Mobile Security
RASP vs WAF vs app shielding:
what protects what
A WAF filters traffic to your servers, app shielding hardens the app before release, and RASP detects and responds to attacks while the app runs on the device. They overlap a little but do not replace one another.
What is the difference?
WAF protects your servers by filtering web traffic at the network edge. App shielding hardens the app before release, mainly through obfuscation and build-time anti-tamper. RASP runs inside the app and detects and responds to attacks while the app is running.
What each one protects
- WAF: the server side. Blocks malicious requests such as injection attempts. Sees nothing on the device.
- App shielding and obfuscation: the app binary. Makes reverse engineering and tampering harder. Static; does not react to what is happening at runtime.
- RASP: the running app and its environment. Detects rooting, hooking, debugging, repackaging and screen sharing, and can respond.
How they fit together
Obfuscation raises the cost of analysing your app, RASP catches attacks that get through at runtime, and the WAF and server-side fraud controls protect the backend. None replaces the others. NPCI's mobile app security circular for UPI lists code obfuscation, runtime integrity and tamper response as separate controls for this reason. NPCI circular →
Which one do you actually need?
- If attackers are sending malicious requests to your APIs, you need a WAF and server-side controls.
- If attackers are reverse engineering or cloning your app, you need shielding and obfuscation.
- If attackers are running your genuine app on rooted, hooked or emulated devices, or guiding customers through screen sharing, you need RASP.
- If you face all three, you need all three, and signals that connect them in one risk decision.
Frequently asked questions
Do I need both RASP and app shielding?
Most serious programmes use both. Shielding makes the app harder to analyse before release; RASP detects and responds to attacks while the app runs.
Which should a fintech start with?
Most fintechs already run a WAF. The gap is usually on the device, so the next step is runtime protection plus server-side verification of its signals, with obfuscation added in the build pipeline.
Does obfuscation count as RASP?
No. Obfuscation changes how the code looks before release. RASP is active protection while the app runs. NPCI's UPI circular lists them as separate controls.
Can a WAF protect a mobile app?
A WAF protects the servers behind the app by filtering traffic. It cannot see what happens on the user's device, so it cannot detect a hooked or repackaged app.
See it on your app.
Book a free 30-day shadow pilot, or download the platform brochure.