droidandy.com

What It Is

Droid Andy positions itself as “No Nonsense Mobile App Sec,” focusing on mobile application security consulting and research. The main text states that it has spent years conducting research, publishing white papers, and speaking at security conferences, while emphasizing that “the only thing we do is mobile applications” rather than general-purpose security services. Its background also includes involvement in the OWASP Mobile Top Ten project, leadership of the OWASP Newcastle Chapter, and discussion on BBC Click world service about mobile app permission abuse and the state of mobile security.

Core Capabilities and Protection Types

Based on the available information, Droid Andy looks more like a specialist mobile app security consulting/testing team than a standardized security product vendor. Its protection focus centers on mobile application security testing, mobile malware research, analysis of excessive permission risks, and vulnerability identification and avoidance guidance based on the OWASP Mobile Top Ten. The text mentions that it has presented the 2015 OWASP Mobile Security Project Top 10 and used real anonymized vulnerability cases to explain how to avoid introducing similar risks into one’s own applications, suggesting that its services lean toward penetration testing, architecture/code-level security advice, and security training.

Deployment, Management, and Integration

The website text does not disclose specific deployment models, such as whether it offers a SaaS platform, remote testing, on-site testing, CI/CD integration, or API capabilities. It also does not provide information about a management console, alerts, reporting workflows, or similar features. Therefore, it should not be treated as a vendor with an automated security operations platform. It is better suited for project-based procurement of mobile app security assessments or consulting deliverables.

Pricing and Compliance

The public text does not include pricing, packages, billing models, payment methods, or service-level agreement information. It also does not mention compliance or professional certifications such as ISO, SOC, or CREST. Before procurement, buyers should clarify the testing scope, report format, whether retesting is included, vulnerability severity standards, response timelines, and confidentiality agreements.

Pros, Cons, and Ideal Users

Its strengths are its strong focus on mobile security, research and community contribution background, and methodology closely tied to OWASP mobile security practices. The weaknesses are the lack of public information: there are no visible customer cases, pricing, certifications, toolchain integrations, or service support details. It is best suited for teams that need pre-launch Android/iOS app security testing, mobile permission and privacy risk analysis, or mobile security training. If an enterprise needs a continuous scanning platform, centralized alerts, and compliance reports, its capabilities should be further verified.

China Access, Payment, and Alternatives

The crawled text does not provide information on access from mainland China, payment options, or local delivery, so china_access can only be marked as unknown. If cross-border communication, payment, data export, or Chinese-language reporting are important requirements, buyers can also evaluate domestic security vendors that provide app penetration testing, privacy compliance testing, and MLPS-related services as alternatives.