In short
Mobile threat defence (MTD) is security software for phones and tablets that detects and blocks phishing links, malicious or risky apps, operating system vulnerabilities, unsafe networks and compromised devices. It works alongside mobile device management (MDM), passing each device's risk level to the MDM so a compromised phone can be blocked from company data.
Not sure where to start?
Tell us what you need to achieve and we will point you to the right option.
What is a mobile threat?
A mobile threat is any attack or weakness that puts a phone or tablet, or the company data on it, at risk. The main types are:
- Phishing and smishing: malicious links in text messages, messaging apps, email, QR codes and websites, designed to steal passwords or install malware. Links in texts bypass email filtering entirely.
- Malicious and risky apps: malware, spyware and apps that leak data or come from outside official app stores.
- Operating system vulnerabilities: devices running out-of-date or unsupported versions of iOS, iPadOS or Android.
- Risky networks: hostile or unsecured Wi-Fi and man-in-the-middle attacks that intercept traffic.
- Device compromise: jailbroken or rooted devices, or configuration changes that weaken the platform's built-in protection.
Traditional endpoint protection and EDR agents were built for Windows, macOS and Linux, and device management tools configure phones rather than detect attacks on them. That is the gap mobile threat defence fills. In US spelling it is mobile threat defense (MTD); the products and the job are the same.
How mobile threat defence works
An MTD product is an app on each device, backed by the vendor's cloud analysis of apps, links and devices and managed from a central console. It typically:
- Checks links as they are opened, in browsers, messages and other apps, and blocks known phishing and malicious sites.
- Assesses installed apps for malware and risky behaviour, where the platform allows it.
- Watches the device for jailbreak or root, risky configuration and out-of-date operating system versions.
- Detects network attacks such as man-in-the-middle interception on Wi-Fi.
- Gives the user guidance in the app so many issues can be fixed without a support ticket.
- Passes the device's risk level to your MDM and conditional access, which can restrict access to company apps until the issue is fixed.
What an app can see differs by platform: iOS limits what any security app can inspect, while Android and ChromeOS allow deeper app scanning. Expectations are worth setting per device type before you roll out.
Mobile threat defence vs mobile device management
MTD and MDM are complementary, not alternatives.
| Mobile device management (MDM/UEM) | Mobile threat defence (MTD) | |
|---|---|---|
| Main job | Enrol, configure and control devices and apps | Detect and block attacks on the device |
| Typical controls | Passcodes, encryption, app deployment, remote lock and wipe, work profiles | Phishing protection, app risk, network attack detection, jailbreak and root detection |
| Sees active threats? | No, it enforces settings | Yes, that is its purpose |
| Works on personal devices? | Usually through app protection or a work profile | Yes, with privacy controls designed for BYOD |
| How they connect | Uses the MTD risk level in compliance and conditional access rules | Sends device risk to the MDM |
If you need help with the device management side, see mobile device management from Forever Group. Some unified endpoint management platforms, such as IBM MaaS360, also offer mobile threat features of their own.
Not sure which option fits? Ask us
Tell us what you need and we will help you choose the right option.
Company phones and BYOD
For company-owned devices, the MTD app is usually pushed out through your MDM, often with zero-touch activation so staff do not need to set anything up. For personal phones, staff install the app themselves, and privacy is what makes them willing to do so.
The products we supply are designed with that in mind. CrowdStrike states that Falcon for Mobile does not read or scan personal data in texts, emails or photos. Lookout states that it collects only the data needed to detect and remediate threats and lets organisations de-identify user data. Explaining clearly what the app can and cannot see is part of a good rollout.
The NCSC's bring your own device guidance and our BYOD security guide cover the policy side. Phones and tablets that access organisational data can also fall within Cyber Essentials; see Cyber Essentials BYOD requirements.
