Consumer Mobile Security in 2023 – Tom Tovar, AppDome

This is Textron TV. Hi everybody, Mike Rothman here from Tech strong research here with another tech strong TV interview. This time we have our pal Tom Tovar who is CEO of appdome.

We're gonna chat a little bit about mobile security and you know, it's like listen everybody has these things. Oh, you can't see it on my background, but maybe um, everybody's got our mobile device. We've got hundreds of apps that go on there, you know, they did some interesting research in terms of you know, kind of what folks expectations are relative to mobile security.

It got a pretty interesting kind of option to help you build mobile security into your mobile app. So so again be a great conversation there. Welcome to the show Welcome to Tech strong TV Tom.

Why don't you introduce yourself a little bit about abdom so we know what we're talking about. Yeah. Thanks Mike and thanks for having us.

Thanks for having us on the program and hello to everyone out there. Appreciate everybody who's on the journey to protect mobile consumers and mobile apps better and look forward to sharing what we've learned and and trying to make the mobile Community safer and more secure for everyone. So, Yeah a little bit about apt Dome.

So we're a we're a defense automation platform for mobile app security. So our product sits inside the Ci City workflow and helps mobile developers deliver on the Cyber objective without any code without any SDK quickly and easily. So yeah, we we sit in the center of the mobile economy.

And we protect a lot of apps out there probably a lot of apps Mike you and other your viewers have on their phones today and it's a pretty scary world out there. And I think I think we have a lot that we can share it is before we dive into that. Just I love the idea.

It's a scary world right because I've been doing security for 30 something years and everybody goes. Oh, is it that bad and I always say if I told you you wouldn't get out of bed in the morning. I'm not gonna actually tell you, you know, what actually happens out there.

Yeah just for your own protection for that. Yeah. I totally get it.

So let's dive into the study. Right? So, you know kind of you ask 25 thousand, you know consumers what their expectations were.

What were some of the Level things that surprised you time. Yeah. So so the first thing that the first thing to note is that the the mobile consumer is a very cyber aware and very tech savvy tech savvy consumer globally.

I think today consumers prefer mobile apps over the web experience probably by a factor of two to three to one so and I think we live that every day. I mean if we're ordering food or buying products or you know, watching shows or sharing with our friends, we're all or banking or trading or whatever. We're doing all that on mobile apps and I think that trend is is definitely gonna continue and I think the world the cyber community is done a great job of helping the consumer be cyber aware.

So they're very key on on top topics including Security fraud malware protection and things of that nature. So they're very astute in that and that shape their expectations about what they expect when they use a mobile. And or a mobile app to to live and work in their daily lives, so a couple of things that might interest your viewers is you know, there's always been this debate Mike around, you know, if you're in cyber and you're working with Dev or you're working with the product team is what is the consumer want more do they want better features or do they want better security?

And and in that debate the the features have always won the features of always one. If you don't have a great product, then there's not much to secure. So hey security always kind of took a back seat, but interestingly in the survey that we did.

It actually came out the consumer basically said I treat security and features equal and in some cases particularly for those mobile apps that I use on a regular basis or those mobile applications that have a high transactional value. So think Financial Services think retail things that I we're on purchasing things. I actually value security higher than I value additional features.

So that was a mind-blower to us. Yeah, that said was one of those things. I'm tell you Tom.

I've been doing this a long time that I'm not sure that won't pass at the sniff test. I'm not challenging your data, right it just it sounds you know counterintuitive. Oh, it's great.

You look it. It's definitely an eye-opener. I agree with you, you know, one of the things that I've said to see so is around the world is think about this.

Is that what it's saying? Is that for the first time At a minimum the consumer values what you're doing and and as part of as a core part of the value proposition of a brand, you know, best case scenario. If our data if our data is like 100% accurate and there's no like wiggle room in it.

Then it says they're on your side. And and so if nothing else, I think it's a it's a very very strong, you know kind of placeholder in the dialogue between cyber and product around. Hey, should we release additional Protections in the app?

Should we be putting security foot and Center in our in our product and the answer the answer from consumers seem to be yes. Well, I mean, you know you look at how Apple positions the iPhone right and and that's I mean security and privacy. I mean that that is a core Stone of you know, kind of apples, you know, kind of brand equity in their brand position.

So, you know clearly there's something to folks being concerned about it more than a fancy feature. I don't know right so I think that one The security person who's been fighting this battle for a long time. I'm ecstatic right?

