Data Theorem

Data Theorem builds full-stack application security testing that follows an app across its actual attack surface — mobile client, backend APIs, and the cloud infrastructure serving both — combining static analysis, dynamic testing, and runtime protection rather than testing each layer with a separate, disconnected tool. The premise is that a mobile app’s real risk usually lives in how it talks to its APIs and cloud backend, not just in the app binary itself, which is where many point-solution mobile scanners stop looking.

Founded in 2013 and headquartered in Palo Alto, California, with additional offices in Paris and New York, Data Theorem was built by a team with backgrounds spanning early penetration testing firm @stake, network security vendor Neoteris, the iOS jailbreak community, and enterprise vendors Cisco and Juniper. The company reports its platform protects applications serving more than 2.8 billion end users, including seven of the top ten largest global banks, and it has been ranked #1 in the Cloud Native Applications use case in Gartner’s 2025 Critical Capabilities for Application Security Testing report. The company has raised venture funding from investors reported to include Wing Venture Capital and Ten Eleven Ventures, though the size and timing of its most recent round is not clearly disclosed in public sources.

Data Theorem competes with mobile-focused scanners and broader cloud-native application protection platforms (CNAPPs) from vendors like Checkmarx, Veracode, and the AppSec modules of larger cloud security suites. Its differentiation is the combined mobile-API-cloud view, which matters most for organizations — particularly regulated financial services firms — whose mobile apps are effectively thin clients over a much larger API and cloud attack surface.