Appdome Empowers Mobile Brands to Build Their Own Mobile API Gateway with AI, Unifying API and Bot Protection in One Solution

Integration of IDAnchor™ into MobileBOT™ Defense provides mobile brands with a powerful new approach to API security and bot defense—without the complexity of point products or SDKs.

LAS VEGAS, Aug. 6, 2025 /PRNewswire/ -- Appdome, the leader in protecting mobile businesses, today announced here at Black Hat 2025 the integration of its IDAnchor™'s Customer Identity Protection suite into MobileBOT™ Defense, Appdome's bot defense offering. This powerful combination enables mobile brands and businesses to build a virtual Mobile API Gateway on top of any standard backend infrastructure, preventing unauthorized API access, stopping brute-force bot attacks, and eliminating point products for API Protection and Bot Defense.  

"There's no need for point products in Bot Defense and API Protection any longer," said Tom Tovar, CEO and co-creator of Appdome. "Within one solution, IDAnchor can tell network security teams if an API request is coming from real users, apps, and devices and MobileBOT Defense can stop brute force bot attacks with ease."

Build Your Own Mobile API Gateway
Powered by AI, Appdome's MobileBOT™ Defense, with IDAnchor inside, enables mobile teams to create a virtual Mobile API Gateway that sits on top of any standard backend infrastructure. Together, they provide an OS-independent chain of trust consisting of:

1. WorkspaceID - root identifier from the DevOps environment,
2. ReleaseID - intermediate identifier for each App Release,
3. InstallID - leaf identifier for each App instance, and
4. DeviceID - leaf identifier for each mobile Device that uses an IDAnchor enabled app.
5. True Device Attributes™ - OS-independent device attributes.
6. Threat Signals – for identity, OS, Application and Device Threats.

During any API connection request, if any part of the chain is missing, altered, or replaced, the mobile brand or business knows the origin of API request is suspicious or malicious. If an attacker attempts to impersonate legitimate mobile users, applications, devices, locations, or uses automated programs to generate requests individually or via brute force methods, the connection can be dropped or routed for mitigation in the application. No external systems or SDKs are required.

"The Appdome platform lets mobile brands create the Mobile API Gateway or Mobile Application Firewall of their choice," said Chris Roeckl, Chief Product Officer at Appdome. "Put simply, MobileBOT™ Defense and IDAnchor™ combined can offer deeper inspection, 400+ detection and defense options, to stop Unauthorized Access, API Attacks, API Abuse or Bot Attacks in one."

Immutable Mobile Identity vs. Cookies and Tokens
Legacy mobile API and bot defense products use time-based cookies and tokens to determine session validity. They can be stored insecurely or transmitted in the clear, making them vulnerable to reuse by the attacker. Cookies and tokens do not provide any data on the mobile device, application, or installation making the API request. In short, cookies and tokens cannot tell if the API request is coming from a good, bad, real, fake, compromised or uncompromised mobile user, app, install, or device.

In contrast, each IDAnchor fingerprint can be cryptographically bound to each user so that it is not reusable and persists across re-installs, OS updates, and factory resets. This fully addresses these top challenges in legacy bot protection strategies:

1. Fake Users & Devices: Fake users and fake, emulated, or spoofed devices cannot present a valid IDAnchor identity, making it easy to block spoofed or impersonated sources.
2. Bot Attack Masking & Evasion Techniques: Any attempted reuse or manipulation of the device, application, or OS attributes will result in an IDAnchor mismatch, revealing the attacker.
3. Stolen Credentials or Identities: Stolen identities using separate devices, synthetic identity or AI generated deepfakes, vishing, or session hijacks.
4. Install and attribution fraud: Fraud attempts conducted by emulator farms, malware-controlled apps, or fake devices.
5. KYC-fraud: Fake signups, fake account creation, and usage performed by bots or automated tools designed to spoof real behavior. 
6. Weaponized Mobile Apps. Malware-controlled or modified apps will change the IDAnchor fingerprint, revealing the weaponized mobile app.
7. Brute force credential stuffing: Attacks that use automated programs or stolen credentials with fake or spoofed mobile applications and devices.
8. Bot Source Triangulation: A bot detected from App A can be blocked or flagged in App B—without needing to sync external intelligence. 
9. Risk Scoring for API Connection Requests: Each match or mismatch of IDAnchor values is represented as a percentage and can be used as a proxy for connection risk or used to influence risk scoring methods for such purpose.

"API attacks and abuse are a superset of bot defense, and you have to defend against both," said Gil Hartman, Field CTO at Appdome. "MobileBOT™ Defense with IDAnchor™ proves you can address both in one solution and retain full flexibility to customize where and how you enforce each defense, per App, per API, or per Device."

Appdome will showcase IDAnchor™ and MobileBOT™ Defense at BlackHat USA in Vegas Aug 6^th and 7^th.  Stop by Booth #4746 in the Black Hat Business Hall to learn more and see it live. For those not attending Black Hat, learn more about Appdome Mobile API and Bot Protection.

About Appdome
Appdome's mission is to protect every mobile business and user in the world from scams, fraud, bots, and attacks. Appdome's patented AI-Native XTM Platform is designed to protect every aspect of mobile business now and in the future. From mobile DevOps to mobile applications, networks, APIs, and Customer Identity, Appdome uses AI to generate Android & iOS defense plugins for 400+ mobile app security, anti-fraud, bot defense, anti-malware, geo compliance, social engineering, deepfake and Customer Identity defenses on demand. Appdome also uses AI inside its ThreatScope™ Mobile XTM, to continuously calculate a Mobile Risk Index™ for businesses and applications as well as rank and preempt attacks in real-time. In Appdome's Threat Resolution Center™, Agentic-AI provides customer support and care teams a quick and easy way to provide end-user threat resolution and remediation. Appdome's Threat-Events™ framework gathers threat and attack metadata, and can be used to inform the application, application SDKs and back-end network components when threats are present or to create customized threat responses inside Android & iOS apps. As a platform, Appdome functions as a continuous compliance center, tracking all builds, changes, teams, users, defense configurations, events, and more for quick and easy audit of the mobile defense lifecycle. Appdome holds several patents including U.S. Patents 9,934,017 B2, 10,310,870 B2, 10,606,582 B2, 11,243,748 B2 and 11,294,663 B2. Additional patents pending.

SOURCE Appdome