Edinburgh Napier & Approov boost smartphone security

Edinburgh Napier University has partnered with mobile cybersecurity firm Approov to improve smartphone security through a Knowledge Transfer Partnership co-funded by Innovate UK.

Under the agreement, the university and the Edinburgh-based company will recruit two cybersecurity researchers and work together over 30 months on blue-team and red-team test beds. In practice, that means developing defensive methods while also building an offensive testing environment to probe weaknesses in software and security controls.

The project received the highest rating in Innovate UK's assessment for the funding round, according to the organisations. It will also involve the Scottish Centre of Excellence in Digital Trust and Distributed Ledger Technology, which is hosted by Edinburgh Napier.

Knowledge Transfer Partnerships are a long-running UK scheme designed to connect academic research with commercial problems. Here, the focus is smartphone software security at a time when businesses face growing pressure to protect mobile applications, data and digital identities against increasingly complex attacks.

Approov works in mobile application security, an area that has drawn more attention as companies shift more customer and employee activity onto smartphones. Mobile devices are now widely used for banking, healthcare, messaging and workplace access, meaning weaknesses in apps or device-level trust can expose personal information and corporate systems.

For universities, such partnerships can help turn specialist research into commercial work while giving researchers a route to work directly on industry problems. For small and mid-sized cyber firms, they can provide access to academic expertise that would be harder to build internally.

Edinburgh Napier said the project builds on its existing work in cybersecurity and digital trust. The university has been recognised by the National Cyber Security Centre and the Department for Science, Innovation and Technology as an Academic Centre of Excellence in Cyber Security Education, and said its cyber programmes have helped produce several spin-out companies.

Research focus

The partnership centres on cryptography, digital trust and software testing. Blue-team activity generally refers to defensive security work, such as protecting systems, spotting intrusions and improving resilience, while red-team work involves simulated attacks designed to reveal vulnerabilities before criminals or hostile actors can exploit them.

That combination has become more important as security teams respond to automated tools and the wider use of generative artificial intelligence, which some researchers and practitioners say can speed up both code production and the identification of flaws. The project will create a setting where new protections can be tested continuously against adversarial techniques, the parties said.

The university's academic lead on the project is Professor Bill Buchanan OBE, Director of the Scottish Centre of Excellence in Digital Trust. He said the work would combine research into trust and cryptography with a practical environment for testing new methods.

"Scotland has many great cybersecurity companies, and, for me, Approov is one of the best. They have an internationally leading product range for mobile device security and work with many leading companies around the world.

"This partnership will allow us to advance research and innovation around cryptography and digital trust, and better protect users.

"What is truly exciting is the opportunity to create new methods, along with a test bed to fully test them. This type of approach becomes ever more important in an era of GenAI breaking software systems."

The funding route also drew comment from the regional KTP network. The programme is often used to support projects in which a company brings in new expertise through dedicated researchers working between business and academia.

"Achieving the highest score in this funding round is a tremendous endorsement of both the vision of Approov and the strength of the partnership with Edinburgh Napier University.

"This project tackles some of the most important emerging challenges in cybersecurity, and the KTP programme has provided the flexibility to build an exceptional team around that challenge.

"Through the recruitment of two specialist associates, operating in complementary blue-team and red-team roles, the project will create a unique environment where new defensive technologies are continually challenged and improved through adversarial testing.

"By combining world-leading academic research with a highly innovative and ambitious technology company, the partnership will not only deliver new products and services but also establish long-term capability that will support growth, competitiveness and future innovation," said Dr Anne-Marie Haughey, East of Scotland KTP Centre Manager.

Company angle

For Approov, the arrangement provides a structured way to test its software more aggressively while linking product development to university research. Security suppliers increasingly need to show their tools can withstand evolving attack methods, particularly as mobile software becomes more closely tied to payments, identity verification and regulated services.

Jae Hossell, Chief Technology Officer at Approov, said the company sees the project as a way to combine industry work with academic research and examine its software under pressure.

"We are thrilled to partner with Edinburgh Napier University for this Knowledge Transfer Partnership.

"By combining our industry expertise with their world-class cybersecurity researchers, we are creating a unique environment to stress-test our software.

"This ensures Approov continues to deliver the highest standard of mobile security to our customers worldwide," said Hossell.