Certificate pinning protects against network-level TLS interception but fails against modern threats like runtime hooking, rooted devices, and token theft. Attackers now operate inside the device or app process, bypassing pinning by hooking validation functions or extracting session tokens from memory. Pinning also introduces operational fragility with certificate rotation and can cause production outages. Effective security requires defense in depth: strong TLS configuration, short-lived tokens with rotation, device integrity signals, step-up authentication for sensitive operations, and behavioral anomaly detection. Pinning remains useful for controlled infrastructure with disciplined processes, but alone it's insufficient against today's attack vectors.
