[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-sp\u002F800-163":3},{"item":4,"lessons":16,"controls":46,"related":75},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"nist-sp","800-163","SP 800-163","SP 800-163 Rev. 1: Vetting the Security of Mobile Applications",7,"US National Institute of Standards and Technology (NIST)","**What it covers.** NIST guidance on establishing a process to vet mobile applications before organisations approve them for use. It describes defining security requirements for apps, testing them and making approval decisions. It is aimed at organisations that deploy mobile apps to staff, whether built in-house or obtained from third parties.\n\n**In practice.** Organisations define which app behaviours are unacceptable, such as excessive permissions or insecure data storage, test apps using automated tools and analysts, and record approval decisions. Approved apps are distributed through managed channels and reassessed when updated. Evidence includes vetting criteria, test reports and an approved app list.\n\n**Common gaps.** Typical gaps are no vetting for apps installed on managed devices and approvals that are not revisited after updates. Apps developed in-house are also sometimes exempted from vetting.",null,"https:\u002F\u002Fcsrc.nist.gov\u002Fpublications\u002Fsp800","Find it among NIST SP 800 publications","2026-10-18T15:18:43.663+00:00",{"total":9,"list":17},[18,22,26,30,34,38,42],{"slug":19,"title":20,"published_at":21},"hirudo-malware-swaps-banking-apps-to-steal-credentials-and-bypass-security","Hirudo Malware Swaps Banking Apps to Steal Credentials and Bypass Security","2026-10-14T13:20:20.786+00:00",{"slug":23,"title":24,"published_at":25},"hirudo-trojan-replaces-legitimate-banking-apps-to-steal-credentials","Hirudo Trojan Replaces Legitimate Banking Apps to Steal Credentials","2026-10-14T12:20:48.409+00:00",{"slug":27,"title":28,"published_at":29},"google-play-early-access-program-exploited-to-distribute-deceptive-android-apps","Google Play Early Access Program Exploited to Distribute Deceptive Android Apps","2026-09-10T16:22:05.519+00:00",{"slug":31,"title":32,"published_at":33},"deceptive-android-apps-abuse-google-play-early-access-to-bypass-review-safeguards","Deceptive Android Apps Abuse Google Play Early Access to Bypass Review Safeguards","2026-09-10T14:20:27.364+00:00",{"slug":35,"title":36,"published_at":37},"fake-government-app-delivers-android-spyware-via-phishing-sites","Fake Government App Delivers Android Spyware via Phishing Sites","2026-07-22T22:21:26.613+00:00",{"slug":39,"title":40,"published_at":41},"rokarolla-android-trojan-harvests-banking-credentials-via-fake-app-updates","Rokarolla Android Trojan Harvests Banking Credentials via Fake App Updates","2026-06-16T22:21:25.54+00:00",{"slug":43,"title":44,"published_at":45},"rokarolla-android-trojan-hijacks-crypto-and-banking-apps-via-accessibility-abuse","Rokarolla Android Trojan Hijacks Crypto and Banking Apps via Accessibility Abuse","2026-06-16T17:20:37.442+00:00",[47,52,57,61,66,70],{"slug":48,"name":49,"problem":50,"stories":51},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",5,{"slug":53,"name":54,"problem":55,"stories":56},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",3,{"slug":58,"name":59,"problem":60,"stories":56},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",{"slug":62,"name":63,"problem":64,"stories":65},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",2,{"slug":67,"name":68,"problem":69,"stories":65},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",{"slug":71,"name":72,"problem":73,"stories":74},"ai-security","AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",1,[76,80,86,91,95,100,104,109],{"family":5,"item":77,"code":78,"title":79,"together":9},"800-124","SP 800-124","SP 800-124 Rev. 2: Guidelines for Managing the Security of Mobile Devices in the Enterprise",{"family":81,"item":82,"code":83,"title":84,"together":85},"cis","2","Control 2","Inventory and Control of Software Assets",6,{"family":87,"item":88,"code":89,"title":90,"together":51},"gdpr","32","Article 32","Security of processing",{"family":81,"item":92,"code":93,"title":94,"together":51},"4","Control 4","Secure Configuration of Enterprise Assets and Software",{"family":81,"item":96,"code":97,"title":98,"together":99},"14","Control 14","Security Awareness and Skills Training",4,{"family":101,"item":101,"code":102,"title":103,"together":99},"owasp","OWASP","OWASP (Open Worldwide Application Security Project)",{"family":105,"item":106,"code":107,"title":108,"together":56},"nist-csf","pr-at","PR.AT-1","Awareness and Training",{"family":110,"item":111,"code":112,"title":112,"together":56},"itil","overview","ITIL"]