Mobile phishing and BYOD risk: are your controls keeping up?

TL;DR: Mobile devices have become a primary social-engineering foothold, with Lookout noting that 77% of organisations have faced an attack in the past six months while only 33% have a plan for AI-powered phishing training. The control gap is no longer email filtering alone, but visibility, response, and user trust on BYOD phones and tablets.

Editorial analysis by NHI Mgmt Group, based on content published by Lookout: “Human Risk Multiplier: How Mobile Devices Expand Enterprise Attack Surfaces”.

By the numbers:

• 77% of organisations have experienced an attack in the past six months.
• Only 33% of organisations currently have a plan to offer training on AI-powered social engineering.

Key questions

Q: How should organisations reduce mobile app risk in BYOD environments without relying only on device controls?

A: Use layered mobile security, not a single control.

Q: Why do mobile devices increase the risk of account compromise?

A: Mobile devices increase account compromise risk because phishing, app permissions, local data and physical loss can all expose the same credentials or session material.

Q: What are the signs that social engineering controls are failing?

A: Common failure signals include repeated clicks on suspicious links, staff bypassing verification steps, unexpected credential sharing, and approval of urgent requests through unapproved channels.

Practitioner guidance

• Define mobile access as part of identity governance Map which authentication flows, apps, and data types depend on smartphones and tablets, then decide where mobile risk changes access decisions.
• Deploy mobile-specific detection and response Use controls that inspect app behaviour, abnormal communication patterns, and mobile-focused malware rather than assuming laptop EDR covers phones.
• Set BYOD privacy and response boundaries Document what the organisation can inspect, what it can remediate, and how far IT authority extends on personally owned devices.

Bottom line: Mobile devices now sit on the path between social engineering and enterprise access, which makes them part of the identity security problem.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →