Guardsquare makes your app harder to take apart

The awkward thing about a mobile app is that you have to give it away to use it. A bank can guard its servers, restrict its offices and vet its staff. Its app still lands on a stranger’s phone, where someone sufficiently curious can try to inspect it, alter it or make it behave badly. Guardsquare sells software for that moment when the developer’s control ends.

The Leuven-based company occupies a specific corner of cybersecurity: protecting the application itself. Its tools help developers find weaknesses, make compiled code harder to understand, detect interference while an app runs and assess whether an app should be trusted to contact a backend service. That puts it close to the engineers shipping the product, as well as the security people responsible when something goes wrong.

There is a pleasing reversal in its history. The original tool made software smaller. The business that followed makes taking software apart more laborious. And in February 2026, Guardsquare became a buyer of another company’s mobile protection assets, acquiring Verimatrix’s Extended Threat Defense technology, patents and a team of specialists.

A company twelve years behind its first product

Eric Lafortune released ProGuard in 2002. The open-source utility removes unused Java code, optimizes what remains and shortens names. Those jobs have an immediate appeal to developers: smaller applications and less unnecessary baggage. The project remains public on GitHub, alongside ProGuardCORE, a library for reading, analyzing and transforming Java bytecode.

ProGuard’s obfuscation also makes code less legible. But basic name changes and a purpose-built security product are different purchases. Lafortune introduced DexGuard for Android protection in 2012. Two years later, he and Heidi Rakels founded Guardsquare to give the existing software and new products an organizational home. iXGuard brought iOS protection into the lineup in 2016.

The sequence matters. Guardsquare did not begin with an enterprise sales pitch and then seek a developer audience. Useful software came first. The commercial opportunity grew around a harder problem: applications containing valuable logic, intellectual property or access to services were being distributed into environments their makers could not supervise.

The attacker gets a copy, too

DexGuard and iXGuard combine code hardening with runtime application self-protection, usually shortened to RASP. Hardening changes the code an attacker tries to study. Runtime checks look for interference or suspicious conditions as it executes. Guardsquare emphasizes a compiler-based approach and polymorphic protection: variations across builds that make an attacker’s previous analysis less reusable.

For an Android team, DexGuard is the relevant protection product. For an iOS team, it is iXGuard. Supported cross-platform technologies broaden that reach, but the engineering question remains concrete: does the protection work with this application, this toolchain and the performance expectations of its users? A mobile game and a payment application will not necessarily make identical tradeoffs.

AppSweep handles a different job. It analyzes Android and iOS application files, including supported SDK formats, for security issues. Its static and dynamic techniques examine application behavior and code; it also looks at third-party dependencies. Findings can be viewed by severity or security category. Integration through the command-line interface lets teams repeat scans in their build pipeline instead of remembering to arrange a separate inspection.

ThreatCast then supplies visibility after release. Signals from protected applications help teams investigate suspicious activity and adjust their response. The distinction is useful: a scanner identifies a weakness, hardening complicates exploitation, and monitoring reports what is happening outside the development environment. Buying one does not magically perform the other two jobs.

Hundreds of bots changed the conversation

One of Guardsquare’s anonymous customer cases describes a social network that initially relied on in-house and open-source security. Product functionality took priority. Then attackers used inadequately protected apps to orchestrate bot activity, manipulating content discovery and engagement. The CTO described hundreds of attacks. Security suddenly had a much more persuasive internal sponsor: the behavior of the product itself.

The company adopted DexGuard, iXGuard and ThreatCast, plus Gold-tier support for onboarding. Its defenses included detection of hooking, rooted or jailbroken environments and emulators, combined with obfuscation. According to the customer account, the team stopped seeing successful bot attacks after protection was implemented and used monitoring data to identify suspicious accounts and refine later releases.

“We wanted to protect our apps just like banks protect theirs.”Anonymous social platform CTO, in a Guardsquare customer account

That is a reported customer outcome, not a promise that every bot disappears. The practical lesson is narrower and more useful: identify how an app is being manipulated, protect the relevant surfaces, then give someone the evidence and authority to respond.

