PlatformFederalResourcesCompanyStart Free →
Standards Alignment

Built Around
Industry Standards

Every Strata finding maps to the frameworks your clients, auditors, and compliance teams already use. Six standards. Automatic. No manual tagging.

Start Free Scan →Full OWASP Details
Coverage Overview

Six Frameworks. One Scan.

Click any framework to jump to its full mapping details below.

OWASP M10
OWASP Mobile Top 10 (2024)
10 / 10 categories
ASVS
OWASP ASVS v4.0
8 verification levels
CWE
Common Weakness Enumeration
40+ CWE IDs mapped
CVSS v3.1
Common Vulnerability Scoring System
Base score on applicable findings
ATT&CK
MITRE ATT&CK Mobile
14 technique IDs
SSDF
NIST SP 800-218
4 practice areas aligned

All mappings are automatic — no configuration required.

OWASP Mobile Top 10 (2024)

The Mobile-Specific Baseline

10/10

Every Strata scan maps applicable findings to all ten OWASP Mobile Top 10 (M1–M10) categories across Android, iOS, and repository scans — the framework the other five standards on this page build on for mobile-specific context.

OWASP ASVS v4.0

Application Security Verification Standard

ASVS defines Level 1, 2, and 3 security verification requirements. Strata findings map to the specific ASVS chapters where non-compliance is detected.

V2
L1–L3
Authentication
Broken auth flows, missing MFA, insecure session handling, OAuth PKCE absence.
M3
V3
L1–L2
Session Management
Session token storage, expiry, and revocation for mobile contexts.
M3
V5
L1–L3
Validation & Encoding
SQL injection, path traversal, WebView injection, and deep-link sanitisation.
M4
V6
L1–L3
Stored Cryptography
Algorithm strength (no DES/MD5/SHA1 for security use), key management, IV randomness.
M10M9
V8
L1–L3
Data Protection
PII in logs, plaintext credential storage, clipboard access, analytics data scope.
M6M9
V9
L1–L3
Communications
TLS 1.2+, cleartext traffic flags, ATS exceptions, certificate validation bypasses.
M5
V10
L2–L3
Malicious Code
Suspicious SDK behaviour, obfuscated payloads, VirusTotal reputation checks.
M2
V14
L1–L3
Configuration
Debug flags, exported components without permissions, backup exposure.
M7M8

Level coverage: Strata findings are relevant across all three ASVS levels. L1 findings represent the most critical baseline — every application should meet them. L2 findings apply to applications that handle sensitive data (banking, healthcare, enterprise). L3 findings apply to high-assurance applications (government, critical infrastructure, financial).

Common Weakness Enumeration

40+ CWE IDs Mapped Automatically

Every finding category in Strata maps to one or more CWE identifiers — providing a standardised vocabulary for reporting, ticketing, and compliance documentation.

CWE IDWeaknessOWASPSeverity
CWE-798Use of Hard-coded CredentialsM1Critical
CWE-321Use of Hard-coded Cryptographic KeyM1, M10Critical
CWE-287Improper AuthenticationM3Critical
CWE-295Improper Certificate ValidationM3, M5Critical
CWE-922Insecure Storage of Sensitive InformationM9Critical
CWE-312Cleartext Storage of Sensitive InformationM9High
CWE-327Use of Broken or Risky Cryptographic AlgorithmM10High
CWE-330Use of Insufficiently Random ValuesM10High
CWE-319Cleartext Transmission of Sensitive InformationM5High
CWE-749Exposed Dangerous Method or FunctionM8High
CWE-926Improper Export of Android Application ComponentsM8High
CWE-1104Use of Unmaintained Third-Party ComponentsM2High
CWE-20Improper Input ValidationM4High
CWE-89SQL InjectionM4High
CWE-359Exposure of Private Personal InformationM6Medium
CWE-532Insertion of Sensitive Information into Log FileM6Medium
CWE-693Protection Mechanism FailureM7Medium
CWE-656Reliance on Security Through ObscurityM7Medium

This table shows the primary CWE mappings. Strata maps to 40+ CWE IDs in total — additional mappings appear in scan reports based on detected finding types.

CVSS v3.1

CVSS Scoring, Calculated Automatically

Strata assigns a CVSS v3.1 Base Score to applicable findings, calculated from the standard metrics without manual input.