I mean if folks are starting to get it that they're gonna start picking and selecting, you know, some of their applications and and what it is, they consume based upon their perception of security. That's fantastic right also means we're gonna see a lot of you know, I guess security washing right, you know for lack of a better term where folks will just you know, kind of play around and say, oh we do security and you know pay lip service to it, which I think a lot of folks already do what I'm ecstatic to hear about that. So what other cool data points did you have and why I think you I think you touched on another very important topic there, which is this kind of you know, kind of how do I say it the name only time of Defense right consumers consumers go a bit deeper.

So the kinds of things the top the top there agenda when they're thinking about okay what I'm using a mobile, what are you expect? The developer. So we asked him questions like, you know do what your data protected your login protective your credentials, etc.

Etc. So, they're clearly well beyond data and login but data and log in are like like table States like you can't you can't have a mobile application or claim to have mobile brand without data protection and and login production influential protection. That's kind of that's kind of famous things but a huge percentage and we're talking, you know, like huge you jump 25% year over year is is around fraud.

And now what like they consumers have become very very aware that their devices even application are not safe environments to be transacting business and they expect the developer the brand who's delivering that application to include more than the basic level of protection. So so that was big so we saw other Threats like kind of I call the classics like man in the middle and and and big database breaches in the cloud and stuff like that really kind of declining the security expectation of consumers become very personal and very very eccentric to their own experience. Right?

What's on my device what's on my app hacking tends to be really high and fake apps tend to be really high. So Trojan applications are very high and the users practices the interestingly we threw in a wild card because we didn't know what it was doing a wild card and the question and wild card was What about a developer that doesn't care about my security like we are afraid of that and they actually ranked the developer who doesn't care about my security as high as they ranked fake apps and malware like like they put that on par. So again, it was this other kind of inside of the coin which which you and I were talking about just a second ago.

Do they really care? Well, it turns out when they're evaluating the developer the developer doesn't care. Is this bad as a bad person attacking them.

So that was very interesting. Okay, that was creative. I don't know if you have thoughts on that, you know, I do only because it it's kind of one of those things where if if folks are starting to make that jump between what's on their devices to the actual company and/or developer that provides it.

I mean we've been trying to get you know, some type of liability or culpability for issues in applications for a long time, right? There's no Ability, it's really difficult to see a legislative environment where that you know, kind of thing could happen. So you have a bunch of folks that are doing, you know, shoddy work without any kind of you know consequences to what they do and what they put at risk, you know for the consumers and for the customers even for big businesses out there.

So if and without that kind of legislative, you know cudgel if we're able to make that connection to if the developer and the company representing that developer is in, you know, kind of saying the right stuff isn't doing the right stuff to protect data to protect consumers. We're not going to do business with them. I mean Darwin Works in magical ways, right, you know, they're gonna figure it out that if you know kind of Mr.

Market or Miss Market says you can't Prosper if you don't take this stuff, seriously, I think that benefits everybody but again, I'm an old cynical security guys. So I love the data. I just, you know, kind of need to see it before, you know, let's Talk about that.

Let's talk about that notion of consequence and prosperity kind of side by side. So we also ask consumers about churn and about advocacy. And so that's that was a this one was not this one if anything's gonna shock you and make you smile as a cyber professional what I'm about to tell you is gonna really really kind of help you now.

The first thing I'm going to start off with is the side that's not going to shock you. Okay, the notion that went bad things happen more bad things happen. So, you know, we ask consumer.

So what if you what if you found out that that your mobile application didn't protect you right How likely are you to abandon the app abandon the brand etc, etc. Okay, you didn't experience an attack. Nothing bad has happened to you just found out the word of mouth or you know, social media post or whatever.

It's something whatever happened. 9% consumers that I get rid of the app. I'd go find an alternative about whatever right so not shocking right bad things.

In bad things happen, they're bet more bad things are going to happen. Then we asked them. Okay, so what if you actually experience the breach or an attack, right and you were not protected that are you are you likely to abandon the app tell others not the band of the app and you're going to engage in cancel culture that kind of thing and the answer was the answer was absolutely but the margin the margin was only slightly higher.

9% Not a lot of difference between a perceived attack and an actual attack affecting them in both cases a big big percentage gonna leave but here's the show stop. Here's the one that's that's more interesting. What if we said the developer stopped that attack?

Okay, and you are aware that they stopped that attack in other words in the user experience. We we demonstrate the developer demonstrated. They stopped in attack or your benefit.

Okay How likely are you to Advocate that app promote that app Etc? Okay nighty three point eight percent said we will we will advocate for that brand we will give that brand five star reviews and Google we will promote that brand on social media and a very large percentage. 4 percent said they would actually become full on brand advocates for that for that brand and social media.

