Appdome announced the launch of Threat-Memory, an industry-defining stateful and agentic threat intelligence engine for mobile apps. Threat-Memory is an upgrade to Appdome’s existing Threat-Events threat signaling agent, enabling Appdome-protected applications to maintain local threat histories, apply Agentic Severity Scoring to each detection, verify threat intelligence with Appdome’s backend, and enforce policies dynamically while receiving remote configuration and over-the-air defense updates.
“Scoring risk without exposing the source data and detecting threats without dynamic scoring has been the model that vendors used until today,” said Tom Tovar, Co-Creator & CEO of Appdome. “We’re stepping forward to provide both on-device threat histories and AI-generated scoring in one solution to identify attack sequences, improve decisioning, and let brands build durable threat and risk profiles, all while providing more flexible enforcement and policy control.”
Interactive Intelligence for Mobile Apps
Legacy mobile app security, RASP, and anti-fraud tools are stateless, providing episodic defense for a narrow set of attack vectors. These tools do not retain or expose source threat data locally, and cannot maintain threat state between sessions, installs, or applications. This means they miss repeat attacks, multi-step attack patterns, exploit mutation, and environmental manipulation. These same legacy tools lack a continuous data source on the validity of each detection and the severity of each attack. So, they fail to provide actionable intelligence to the application at runtime.
Threat-Memory changes this by creating a durable, intelligent threat state within each mobile app, filled with the source threat data occurring on the device and enriched by Agentic Severity Scoring, a set of AI models that continuously rank threats at runtime.
This AI-informed threat state is securely accessible from inside each Appdome-enabled app and, based on configuration, can be attributed to the mobile device, application, instance, installation, session, or user account. Each threat history, threat state, and severity intelligence is confirmed and synchronized with Appdome’s backend, ensuring integrity and persistence across app upgrades, reinstalls, OS updates, and active attack conditions.
Leveraging Appdome’s 400+ behavioral, environmental, and identity-based detections, Threat-Memory delivers verified and informed threat and risk profiles across the full attack continuum — including fraud, deepfakes, ATOs, geo-spoofing, malware, and advanced manipulation techniques.
“By combining a local threat repository (or store) with agentic and platform-validated threat history and risk intelligence directly inside mobile applications, we eliminate guesswork in defeating mobile security and fraud risks,” said Kai Kenan, VP of Identity & Reputation Solutions at Appdome. “As a substrate to defeat dedicated attackers and fraudsters, there’s no comparison to Threat Memory.”
A Digital Brain for Mobile Risk
Threat-Memory functions as a digital brain for mobile fraud and attack prevention. It aggregates threat intelligence locally, synchronizes threat histories with Appdome’s backend, and receives secure configuration and intelligence updates from the Appdome platform.
With Threat-Memory, mobile brands can:
- Retrieve true threat-state at any point in the application lifecycle
- Access Agentic Severity Scoring, updated via Appdome’s backend
- Detect multi-step attacks via on-device threat histories and attack patterns
- Evaluate mobile risk during onboarding, authentication, and transactions
- Update certificates, exclusions, and defense controls securely over the air
- Analyze threat histories by device, install, release, or user identity
- Access Appdome’s future digital reputation and risk APIs
“Threat Memory allows us to provide an interactive, flexible and informed defense posture in each application,” said Avi Yehuda, Co-Creator & CTO at Appdome. “Now, Appdome can not only tell you ‘when’ and ‘what’ attack happened, but how many times it happened, if it was different each time and whether it occurred with other attack patterns, and the severity of that stand-alone or combined attack sequence.”
High Performance Detection & Intelligence
Threat Memory is built for high performance, consumer-grade, mobile applications. In fact, a defining capability of Threat-Memory is its ability to operate discreetly in the background, collecting more than 400 mobile application, fraud, social engineering, environmental, network, and device threat signals locally and sending each threat signal to Appdome’s backend for verification.
When needed, mobile apps call Threat Memory locally to retrieve any accumulated threat intelligence and severity scoring at that time. For example, mobile apps can call Threat Memory during sign-up, login, transactions, password resets, or account recovery, all without any external API calls for each data pull or decision. By eliminating round-trip delays, interception risks, and backend processing overhead, critical functions in the mobile app lifecycle can operate smoothly without any impact to the user experience.
In addition, Threat Memory protects each threat history locally and augments or restores severity profiles via Appdome’s backend as needed. Threat Memory is also designed to accept intelligence updates from future Appdome APIs.
“Threat-Memory improves critical on-device protection capabilities,” said Eric Newcomer, Principal Analyst at Intellyx. “A device-based threat history enables local defense against repeated attacks and multi-step attacks. Together with AI, local history data creates actionable intelligence to stop fraud, prevent ATOs, and defeat social engineering.”
