Approov

Approov provides a mobile app and API security platform that operates on a Zero Trust model, ensuring that only genuine, untampered mobile applications can access backend services. The company’s technology is designed to protect against automated attacks, reverse engineering, and API abuse by continuously verifying the integrity of the app and the device at runtime. Approov's core services include runtime attestation, just-in-time delivery of API secrets, Runtime Application Self-Protection (RASP), and end-to-end visibility from the app to the API.

Originally founded as CriticalBlue in Edinburgh, Scotland, in 2001 by David Stewart and Ben Hounsell, the company's origins are in the deep inspection, analysis, and optimization of software at the hardware level. After a decade of services work, including significant projects on Android code optimization, the firm identified a market opportunity for a mobile app attestation solution. This led to the launch of the Approov Mobile App Protection platform in late 2016. In December 2022, David Stewart retired as CEO and was succeeded by Ted Miracco, a technology executive with extensive experience in cybersecurity and electronic design automation. Stewart remains an advisor to the company.

Approov operates as a global SaaS business, with its attestation services hosted in the cloud, primarily on AWS. Its business model targets enterprises where mobile app integrity is critical, serving clients in sectors such as eCommerce, finance, healthcare, gaming, connected vehicles, and government. Customers include prominent names like The BMW Group and Sixt. In August 2025, the company secured a £5 million (US$6.7 million) Series A funding round led by the Investment Fund for Scotland (managed by Maven Capital Partners), with participation from Souter Investments, Lanza techVentures, and Scottish Enterprise. This capital is intended to expand its R&D team in Edinburgh and accelerate global growth as it addresses threats amplified by AI and regulatory changes like the EU's Digital Markets Act.

The platform embeds a lightweight SDK into a client's mobile app, which works with a cloud-based service to attest the app's integrity before any API request is made. This process prevents malicious traffic from scripts, bots, repackaged apps, or emulators from reaching the API endpoints. It provides a dynamic certificate pinning feature to simplify an otherwise complex security practice for development teams. Approov's solution is designed for cross-platform support, including various Android versions and non-store distribution channels, offering a more robust alternative to traditional code obfuscation techniques.

Keywords: mobile app security, API security, runtime application self-protection, RASP, API protection, app attestation, Zero Trust, anti-bot, mobile security, API abuse, threat protection, credential stuffing, runtime security, cloud-native security, David Stewart, Ted Miracco, CriticalBlue, API shielding, mobile-to-cloud security, secure system performance, binary analysis, dynamic attestation, API secrets management