As Black Hat USA 2026 approaches, mobile app security is emerging as one of the industry’s most urgent — and most overlooked — battlegrounds. Ahead of the show, VMblog sat down with Alan Snyder, CEO of NowSecure, to discuss how frontier AI models are compressing the timeline between vulnerability discovery and exploitation, and why mobile apps — distributed as public binaries and easily reverse engineered — have become a prime target. Snyder points to a UK government evaluation in which an advanced AI model autonomously found vulnerabilities and executed multi-step attacks that once required a skilled human team, underscoring just how quickly the threat landscape is shifting.
Snyder also previews what NowSecure will bring to Black Hat 2026, including new AI-native platform capabilities — an AI Chat interface, an MCP server, and an extended API for agentic workflows — alongside new AI-specific findings designed to surface hidden AI components, data leaks, and risky data flows inside mobile apps. Drawing on the company’s 2026 Mobile App Risk Management Survey, which found that 95% of organizations already have AI running inside their mobile apps yet more than a third can’t fully see what that AI is doing, Snyder makes the case that continuous, runtime-based testing — not annual reviews or code inspection alone — is now essential for security teams heading into the second half of 2026.
++
VMblog: For readers who may not be familiar, give us the elevator pitch — who you are, what you do, and what genuinely sets you apart in today’s crowded cybersecurity market.
Alan Snyder: NowSecure analyzes mobile app binaries and runtime behavior on real devices to find out what an app is actually doing: what data it collects, where that data goes, and what third-party or AI components are running inside it. Security and compliance teams use that visibility to catch problems before an app ships and for critical third-party apps. Our customers include large banks, telecoms, healthcare organizations, and government agencies including, the DOJ, DOD, and DOS. We’ve also supported open-source security tools for more than a decade, including Frida and Radare2, and contributed to the OWASP MASVS standard.
VMblog: The threat landscape heading into Black Hat 2026 looks very different from even 18 months ago. Which specific threat vectors — whether that’s agentic AI attacks, identity-based intrusions, critical infrastructure targeting, or something else — is your solution most directly built to address?
Snyder: Speed is the biggest change we’re seeing. Frontier AI models like Anthropic’s Claude Mythos are compressing the time between when a vulnerability is discovered and when it’s exploited. In a UK government evaluation, Mythos was able to autonomously find vulnerabilities and carry out multi-step attacks that used to require a skilled human team and significant time to pull off.
Mobile apps are especially exposed to that shift. Apps are distributed as public binaries, so the entire app is available for anyone to reverse engineer and cloud security controls are useless. That makes them a good target for AI models built to analyze an app. We know that mobile apps are used by attackers to enumerate APIs and identify weaknesses. An attacker can diff a new app version against the last one, spot exactly what changed in something like the authentication or token handling, and start working toward an exploit within hours of release rather than weeks. And because so much of a mobile app is third-party SDK code, one flaw or malicious intent in a widely used SDK can spread across hundreds of apps and millions of installs at once.
That’s the gap we’re focused on closing with continuous mobile application security testing of the actual binary and its runtime behavior, so security teams know what’s exploitable before an attacker with an AI model finds it first.
VMblog: Are you unveiling any major product announcements, partnerships, or research findings at Black Hat 2026? Can you tease it or give us a preview?
Snyder: A few weeks ago, we published our 2026 Mobile App Risk Management Survey. One finding stood out: 95% of organizations already have AI running inside their mobile apps, but 37% say they can’t fully see what that AI is doing. At Black Hat, we’re introducing two things aimed at that gap.
One is a set of AI-native capabilities in NowSecure Platform meant to help security teams work faster and more effectively: an AI Chat interface, an MCP server, and an extended API for agentic workflows. These give teams the connectivity and speed they need without giving up the governance and visibility that regulated industries require.
The other is a set of new AI findings built to catch AI-related vulnerabilities, data leaks and data flows with remediation assistance. In our own testing of 50,000 apps, 53% already contained AI components, most of which a traditional app review never catches. These findings give security teams visibility into AI-driven risks most testing tools weren’t built to see, plus a path to actually fixing what they find.
That visibility is only going to matter more. As AI agents start taking actions on a user’s behalf, like booking travel or moving money, without a person approving each step, organizations need to know what their apps are exposing to those agents and how that data gets handled.
VMblog: What should be sitting at the very top of every security leader’s priority list in the second half of 2026?
Snyder: Get visibility into your mobile app attack surface before someone else finds it for you.
Mobile has been treated like just another endpoint to manage for too long. It isn’t one. A single app today is a full software supply chain: open source libraries, third-party SDKs, AI components, APIs, trackers, cloud connections, all touching real customer and enterprise data. Most security teams can’t tell you what any of it is doing. Typical mobile app analysis is from legacy web/cloud testing tools that are incomplete and provide a false sense of security.
The solution starts with knowing which apps handle sensitive data, and which ones are quietly sending information to third parties or external LLMs. From there, security teams need to test apps the way they’d test a cloud workload: continuously, not just before launch, checking for vulnerabilities, weak encryption, insecure APIs and privacy gaps. AI adds another layer to watch, since plenty of apps now have multiple AI features built in, and teams need to know what data those features send out and where it lands. A compromised banking or healthcare app can expose the data an organization has to protect most.
Every release adds new code and dependencies, plus whatever new permissions come with them. An annual test doesn’t reflect that pace, and it definitely doesn’t reflect a world where an AI model can find and exploit a vulnerability within hours of a release. Security teams need to be validating continuously, as part of the normal release cycle.
VMblog: Does your team have any speaking sessions, sponsored research presentations, or Briefings appearances at Black Hat 2026 that attendees should put on their schedule?
Snyder: NowSecure will be at Booth 5545 at Black Hat in Las Vegas from Aug. 4–6. Stop by if you want to see AI Chat, the new MCP server, and what we’re seeing as we look for AI-specific vulnerabilities in mobile apps.
Learn More: https://www.nowsecure.com/blackhat2026/
VMblog: A lot of AI governance and code review efforts focus on generated code and cloud infrastructure. What’s the mobile-specific blind spot most security teams are missing?
Snyder: Code review tells you what developers wrote. It doesn’t tell you how an app behaves once it’s compiled, installed and running on a real device, and that’s where many mobile AI risks show up. Embedded models, AI SDKs and agentic components can make network calls, collect data or introduce behavior that isn’t obvious from the source alone, especially when those capabilities come from third-party software.
That’s why mobile security needs more than code review. You have to validate the application that’s actually running. What data leaves the device? Which AI services does it communicate with? Do third-party components behave the way you expect? Static analysis remains an important part of the process, but it can’t answer those runtime questions.
VMblog: NowSecure has more than 15 years of experience in mobile app security. How does that background position the company for AI-powered mobile applications?
Snyder: We’ve been focused exclusively on mobile application security for more than 15 years, long before most of the industry treated mobile as its own security discipline. We’ve supported research tools like Frida and Radare2 for more than a decade, helped establish the OWASP MASVS through our role as the first OWASP MAS Advocate, and our platform has performed more than 5 million automated mobile app assessments, identifying more than 8 million vulnerabilities.
That history gives us a unique understanding of how mobile apps behave after they’re built. As AI becomes part of mobile apps through generated code, embedded SDKs and third-party models, organizations need to know what’s actually in the app, how data moves and whether third-party components behave as expected. Our binary and runtime analysis provides that evidence, helping customers identify AI components, validate data flows and support remediation, compliance and governance. That’s a very different problem than securing cloud infrastructure, and it’s one we’ve been solving on mobile for years.
##