Exploitability Metrics
Attack Vector (AV)
Network, Adjacent, Local, Physical
Most mobile findings score AV:N (network-reachable) or AV:L (local, device-only).
Attack Complexity (AC)
Low, High
AC:L for straightforward exploitation; AC:H when specific preconditions apply.
Privileges Required (PR)
None, Low, High
Exported components typically score PR:N; root-only issues score PR:H.
User Interaction (UI)
None, Required
Background processes score UI:N; social-engineering-dependent issues score UI:R.
Impact Metrics
Confidentiality (C)
None, Low, High
Credential leakage and PII exposure typically score C:H.
Integrity (I)
None, Low, High
Permission abuse and component hijacking score I:H.
Availability (A)
None, Low, High
Most mobile findings do not directly impact availability; A:N is common.

Scope note: CVSS Base Scores represent the intrinsic severity of a vulnerability independent of environment. Temporal and Environmental scores can be calculated by your team using the Strata Base Score as a starting point. All CVSS scores in Strata conform to the CVSS v3.1 specification published by FIRST.

MITRE ATT&CK Mobile

14 Technique IDs Mapped to Findings

Strata maps applicable findings to MITRE ATT&CK Mobile techniques — providing adversarial context beyond vulnerability classification.

Tactic: Initial Access
T1475Deliver Malicious App via Authorized App StoreM2
T1476Deliver Malicious App via Other MeansM2
Tactic: Credential Access
T1417Input CaptureM4
T1412Capture SMS MessagesM6
T1414Capture Clipboard DataM6
Tactic: Collection
T1432Access Contact ListM6
T1433Access Call LogM6
T1513Screen CaptureM6
Tactic: Defense Evasion
T1406Obfuscated Files or InformationM7
T1418Software DiscoveryM7
Tactic: Discovery
T1422System Network Configuration DiscoveryM8
Tactic: Exfiltration
T1437Standard Application Layer ProtocolM5
Tactic: Persistence
T1402Broadcast ReceiversM8
Tactic: Privilege Escalation
T1404Exploit OS VulnerabilityM1, M3
Tactic: Command & Control
T1437Application Layer ProtocolM5

ATT&CK technique mapping contextualises findings for red team and threat modelling use cases. Strata maps to the MITRE ATT&CK Mobile (v14) matrix. Not all findings produce an ATT&CK mapping — only those with a clear adversarial technique correlation.

NIST SP 800-218 — SSDF

Secure Development Practice Alignment

The NIST Secure Software Development Framework (SSDF) defines practices for reducing software vulnerabilities throughout the SDLC. Strata output can support evidence collection toward SSDF alignment.

POPrepare the Organization
PO.1
Define security requirements
Scan results surface unmet requirements — exported components, missing TLS, weak crypto — directly traceable to secure coding standards.
PO.3
Implement supporting toolchains
CI/CD integration enables automated assessment on every push. GitHub Actions and GitLab CI YAML templates provided.
PO.5
Implement and maintain secure environments
Dependency CVE scanning and third-party SDK analysis reduce supply chain risk in development environments.
PWProtect the Software
PW.1
Design software to meet security requirements
ASVS-mapped findings show which design requirements are unmet — missing certificate pinning, weak auth patterns, etc.
PW.5
Create source code by adhering to secure coding practices
SAST findings identify insecure patterns at the code level — SQL injection, hardcoded secrets, unsafe WebView usage.
PW.7
Review and/or analyze code to identify vulnerabilities
Automated static analysis serves as a scalable code review layer. Every scan generates findings with file paths and line numbers.
PW.8
Test executable code to identify vulnerabilities
APK and IPA scanning decompiles and tests the compiled binary — not just source — catching issues that survive build-time.
PSProduce Well-Secured Software
PS.1
Protect all code from unauthorized access and tampering
Binary protection checks confirm obfuscation and anti-tampering controls are in place before release.
PS.2
Provide a mechanism for verifying software integrity
Certificate and signing analysis validates that release builds are signed with expected keys, not debug certificates.
RVRespond to Vulnerabilities
RV.1
Identify and confirm vulnerabilities
Automated detection with evidence — file path, line number, code snippet — per finding. Structured findings reduce initial triage effort.
RV.2
Assess, prioritize, and remediate vulnerabilities
CVSS scores, severity rankings, and OWASP category enable structured prioritisation. Lifecycle tracking shows status across the portfolio.
RV.3
Analyze vulnerabilities to identify root causes
Each finding includes a description of the vulnerable pattern, its origin, and a specific remediation step with code context.

Mappings are provided to support analysis and reporting. They do not by themselves establish compliance.

Get Started

Run Your First Scan.
First Results in 30 Seconds.

No credit card. No setup. Upload an APK, IPA, or repository URL.

Start Free →Full OWASP Coverage