Mobile travel exposure: are your controls keeping up?

TL;DR: Summer travel turns mobile devices into the enterprise’s most exposed attack surface, with more than 5 million unsecured public Wi-Fi networks, 33% of users still connecting to open networks, and AI-generated phishing now 5 times more convincing than human-written lures, according to Zimperium. The gap is not awareness, but continuous control over devices, apps, and access outside the office.

Editorial analysis by NHI Mgmt Group, based on content published by Zimperium: “Summer Travel Exposes Mobile as the Most Vulnerable Attack Surface in the Enterprise”.

By the numbers:

• Zimperium found more than 5 million unsecured public Wi-Fi networks globally in 2025.
• Zimperium says 33% of users still connect to open networks despite the risk.
• Zimperium's 2025 Global Mobile Threat Report found that mishing represents roughly one-third of threats identified by zLabs.

Key questions

Q: What breaks when trusted networks are used for authentication on travel devices?

A: Trusted networks collapse the difference between infrastructure access and identity trust.

Q: Why do unsecured Wi-Fi and travel-themed phishing increase identity risk so quickly?

A: They compress the attacker’s opportunity window and the user’s decision time at the same moment.

Q: What are the signs that mobile phishing controls are not working?

A: Weak mobile phishing control usually shows up as repeated user reports of suspicious texts, rising smishing activity, and employees continuing to click links or enter credentials on mobile devices.

Practitioner guidance

• Strengthen mobile phishing controls Extend detection to SMS, messaging apps, QR codes, and PDFs because travel lures now arrive outside email and can bypass desktop-focused training.
• Apply conditional access to risky mobile sessions Block or step up authentication when users connect from open Wi-Fi, captive portals, or other unsecured networks that undermine session trust.
• Review third-party apps on work devices Inventory installed consumer apps that share devices with corporate email, MFA, and collaboration tools, then remove apps that can observe or steal credentials.

Bottom line: Mobile travel risk is really a convergence problem, where identity, device posture, and app trust all collapse into one exposed endpoint.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →