A significant share of mobile applications are exposing sensitive information through insecure application programming interfaces (APIs), leaving users and businesses vulnerable to attack, according to the 2025 Zimperium Global Mobile Threat Report.
The report found that client-side weaknesses are fueling new avenues for abuse. Attackers can tamper with apps, intercept traffic and exploit compromised devices to bypass defenses. Additional key findings include:
- 1-in-400 Android devices is rooted, and 1-in-2500 iOS devices is jailbroken.
- Three in every 1000 mobile devices are already compromised.
- One in 5 Android devices encounters malware in the wild.
- Nearly 1-in-3 Android finance apps and 1-in-5 iOS travel apps remain open to man-in-the-middle attacks, despite SSL pinning
Mayur Upadhyaya, CEO at APIContext (which “empowers API owners and reliability teams to understand how their applications work”) has this to say about the report: The latest Zimperium report is a wake-up call for enterprises treating mobile app security as a ‘set and forget’ concern. With nearly half of mobile apps still exposing hardcoded secrets or leaking sensitive data through insecure APIs, we’re seeing critical gaps in real-time risk visibility. This isn’t just a mobile issue, it’s a supply chain and automation issue.
Enterprises relying on mobile workflows and BYOD policiess are increasingly vulnerable to data loss and service disruption, especially as AI-driven tools depend on APIs embedded in mobile apps to function. Under regulations like DORA, this becomes a systemic risk: monitoring mobile infrastructure and client-side APIs must be proactive and continuous, not just reactive or post-incident. Without external validation and runtime conformance checks, businesses are flying blind.
