We aren’t a financial business. Can we still use the platform?
Yes. While we primarily work with banking, fintech, and cryptocurrency platforms, our technology also applies to industries such as social media, marketplaces, and gaming. Tell us about your use case, and we’ll explore where the platform could fit.
Do we need to involve our development, authentication, or KYC vendor in a pentest?
Not always. We can often scope testing to offline binary and runtime analysis without touching live endpoints. During scoping, we’ll establish the testing boundaries and identify any vendor permissions or contractual restrictions that need to be addressed. The goal is to find weaknesses before threat actors do.
Our fraud provider already includes a mobile attestation SDK. Why add Cipherstep?
An attestation SDK’s presence alone doesn’t tell you how resilient it is to tampering or reverse engineering. Mobile security is a specialist discipline that requires deep knowledge of Android and iOS internals and continuous research into bypass techniques. A pentest can show how your current SDK holds up and where an additional layer could add value.
How does Cipherstep keep pace with sophisticated threat actors?
We set incident response commitments through an SLA and system performance targets through an SLO. No security provider can guarantee that its systems will never be bypassed or reverse-engineered. Our research team is committed to staying at the forefront of mobile security research, continuously testing and strengthening our defenses as threats evolve.
Does the platform support SSO?
Yes. Our portals include dedicated identity and access management, with SSO, restricted team roles, and configurable MFA requirements. We support passkeys, authenticator apps, and security keys.