The same buying logic applies beyond social media. Guardsquare markets to financial services, healthcare, gaming, retail and technology organizations. Its company LinkedIn profile reports more than 1,000 customers. The problems differ: a bank worries about tampering and credential theft; a game developer cares about cheating and revenue; an SDK supplier must ship code that will live inside somebody else’s application.

A price tag with a date attached

Guardsquare’s current commercial menu has three named plans. Core combines protection, AppSweep testing, guided configuration and support. Control adds ThreatCast monitoring and analytics. Command adds AppSweep Enterprise and server-side attestation. Each asks the buyer to request pricing. The packaging reveals the business model: sell organizations a broader set of controls as their needs extend beyond protecting a binary.

There is a dated public price reference. A 2025 AppSweep fact sheet lists starting prices of €3,499 per app for AppSweep and €4,999 per app for AppSweep Enterprise. These are testing-product figures from that document, not quotations for today’s complete security bundles. Treating them as the price of DexGuard, iXGuard and everything else would make for a very misleading budget.

The work also has a cost in engineering attention. Teams must integrate protection, test the resulting builds, investigate findings and decide what should happen when a check fires. Guardsquare’s configurable checks let developers balance security and performance. The buyer still owns the release and the experience of legitimate users.

The server gets a vote

App attestation extends the argument from the application to the service behind it. Guardsquare’s offering evaluates app and device integrity, allowing a backend to use an attestation result before granting access to an API. Security teams can change server-side policies without republishing the app. That matters when waiting for another release would leave a response dependent on users installing an update.

The company positions this as an addition to client-side hardening and existing operating-system protections. The product interface makes the operational shift visible: protection becomes something a team can inspect and adjust, rather than only something compiled into yesterday’s release.

There are boundaries. Guardsquare’s FAQ says ThreatCast requires DexGuard or iXGuard and is not suitable for a mobile SDK consumed by applications the SDK maker does not control. Automated testing also leaves room for penetration testing. An organization still needs to secure its backend, review business logic and investigate the evidence it collects. App protection is one part of that work.

Buying expertise, then making it usable

Battery Ventures invested $29 million in January 2019. In a later reflection, CEO Roel Caers connected that funding with team expansion and the Boston operation. Verdane announced its investment in July 2025, describing a growth strategy involving product development, international reach and acquisitions. The subsequent XTD asset purchase gives that last ambition a concrete example.

Guardsquare had bought technology before. In 2020 it acquired Breakpoint’s App-Ray testing engine, the same year it added ThreatCast. AppSweep launched in 2021, followed by an enterprise edition in 2024. Across those moves, the business has accumulated capabilities around its original protection products, moving into earlier testing and later observation.

Making that collection usable is a separate engineering problem. The technical partner directory includes a Bitrise integration that sends built apps to AppSweep and Sentry support for ProGuard and DexGuard mapping files, which help turn obscured crash traces back into readable information. These are modest-looking details with practical consequences: security has to fit the machinery developers already use.

The careers page offers a similarly concrete view of its expertise. Java and C++/LLVM roles feature in its engineering recruitment. Guardsquare describes an international team working on mobile technology and security. Compiler work is easy to overlook beside a threat dashboard, but it is central to the company’s proposition: change the application while preserving the behavior people downloaded it for.

Make the next attack more work

Guardsquare competes with mobile protection vendors including Appdome and Zimperium. Appdome stresses automated, no-code implementation; Zimperium’s zShield also offers obfuscation and anti-tampering protection. Guardsquare’s case rests on its compiler expertise, ProGuard heritage and combination of testing, hardening and runtime visibility. Those are reasons to evaluate it, not evidence that competitors cannot protect an app.

A useful evaluation starts with a real application and a specific concern. Can the team reproduce the weakness, apply a control, verify the protected build and act on the resulting signals? Can it repeat the process next release? Guardsquare’s history points toward that unglamorous discipline. The attacker gets another copy whenever the app ships. The developer’s job is to make that copy less rewarding to investigate.