What Is Mobile Security?
Mobile security protects smartphones and tablets from malicious apps, network attacks, and phishing.
The Mobile Threat Landscape
Malicious Applications
Malicious apps impersonate legitimate applications in app stores or are distributed through third-party app repositories, phishing links, and social engineering. Once installed, malicious apps can steal credentials from other applications, exfiltrate sensitive data, enable persistent surveillance, and install additional malware. Even official app stores have experienced malicious app campaigns — though the vetting processes of Apple's App Store and Google Play reduce but do not eliminate the risk.
Network-Based Attacks
Mobile devices connecting to public Wi-Fi networks are vulnerable to man-in-the-middle attacks, rogue access point attacks, and SSL stripping. Corporate email and application access through uncontrolled networks — a common pattern for remote workers in public spaces — exposes credentials and data to network-level interception.
Phishing on Mobile
Smishing and mobile browser phishing exploit the small screen context that makes URL evaluation difficult, the absence of email security gateways that protect corporate email, and the personal nature of mobile devices where users may apply less security skepticism than at a corporate workstation.
Mobile Device Management
Mobile Device Management — MDM — platforms enforce security policies on enrolled devices: requiring screen lock PIN or biometric authentication, enforcing encryption, enabling remote wipe of lost or stolen devices, restricting installation of applications from unknown sources, and separating corporate data from personal applications through containerization. Microsoft Intune, Jamf, and VMware Workspace ONE are the dominant enterprise MDM platforms.
BYOD Policy Considerations
Bring Your Own Device policies create a spectrum of options between requiring corporate-owned devices and permitting unrestricted personal device use for corporate access. MAM — Mobile Application Management — manages only corporate applications and data on personal devices without requiring full device enrollment, protecting corporate data while respecting employee privacy. The appropriate policy depends on the sensitivity of data accessed, regulatory requirements, and organizational culture, but the absence of any mobile device policy is consistently one of the most significant security gaps in mid-market environments.
Related Reading
What is mobile security?
Mobile security is the protection of smartphones and tablets, their data, and the corporate systems they access, from cyber threats. With mobile devices now the primary access point for many corporate workflows, mobile security spans device management, application security, network protection, and identity. The threat surface includes malicious apps, phishing, network attacks, physical loss, and increasingly sophisticated mobile-targeted malware including commercial spyware.
How does mobile security differ from endpoint security on laptops?
Mobile platforms iOS and Android have stricter application sandboxing than desktop operating systems, limiting some attack vectors but constraining traditional EDR functionality. Personal device usage for work blurs the line between corporate and personal data. App stores provide some security review but malicious apps still slip through. Lost or stolen devices are a more common risk than for laptops. Mobile threat defense platforms address the unique mobile risk landscape rather than reusing laptop controls.
What are the most significant mobile security threats?
Phishing via SMS, messaging apps, and email targeting mobile users where URL inspection is harder. Malicious apps that slip into legitimate app stores. Network attacks on insecure public WiFi. Commercial spyware including Pegasus and Predator targeting journalists, activists, and executives. Stolen or lost devices with weak local authentication. SIM swapping that takes over phone numbers used for MFA. Outdated devices with unpatched vulnerabilities.
What platforms protect mobile devices?
Mobile Device Management platforms including Microsoft Intune, Jamf, VMware Workspace ONE, and Kandji manage device configuration and policy. Mobile Threat Defense platforms like Lookout, Zimperium, and Wandera detect threats on the device. iVerify and Mobile Verification Toolkit support advanced threat detection for high-risk users. App vetting services like NowSecure and Appthority analyze enterprise app security. Identity providers like Okta and Microsoft Entra ID secure mobile access to corporate apps.
How should organizations handle bring-your-own-device (BYOD)?
Modern BYOD programs use application-level controls rather than full device management to balance security with user privacy. Mobile Application Management policies in Intune restrict data sharing from corporate apps without requiring corporate control over the entire device. Conditional access policies in Microsoft Entra ID or Okta evaluate device health before granting access. Apple's Managed Apple Account and Android Work Profile separate corporate and personal data on the same device.
What does enterprise mobile security cost?
MDM platforms typically run $5 to $15 per device per month. Mobile Threat Defense adds another $3 to $10 per device per month. A 1,000-device fleet should expect $100,000 to $300,000 annually for the platforms plus operations. Microsoft Intune is bundled in M365 E3 and E5 licensing, materially changing the math for Microsoft-heavy organizations. The operations cost including help desk and policy management often exceeds the platform cost.
What is the first step in improving mobile security?
Enforce mandatory device passcodes, OS version minimums, and disk encryption on every device that accesses corporate data, through conditional access policies in your identity provider. Most organizations find a meaningful percentage of devices that fail these baseline controls today. Closing that gap delivers immediate, measurable risk reduction before more sophisticated mobile defense layers.
Real-World Example: Pegasus Spyware — Nation-State Mobile Surveillance
Pegasus, a sophisticated mobile spyware developed by NSO Group, exploited zero-click vulnerabilities in iOS and Android to install surveillance software on target devices without any user interaction. Once installed, Pegasus captured all communications, location data, contacts, and could activate the camera and microphone. Victims included journalists, lawyers, activists, and government officials across 50 countries. The Pegasus cases demonstrated that mobile devices, including fully patched iPhones, represent a viable high-value target for sophisticated nation-state actors.
Of enterprise breaches involve mobile devices as either the initial access vector or an intermediate step in the attack chain — driven by the combination of corporate access, personal use patterns, and weaker security controls compared to managed workstations.