?
- Detection depth across Android and iOS, not just a root check.
- Whether signals are verified server-side or trusted from the device.
- Measured performance overhead in your own app.
- How false positives are handled, so genuine customers are not blocked.
- Whether it connects to fingerprinting and fraud scoring, or leaves you to integrate those separately.
- Pricing you can predict, and a pilot before you commit.
How NonaShield approaches mobile RASP
NonaShield combines RASP with hardware-rooted device fingerprinting, behavioural signals, a fraud engine and a signed evidence chain, from one SDK for Android and iOS. Runtime signals are signed and verified on the server, so a single bypassed check is not the end of the story. See the unified platform →
Related pages
- How to detect Frida hooking on Android
- Why root detection gets bypassed (Magisk, Zygisk)
- RASP vs WAF vs app shielding
- Screen-sharing and remote-access fraud
- Play Integrity API: what it proves and what it does not
- Overlay attacks on Android banking apps
- Emulator and cloned-app detection
- OWASP MASVS resilience controls
- Build vs buy: mobile RASP
- Mobile security glossary
Frequently asked questions
What is mobile RASP?
Mobile RASP (runtime application self-protection) is security code built into a mobile app that detects and responds to attacks while the app is running. It checks for rooted or jailbroken devices, debuggers, code hooking such as Frida, repackaged apps and screen-sharing tools, then blocks, degrades or reports the session.
How is RASP different from app shielding or obfuscation?
App shielding and obfuscation harden the app's code before release so it is harder to reverse engineer. RASP watches the app and its environment while it runs and reacts to attacks as they happen. Most serious mobile security programmes use both.
Does RASP replace a WAF?
No. A web application firewall filters traffic at the network edge, before it reaches your servers. RASP runs inside the mobile app on the user's device. They protect different places and complement each other.
Does mobile RASP slow an app down?
A well-built RASP SDK runs lightweight checks and should not noticeably affect the user experience, but the only reliable answer is to measure overhead in your own app during a pilot, on mid-range Android devices as well as flagship phones.
Is RASP required for banking and UPI apps in India?
For UPI apps, yes: NPCI circular NPCI/2025-26/IS/003 (19 May 2025) mandates mobile application security controls and RASP enhancements for all UPI applications. RBI's Digital Payment Security Controls Directions set mobile app controls for banks, with some controls mandatory and others advisory.
Can RASP be bypassed?
Individual client-side checks can be bypassed by a determined attacker who controls the device. That is why RASP should be paired with server-side verification of its signals and hardware-backed attestation, so a bypassed check does not become a successful fraud.
See it on your app.
Book a free 30-day shadow pilot, or download the platform brochure.