So not only not only is it is it is it good business to add cyber, but it's actually good business to add cyber to the value problem. Okay. My first thought was all right.

I'm done with this text wrong thing. I'm just gonna become a marketing agency to From you know kind of protective, you know activities on that to companies because that seems to be a gold mine. If it's true.

That's great. You know the date is great time, but I do want to make sure that we take a little bit of time and talk about some of the constraints to actually building. Security into your mobile apartment.

I know that's something that that you guys that adapt to home, you know really focus on because that's always been the excuse right? It's hard. I don't really understand it.

I don't you know, I can't make it in. I've got a prioritize features. So explain a little bit about what you guys do to really facilitate that with a lot of the app developers out.

Yeah. Yeah. So the first thing that there's two components to that there's there's the threat landscape and then there's the operating environment that you have to kind of deal with so although threat landscape side.

You have to you have to consider that the meantime to first attack for a mobile application that's released on to a device is around 14 seconds, which means that the primary delivery vehicle of an attack this malware sitting on a device already, right? And as you're as your user base grows the meantime to first attack actually drop so it can drop as low as you know, 137 milliseconds like you can drop like very very fast and that's just because you're spreading the app out over a large Universe where there's more malware. You know installed so the primary delivery vehicle and mobile is going to be an automated programmatic attack.

That doesn't go away right? It's not hackers in a barrage with a hoodie and eating pizza. It's actually automated programmatic attack.

So you got it. You got to understand that and there's also an economy around building these exploits malware that's out there. So things are constantly changing.

So that's the threat landscape. But also inside your operating environment, you've got hundreds of developers, maybe thousands of developers who are building these incredible beautiful Rich mobile app experiences and they're changing that application constantly, right? So they're releasing the application 48 times or 96 times a year and you've got the operating systems that are changing likewise, you know every month new releases, whatever and every Android device changing its operating system as well.

So the reality of trying to get this thing out is one of one of Rapid iteration rapid change, right and and Broad large-scale deployments across millions and millions of devices all with different, you know, operating profiles and so forth. So if you're a cyber professional you've got to accommodate that and and without so what app Don't did is we created a platform we call it defense automation, but basically takes all those changes into account. When the developers building the app, so as a developer is creating the application in their devops pipeline.

However, they change it whatever language they use. However, they cheat whatever they add to it. You have an automated system that accounts for that and adds the security that the Cyber team needs and that you need to pass regs or compliance or whatever ads that in the bill process.

So the dev team can stay on track meet the consumer demand and and accommodate all of that change. So ultimately that's the main thing you've got to deal with you got to deal with the pace the diversity and the change that happens inside of a mobile mobile release life like without adding a lot of friction to the developers. Exactly and you can't change the way the dev the dev Team Works.

I mean again, you know the data is the data is amazing, but the practicality of delivering on a mobile brand is the same Dev team has to have the freedom to deliver the mobile application and the Cyber, you know, we here I'll give you something I've said to see those around the world. I've been in cyber like you for 25 years. We have spent our careers trying to teach Cy Best practices to the dev team.

Okay, it's our time to bring Deb best practices into cyber so that we can deliver in the manner that Dad deliver Cyber Solutions in the manner. They're delivering the app. So it really is time for us to flip the script on ourselves and use some of the automation system level control velocity Etc on integration points and not expecting folks to do unnatural acts in order.

Yeah. Okay, exactly. So that's what we provide and and we give people inside into the real attacks that are going on in the wild give them an XTR component so they can see it solve it prove it, you know in the wild and you know, we're just having a blast I tell you my My joy, and I think you met you hit it right at the top of this.

This segment is looking down on my phone and seeing the brands that I love and knowing that the company and the product that that our team has created is protecting those Brands and protecting me when I use them. That's mine. That's my joy, then we then then hopefully we're we're more joyous in the future.

So great Tom Tovar. Thanks for being on Tech strong TV, really appreciate how to folks get in touch with you guys, you know, if they want the survey report or just to learn a little bit more about integrating. Yeah, just go to app Don't calm there's plenty of links.

You can follow and you can explore what we do all the different protections that we offer and you can pick up a copy of the of the report. It looks like this. We also have country specific reports like for the UK for for Columbia for us or you know, all of the different countries that we surveyed so you can compare the country specific data to the global data and see what's for your brand good.

That's great. com tops over again. Thanks for being on the show.

And let's send it back to the studio for our next segment.