Quokka Launches Q-firm to Secure Android Firmware Before Devices Ship

New firmware security analysis tool helps telcos and device makers validate security before release.

Published on Mar. 10, 2026

Got story updates? Submit your updates here. ›

Quokka, a leader in mobile app risk and security, has announced the launch of Q-firm, a firmware security analysis tool designed to help telecommunications providers and Android device manufacturers ensure that every device released to market is secure, free from vulnerabilities, and aligned with industry standards. Q-firm provides automated, multi-layered firmware security analysis across pre-installed, hidden, and privileged Android applications embedded within device firmware.

Why it matters

The launch of Q-firm comes after the discovery of the 'Keenadu' firmware-level Android backdoor that was found pre-installed on new devices, highlighting how vulnerabilities or malicious components embedded in firmware can reach end users before a device is ever powered on. Q-firm aims to address this growing issue by helping manufacturers and service providers validate device security before shipping.

The details

Q-firm applies AI-powered static, dynamic, interactive, and forced-path execution analysis techniques, combined with expert review, to uncover insecure interfaces, embedded libraries with unknown vulnerabilities, escalation-of-privilege paths, privacy leaks, and other behaviors that could enable real-world abuse. It generates precise Software Bills of Materials (SBOMs) and validates firmware behavior against industry security standards including NIAP, NIST, and OWASP MASVS.

  • Q-firm was announced on March 10, 2026.
  • In February 2026, the 'Keenadu' firmware-level Android backdoor was discovered pre-installed on new devices.

The players

Quokka

A global leader in mobile security, trusted by Fortune 500 companies and government agencies to protect against mobile threats.

Q-firm

Quokka's new firmware security analysis tool designed to help telecommunications providers and Android device manufacturers ensure device security before release.

Nikolaos Kiourtis

The CTO at Quokka.

Jaysen Sweeting

The Sr. Principal Security Engineer at Promethean, an early Q-firm customer.

Promethean

A global education technology company and an early Q-firm customer.

Got photos? Submit your photos here. ›

What they’re saying

“End users expect mobile devices to be secure out of the box, but with the evolving threat landscape, that is no longer a reality.”

— Nikolaos Kiourtis, CTO at Quokka

“Security is a critical part of our release process, but validation can be complex, especially at scale. We use Q-firm to test our Android-based devices so we can identify and remediate vulnerabilities in firmware and pre-installed applications before they ship. It provides visibility into areas that are difficult to assess manually and strengthens our overall device security validation.”

— Jaysen Sweeting, Sr. Principal Security Engineer at Promethean

What’s next

Quokka is hosting an informational webinar about Q-firm on April 2, 2026 at 9 a.m. PT.

The takeaway

As attackers increasingly target the software supply chain, firmware can no longer be implicitly trusted as secure. Q-firm helps telcos and device manufacturers validate security across every layer of the device before it reaches customers, addressing a critical gap in the Android ecosystem.