An apparatus for increasing tamper-resistance of Java bytecode, comprising: a Java bytecode protection tool configured to apply protections to Java bytecode during build-time to generate secured Java bytecode and corresponding protection data, wherein the secured Java bytecode includes a protected application payload and protected Java classes that are encrypted using white-box encryption techniques and which can only be accessed by a software-implemented white-box security module and which can be loaded individually by secure loaders within the security module; wherein at least a portion of the secured Java bytecode is loaded into a Java Virtual Machine (JVM) executing within a hardware environment configured to load at least a portion of the secured Java bytecode; wherein the corresponding protection data is loaded into the software-implemented white-box security module, wherein the software-implemented white-box security module includes a Java Native Interface (JNI) bridge and is configured to execute in the same environment as the JVM during deployment time and to use the JNI bridge to communicate with the JVM during loading and execution of the secured Java bytecode; and counter static and dynamic attacks to the secured Java bytecode during loading and execution of the secured Java bytecode via one or more software-implemented protection mechanisms, wherein at least one of the one or more software-implemented protection mechanisms are integrated into the software-implemented white-box security module, wherein the static and dynamic attacks are countered based at least in part on the corresponding protection data loaded into the software-implemented white-box security module, and wherein the software-implemented white-box security module is configured to co-execute with the secured Java bytecode within the environment via the JNI bridge during runtime. a Java bytecode protection tool configured to apply protections to Java bytecode during build-time to generate secured Java bytecode and corresponding protection data, wherein the secured Java bytecode includes a protected application payload and protected Java classes that are encrypted using white-box encryption techniques and which can only be accessed by a software-implemented white-box security module and which can be loaded individually by secure loaders within the security module; wherein at least a portion of the secured Java bytecode is loaded into a Java Virtual Machine (JVM) executing within a hardware environment configured to load at least a portion of the secured Java bytecode; wherein the corresponding protection data is loaded into the software-implemented white-box security module, wherein the software-implemented white-box security module includes a Java Native Interface (JNI) bridge and is configured to execute in the same environment as the JVM during deployment time and to use the JNI bridge to communicate with the JVM during loading and execution of the secured Java bytecode; and counter static and dynamic attacks to the secured Java bytecode during loading and execution of the secured Java bytecode via one or more software-implemented protection mechanisms, wherein at least one of the one or more software-implemented protection mechanisms are integrated into the software-implemented white-box security module, wherein the static and dynamic attacks are countered based at least in part on the corresponding protection data loaded into the software-implemented white-box security module, and wherein the software-implemented white-box security module is configured to co-execute with the secured Java bytecode within the environment via the JNI bridge during runtime. <EOS>