Appdome, the industry leader in mobile business protection, has announced—live from Black Hat 2025—the integration of its IDAnchor™ Customer Identity Protection suite into its MobileBOT™ Defense solution. This strategic unification empowers mobile brands to construct a virtual Mobile API Gateway atop any conventional backend system, allowing them to block unauthorised API traffic, thwart brute-force bot intrusions, and eliminate the need for separate tools for API and bot security.
By embedding IDAnchor™ into MobileBOT™ Defense, Appdome is offering mobile businesses a streamlined and effective approach to securing mobile APIs and defending against bot threats—without the overhead and complexity associated with standalone products or SDKs.
“There’s no need for point products in Bot Defense and API Protection any longer,” said Tom Tovar, CEO and co-creator of Appdome. “Within one solution, IDAnchor can tell network security teams if an API request is coming from real users, apps, and devices and MobileBOT Defense can stop brute force bot attacks with ease.”
This innovation signals a shift in how mobile enterprises approach cybersecurity—providing a unified, intelligent, and AI-driven framework for protecting mobile infrastructure at scale.
Build Your Own Mobile API Gateway
Powered by AI, Appdome’s MobileBOT™ Defense, with IDAnchor inside, enables mobile teams to create a virtual Mobile API Gateway that sits on top of any standard backend infrastructure. Together, they provide an OS-independent chain of trust consisting of:
1. WorkspaceID – root identifier from the DevOps environment,
2. ReleaseID – intermediate identifier for each App Release,
3. InstallID – leaf identifier for each App instance, and
4. DeviceID – leaf identifier for each mobile Device that uses an IDAnchor enabled app.
5. True Device Attributes™ – OS-independent device attributes.
6. Threat Signals – for identity, OS, Application and Device Threats.
During any API connection request, if any part of the chain is missing, altered, or replaced, the mobile brand or business knows the origin of API request is suspicious or malicious. If an attacker attempts to impersonate legitimate mobile users, applications, devices, locations, or uses automated programs to generate requests individually or via brute force methods, the connection can be dropped or routed for mitigation in the application. No external systems or SDKs are required.
“The Appdome platform lets mobile brands create the Mobile API Gateway or Mobile Application Firewall of their choice,” said Chris Roeckl, Chief Product Officer at Appdome. “Put simply, MobileBOT™ Defense and IDAnchor™ combined can offer deeper inspection, 400+ detection and defense options, to stop Unauthorized Access, API Attacks, API Abuse or Bot Attacks in one.”
Immutable Mobile Identity vs. Cookies and Tokens
Legacy mobile API and bot defense products use time-based cookies and tokens to determine session validity. They can be stored insecurely or transmitted in the clear, making them vulnerable to reuse by the attacker. Cookies and tokens do not provide any data on the mobile device, application, or installation making the API request. In short, cookies and tokens cannot tell if the API request is coming from a good, bad, real, fake, compromised or uncompromised mobile user, app, install, or device.
In contrast, each IDAnchor fingerprint can be cryptographically bound to each user so that it is not reusable and persists across re-installs, OS updates, and factory resets. This fully addresses these top challenges in legacy bot protection strategies:
1. Fake Users & Devices: Fake users and fake, emulated, or spoofed devices cannot present a valid IDAnchor identity, making it easy to block spoofed or impersonated sources.
2. Bot Attack Masking & Evasion Techniques: Any attempted reuse or manipulation of the device, application, or OS attributes will result in an IDAnchor mismatch, revealing the attacker.
3. Stolen Credentials or Identities: Stolen identities using separate devices, synthetic identity or AI generated deepfakes, vishing, or session hijacks.
4. Install and attribution fraud: Fraud attempts conducted by emulator farms, malware-controlled apps, or fake devices.
5. KYC-fraud: Fake signups, fake account creation, and usage performed by bots or automated tools designed to spoof real behavior.
6. Weaponized Mobile Apps. Malware-controlled or modified apps will change the IDAnchor fingerprint, revealing the weaponized mobile app.
7. Brute force credential stuffing: Attacks that use automated programs or stolen credentials with fake or spoofed mobile applications and devices.
8. Bot Source Triangulation: A bot detected from App A can be blocked or flagged in App B—without needing to sync external intelligence.
9. Risk Scoring for API Connection Requests: Each match or mismatch of IDAnchor values is represented as a percentage and can be used as a proxy for connection risk or used to influence risk scoring methods for such purpose.
“API attacks and abuse are a superset of bot defense, and you have to defend against both,” said Gil Hartman, Field CTO at Appdome. “MobileBOT™ Defense with IDAnchor™ proves you can address both in one solution and retain full flexibility to customize where and how you enforce each defense, per App, per API, or per Device.”
Appdome will showcase IDAnchor™ and MobileBOT™ Defense at BlackHat USA in Vegas Aug 6th and 7th. Stop by Booth #4746 in the Black Hat Business Hall to learn more and see it live. For those not attending Black Hat, learn more about Appdome Mobile API and Bot Protection.
