Topic starter
24/10/2026 8:49 pm
TL;DR: 2023 saw record mobile phishing attempts against enterprise users, more than 260 iOS CVEs published, and 52.8% of risky mobile devices running out-of-date OS versions, according to Lookout, showing how social engineering and delayed patching combine to widen exposure. Mobile security now fails at the user, app, and device layers at once, so governance must shift from awareness to enforceable control.
Editorial analysis by NHI Mgmt Group, based on content published by Lookout: “Mobile Threat Landscape Report: 2023 in Review”.
By the numbers:
- There were more than 260 iOS CVEs published in 2023.
- 52.8% of risky mobile devices were out-of-date OS devices.
Key questions
Q: Why do out-of-date mobile devices increase enterprise risk?
A: Out-of-date devices keep known vulnerabilities exposed long after disclosure, especially when operating system patches are available but not yet installed.
Q: What are the signs that mobile security hygiene is failing in an organisation?
A: Common warning signs include unmanaged devices, weak or shared passwords, outdated operating systems, delayed app updates, and employees logging in from unsecured public Wi-Fi.
Q: What breaks when mobile phishing is not in place?
A: When mobile phishing resistance is weak, attackers can exploit urgency, small-screen trust, and messaging-app context to capture credentials or trigger MFA bypass.
Practitioner guidance
- Enforce mobile phishing resistance controls Block high-risk message and link interactions on managed mobile devices, and require users to verify unexpected requests through a separate trusted channel.
- Tie access to device compliance signals Use device posture, OS version, and lock status as access inputs so that out-of-date or unlocked devices do not retain the same trust level as compliant devices.
- Prioritise remediation for shared mobile components Track Chromium, WebP, JavaScript engine, and shared library exposure across browser and app fleets because one component flaw can affect multiple apps at once.
Bottom line: Mobile threats now combine phishing, exploitation, and posture drift into a single enterprise governance problem.
Glossary terms: Mobile Phishing, Device Posture, MFA Bypass, Shared Component Vulnerability
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
25/10/2026 11:12 am
Mobile threat governance is now an identity problem as much as an endpoint problem. The report shows that phones are not just devices carrying risk, but trust brokers used for authentication, approval, and message-based social engineering. When the mobile channel becomes the place where credentials are captured or MFA is bypassed, IAM teams have to treat handset posture and message trust as part of access governance. The practitioner conclusion is straightforward: mobile access decisions need identity-aware device signals, not just enrollment status.
A question worth separating out:
Q: How should IAM teams govern mobile application access in BYOD environments?
A: IAM teams should govern mobile app access as an entitlement problem, not just a device problem. That means approvals, policy restrictions, and revocation rules must follow the identity, while app-level controls handle data movement on personal devices. The key is to define who may use the app, what data it may reach, and when access must be removed.
👉 Read our full editorial: Mobile phishing and outdated devices widen enterprise attack risk
This post was modified 6 days ago by NHI Mgmt Group