Topic starter
25/10/2026 11:04 am
TL;DR: Nearly 13% of devices encountered phishing or malicious content in Q3 2025 because mobile now serves as a reliable entry point into identity and access workflows, Lookout found. Mobile telemetry has to feed identity and SOC decisions early, or cloud abuse and suspicious sign-ins surface after access is already accepted.
Editorial analysis by NHI Mgmt Group, based on content published by Lookout: “Lookout Mobile Threat Landscape Report - Q3 2025”.
By the numbers:
- Global mobile phishing click rate across all devices was 12.88% in Q3 2025.
- iOS devices recorded a 16.07% phishing encounter rate in Q3 2025.
- MDM-managed devices still saw a 12.63% phishing encounter rate in Q3 2025.
Key questions
Q: Why does mobile risk keep showing up even in managed environments?
A: Because device management does not control the legitimacy of messages or the user’s decision to trust them.
Q: What breaks when mobile telemetry is missing from SOC monitoring?
A: The earliest compromise signals are lost, so the SOC sees the outcome later than it should.
A: Security teams should treat mobile access as part of the same authentication policy, not an exception.
Practitioner guidance
- Correlate mobile phishing with identity events Join mobile web, SMS, and authentication telemetry so one suspicious click or MFA prompt can be traced into cloud and collaboration access logs.
- Tighten approval pathways on mobile-originated access Review which mobile flows can trigger privileged approvals, then remove any path that allows a phone-based interaction to grant elevated access without additional verification.
- Separate managed posture from trusted access Do not treat MDM compliance as proof of legitimacy.
Bottom line: Mobile risk has settled into a persistent baseline because attackers now use phones as a reliable entry point into identity and access workflows.
Glossary terms: Mobile Phishing, Mobile Telemetry, MFA Reset Abuse, Identity Abuse
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 7 days ago by NHI Mgmt Group
27/10/2026 7:14 pm
Mobile telemetry is now identity telemetry: the most useful early warning on mobile is not a device crash or malware alert, but the signal that a user has entered a fraudulent authentication or messaging flow. That shifts mobile governance into the identity domain, where access decisions, MFA prompts, and session trust become part of the control surface. Practitioners should treat mobile signals as evidence of access risk, not just endpoint risk.
A question worth separating out:
Q: Should organisations prioritise device ID over stronger authentication controls?
A: No. Device ID works best as an additional trust signal layered onto authentication, session controls, and behavioural risk checks. Prioritising it over stronger authentication can improve convenience in the short term, but it also increases the chance that compromised or shared devices inherit too much trust. Assurance must stay explicit.
👉 Read our full editorial: Mobile risk has become a persistent enterprise attack surface
This post was modified 7 days ago by NHI Mgmt Group