November 12th | 09:00 GMT / 10:00 CET / 17:00 SGT
November 13th | 10:00 AM PST / 1:00 PM EST
87% of apps were attacked in 2026. The first attack arrived 1 hour and 56 minutes after publication.
A laptop, freely available tools and a published APK. That is all it takes to read your business logic, trace your authentication flow, map your APIs and find whatever was left hardcoded. AI has removed most of the skill and time it used to cost.
This session is not a deck about that risk. John Goodland reverse engineers a mobile banking application live, applies Arxan Security protections to the same app, then runs the attack again so you can see the difference for yourself. He also covers the part most vendors leave out: how a protected app can still be tested.
We cover:
Break: Live reverse engineering with JADX against an unprotected banking APK
Protect: MASVS-aligned hardening, obfuscation, anti-tampering and runtime protection
Before and after: The identical attack against the protected build, side by side
Test: How secure-by-default protections behave when a test environment isn't trusted
Watch: Runtime visibility with App Aware once the app is out in the field

Global Practice Lead, Application Security
Digital.ai