Mobile App Security with Ryan Lloyd

Mobile apps have become a primary interface for critical services, including banking, payments, and health care. Unlike web applications, much of the logic and intellectual property in a mobile app lives directly on the user's device, which is an environment the developer doesn't control. That makes mobile apps uniquely exposed to reverse engineering, runtime manipulation, and fraud. As more critical functionality shifts to mobile, the need to harden apps against sophisticated attackers continues to grow. GuardSquare builds tools to protect and test mobile applications against both static and dynamic threats. Its platform has features including layered code obfuscation, runtime application self protection, mobile specific security testing, threat monitoring, and API attestation. Ryan Lloyd is the chief product officer at GuardSquare. In this episode, he joins Gregor Van to discuss why mobile security differs from desktop and web security, how reverse engineering tools have evolved, the role of compiler based obfuscation and runtime protections, common mobile app vulnerabilities, and how LLMs are reshaping the attacker landscape. Gregor Vand is a security focused technologist, having previously been a CTO across cybersecurity, cyber insurance, and general software engineering companies. He is based in Singapore and can be found via his profile at van.hk or on LinkedIn. Hello, and welcome to Software Engineering Daily. My guest today is Ryan Lloyd. Hi there. Great to be here. Yeah. Great to have you here, Ryan. So you're the chief product officer of GuardSquare. We're gonna be hearing all about GuardSquare through the episode and everything mobile app security. Not a topic that we've covered in much depth before, so this is gonna be an interesting one. But as we like to do on SE daily, just what was your path to Garscore, I guess? And I'm becoming the CPO at Garscore. Yeah. So for twenty, twenty five years now, I've been working for a series of companies that provide software developer tools. So in early two thousand, I started with a company that built, version control and issue tracking software, predating Git and Jira and those kinds of things. And then eventually moved into a company called SmartBear where we focused on software test automation and quality assurance tools. And then more recently, I spent a bit of time in a company called Veracode, which is my first foray into the world of security and application security specifically, which has a lot of similarities to automated testing. Scanning apps to find vulnerabilities is not that different than testing apps to find bugs and defects. And then the last five years, I've been here at GuardSquare. So throughout my journey, I've been focused on product management and really on tools for developers and then more recently around security. And now here at GuardSquare, it's all about mobile app security, so an even more narrow and specialized space within security. But, yeah, all about focusing on our customers who are app developers and supporting them in how they secure their mobile applications. Yeah. Nice. So then, I guess, …