masCON Berlin 2026
Four weeks ago I began a new job, moving from an internal cyber ops function to the Offensive Security team working primarily in pentesting and purple teaming. The move has been very exciting and something that I had been working towards for a while.
On the first week, my new manager invited me to the next.app devcon conference in Berlin which was a thrilling opportunity so early on and I couldn’t say no. The conference hosts nine different tracks all focused on different subjects mostly surrounding development, but we went to attend the masCON track (mobile application security). Now I am not a mobile tester but this makes more sense when I explain that I travelled over with my new boss and a senior who are both mobile application testers by trade. My experience in iOS and Android testing is cursory (mobsf etc) and having now sat through three days of talks I have a better idea of how much time investment is going to be needed to hone this discipline.
Which would be a lot.
Interestingly, I have never really come across formal mobile security testing certifications in the industry, maybe it’s something I just haven’t been looking for but outside of internal training materials curated by my new colleagues I think the only thing I have seen is maybe a SANS course about it? It doesn’t seem to be something that gets focused on in my red team circles very much.
More to this point, my colleague presented a talk this year on a suite of applications he has developed as additions to the OWASP mobile crackme’s. He explained that when he originally started learning mobile security the three that OWASP provided were his first foray into this lane of testing. With the space now having moved significantly on from this era he was shocked to see they had not been added too. So this was his contribution back to the community, to help others learn more about the basic concepts. Something I appreciate greatly.
The other talks were ranged in complexity, but with no background in reverse engineering, building trampolines and writing swift, I can’t claim I understood it all. It certainly gave me an appreciation for the work that goes into attacking mobile apps. I noticed a clear trend throughout the talks about how difficult of a time the testers have just preparing an environment they can consistently use to perform their penetration tests. With Apple devices not having had a jailbreak on hardware since palerain on iOS 16.3, it’s getting to the point where testers are going to/having to ask developers to downgrade their applications to unsupported OS versions just to have the assurance of testing. This is less of a problem with android but an interesting situation for the industry to be in.
Putting security aside for a moment I noticed - as I had done with all the other conferences I have attended this year - that you can’t look down the agenda without every other talk being directly or adjacently revolved around AI. This was a developer conference so it’s understandable; dev work has been most immediately impacted. Though, I think there comes a point where, as an audience member, you develop a fatigue relating to the amount of times you hear about someone’s vibe coded app or ‘how you can develop faster with agents’. Much like the content produced with AI, the talks all eventually ring the same tune - the repetition of Claude Design slides and ‘not this, but this’.
I suppose anyone can build software now, whereas before it was unique ideas combined with skill and value. Today’s tools being presented cross a line where the unique ideas are not particularly unique, there’s certainly no skill and I have to guess what the value is. AI doesn’t generate anything new, it just blends what it already knows. Much like how the non-technical director of small business A asks Claude to build him a site, he’s ecstatic at how professional it looks, until he sees his competitors website looks the exact same. I have noticed some conference talks in 2026 giving off this vibe.
It was a great opportunity to meet people, as most conferences are. We spent time chatting with the OSWAP maintainers and got to know Ole from the FRIDA project. International events like these bring some of the best minds together and as we have moved to a such an isolated way of working these past few years I would encourage anyone who is offered a ticket to go. Also there is the benefit of travelling to a city, seeing the sights and eating the food!
Written without AI.