Industry executives and experts share their predictions for 2026. Read them in this 18th annual VMblog.com series exclusive.
By Ted Miracco, CEO, Approov
One of the most critical security exposures facing enterprises today is not buried in cloud infrastructure, but embedded in the mobile applications their customers use every day. Roughly 83 percent of internet traffic now flows through APIs, and nearly two-thirds of that activity originates from mobile apps.
Despite this, the mobile realm continues to be treated as a secondary cybersecurity concern, in large part due to misplaced confidence in app store safeguards. App store vetting is designed to protect consumers from malicious software on their devices. It does not protect enterprise backend APIs from exploitation by the application itself.
That’s why Mobile API exploitation is the attacker’s new frontier. Using AI to reverse-engineer mobile apps in seconds, they extract hard-coded secrets and API keys that give them a direct back door into corporate databases.
Mobile binaries are effectively public, and attackers are increasingly using AI to accelerate reverse engineering efforts. This enables them to extract API credentials, replicate application logic, and automate attacks that closely resemble legitimate user behavior.
Any security strategy for mobile apps that still relies on basic obfuscation, perimeter defenses like WAFs, or app store approval as a control is out of step with modern threats. Organizations must move toward strong mobile app attestation, using cryptographic, token-based verification to ensure API requests originate from untampered applications running on trusted devices. Without that shift, enterprises are effectively leaving sensitive data exposed to automated, massively scalable attacks.
2025 saw the rise of sophisticated attacks via AI scripts that scraped social data to create deepfake voice notes or “smishing” (SMS phishing) messages that were impossible to readily distinguish from an authentic contact.
In 2026, we’ll see machine-speed cyberattacks – for mobile apps, this means AI-powered botnets that replicate human behavior so effectively that they evade legacy bot detection tech. VIBE programming and Generative AI equip attackers to develop malicious mobile slop apps at a scale and speed inconceivable only a year ago.
Organizations still relying on traditional obfuscation, WAFs and app store measures will give their attackers the advantage of speed: new mobile vulnerabilities will be identified and weaponized by AI in a matter of minutes.
These attacks will speed the demise of the narrative that app store monopolies provide a unique layer of safety, starting in 2026. The “Garden” was never intended to serve as a fortress; it was a collection mechanism for extracting taxes from developers.
Malicious apps have always found ways into the official stores, and they will continue to thrive in the newly more open ecosystem. The difference in 2026 will not be that apps are less safe, but rather that the gatekeepers can no longer use “security” as a pretext for rent-seeking.
Unfortunately, as consumer fraud and API-based attacks hit in 2026, monopolists are likely to serve up the same blame games long offered for previous cloning of popular apps and other attacks. Expect the same chorus of “we told you so,” as they blame mandated changes in app store policies for every breach, even if the vulnerabilities being exploited were always there, unprotected.
Regulatorily-mandated app store policy changes will not create threats. They just stop the “protection theater” that have prevented organizations from looking at the real mobile app security problem: the inherent fragility of under-protected mobile APIs.
##
ABOUT THE AUTHOR
Ted is an experienced technology executive with expertise in cybersecurity, particularly in the mobile app and API space. He is the CEO of Approov Mobile Security, a prestigious cybersecurity firm based in Edinburgh, UK and at the forefront of safeguarding mobile apps and APIs from malicious attacks. Approov is renowned for its cutting-edge solutions that provide robust protection in the ever-evolving mobile threat landscape. Prior to his role at Approov, Ted co-founded Cylynt Limited, an anti-piracy and SaaS data analytics company, and played a pivotal role in the establishment of AWR Corporation, an EDA company that was later acquired by National Instruments in 2011 and is now an integral part of Cadence. AWR’s contributions to semiconductor design for wireless applications are widely recognized. During his tenure, Ted spearheaded global sales, marketing, and the implementation of a highly successful license compliance program, ensuring the company’s continued growth and success. Ted’s extensive experience extends beyond established industry giants to include collaborations with Fortune 500 software companies such as Cadence Design Systems, as well as innovative startups like EEsof Inc., which was acquired by Hewlett Packard in 1994 and is now part of Keysight Technologies. This diverse background has equipped him with a comprehensive understanding of the industry’s landscape from multiple perspectives. Ted holds a Bachelor of Science in Electrical and Computer Engineering (B.S.E.E.) from Carnegie Mellon University, a testament to his strong academic foundation and commitment to excellence.
