Topic starter
24/10/2026 8:50 pm
TL;DR: Mobile phishing and malware exposure outpaced MDM controls in Q2 2025, Lookout measured in its mobile threat landscape report. Mobile identity and endpoint governance need mobile telemetry, posture enforcement, and identity-aware response.
Editorial analysis by NHI Mgmt Group, based on content published by Lookout: “Lookout Mobile Threat Landscape Report - Q2 2025”.
By the numbers:
- 15% of iOS devices with MDM were exposed to mobile phishing attacks, a 2% increase from Q1.
Key questions
Q: Why do mobile phishing attacks create such a high compromise risk?
A: They work because the device is already trusted, always nearby, and often used for fast approvals.
Q: What are the signs that mobile controls are not keeping up with threat activity?
A: Look for large gaps between managed-device enrollment and actual exploit visibility, repeated phishing exposure on mobile channels, delayed OS updates, and a lack of mobile telemetry in incident workflows.
Q: What breaks when mobile security is treated as a lower-priority endpoint problem?
A: Identity assurance breaks first.
Practitioner guidance
- Build mobile into identity risk scoring Treat mobile phishing, suspicious prompts, and app-based credential capture as identity-risk signals that can raise user risk, trigger step-up authentication, or suspend access.
- Extend SOC telemetry to mobile devices Ingest mobile threat, posture, and web-filtering signals into the SOC so analysts can correlate phishing, malware, and exploit activity with account compromise indicators.
- Tighten mobile device posture enforcement Require current OS versions, device lock, and encryption on managed phones and tablets, then monitor for drift rather than assuming MDM enrollment equals protection.
Bottom line: Mobile phishing is now a direct identity risk because the same device used for communication is also used for authentication and access.
Glossary terms: Mobile Phishing, Surveillance Spyware, Mobile Device Management, Device Posture
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
25/10/2026 11:11 am
Mobile is now an identity perimeter, not just an endpoint category. The report shows that mobile devices are involved in authentication, communications, and work access, which means compromise is no longer limited to device hygiene. When phishing lands on the device used to approve access, the identity control plane is affected as directly as the endpoint. Practitioners should treat mobile as part of the IAM and SOC surface, not as an accessory to desktop security.
A few things that frame the scale:
- 43% of security professionals are concerned about AI systems learning and reproducing sensitive information patterns from codebases, according to the State of Secrets in AppSec.
A question worth separating out:
Q: Should organisations treat managed mobile devices as trusted endpoints?
A: No. Management is not the same as security, and MDM enrollment does not stop phishing, malicious apps, or browser exploitation. Organisations should treat managed phones as controlled but still attackable endpoints, then pair posture enforcement with identity-aware detection and response.
👉 Read our full editorial: Mobile threat telemetry shows phishing and malware outpace controls
This post was modified 6 days ago by NHI Mgmt Group