Mobile threat defence solutions we supply
We supply several mobile threat defence products, so we can match the choice to the endpoint platform and device management you already use.
| Product | Platforms | What it offers | How we supply it |
|---|---|---|---|
| Lookout Mobile AI Security | iOS, Android, ChromeOS | Phishing and content protection, app risk, device compromise and network attack detection, MDM and SIEM integration; Advanced adds deeper app risk analysis, vulnerability management and Secure DNS | Essentials and Advanced bundles; see Lookout mobile security |
| CrowdStrike Falcon for Mobile | iOS, Android | Detects suspicious links in texts, email, browsers and QR codes, mobile malware, network disruption and jailbroken devices; Zero Trust Assessment risk scores | Per-device add-on to a CrowdStrike Falcon bundle; which bundle fits is confirmed at quote |
| ThreatDown Mobile Security | Chromebooks, iOS and iPadOS, Android | Protection against harmful websites, malicious apps and unwanted ads, with features varying by platform | Per-device add-on, managed in the same OneView console as ThreatDown on computers |
| IBM MaaS360 | iOS, iPadOS, Android, Windows, macOS | Unified endpoint management; the Enterprise edition includes mobile threat management, and IBM offers an MTD add-on | Essentials, Deluxe and Enterprise, per device |
| Check Point Mobile Security | iOS, Android | Mobile threat defence, formerly Harmony Mobile | See Check Point Harmony Mobile |
| Sophos Mobile | iOS, iPadOS, Android; also manages Windows, macOS and ChromeOS | Mobile device management combined with mobile threat defence | See Sophos Mobile |
For more on licensing, see mobile security software on our licensing site. For antivirus and endpoint protection on laptops and desktops, see endpointprotection.uk.
Need help choosing?
We will recommend what fits your organisation and explain why, in plain English.
How to choose a mobile threat defence solution
The best fit usually comes down to a few questions:
- Which endpoint platform do you run? If your laptops use CrowdStrike or ThreatDown, adding their mobile product puts phones in the same console.
- Which MDM do you use? Check the MTD product integrates with it for zero-touch deployment and risk-based conditional access.
- How many devices are personal? For BYOD, the privacy model and how clearly it can be explained to staff matter as much as features.
- Do you need app and OS compliance enforcement? Lookout Advanced, for example, adds blocking of untrusted apps and vulnerable app versions, plus OS vulnerability visibility.
- Does your security team want mobile telemetry? If you need to hunt and investigate on phones, look at mobile EDR.
- Which platforms? Chromebook fleets, common in education, narrow the choice.
Mobile threat defence also supports a zero trust endpoint security approach, where a device's health is checked before it is trusted with company data.
How we help
We start with your devices (company and personal, by platform), your device management tool and the endpoint security you already run. From there we can:
- Recommend a mobile threat defence product that fits, with the reasoning written down
- Help connect it to your MDM and agree what happens when a device becomes high risk
- Help plan the rollout to company devices first, then personal devices, with a plain explanation for staff
- Arrange licensing, with pricing confirmed at quote
Contact us to talk through mobile threat defence for your organisation.
Mobile security guides
How Forever Systems helps with endpoint security
We are an independent UK IT and cyber security provider. We supply and support endpoint security from several vendors, so we can recommend what fits your devices, your people and your budget rather than one vendor's answer to everything.
- Start with what you have: we can review your current antivirus, EDR and Microsoft 365 licences before suggesting anything new
- Vendor-aware advice on EDR, XDR and managed detection and response, including CrowdStrike, SentinelOne, WatchGuard, Bitdefender, Sophos and Check Point Harmony
- Deployment help: planning a rollout, replacing an existing product and setting sensible policies for device control, encryption and patching
- Policies and compliance: we help you map your controls to Cyber Essentials and the NCSC's device guidance
- Ongoing support options, such as policy tuning, renewals and regular reviews, agreed and confirmed at quote
We work with businesses, schools, charities and public sector organisations. Tell us about your devices and we will suggest a sensible next step.
Frequently asked questions
What is mobile threat defence?
Mobile threat defence (MTD) is security software for phones and tablets that detects and blocks phishing, malicious apps, operating system vulnerabilities, network attacks and compromised devices. It reports each device's risk to a central console and to your mobile device management tool.
What is a mobile threat?
A mobile threat is any attack or weakness that puts a phone or tablet, or the data on it, at risk. Common examples are phishing links sent by text message, malicious or data-leaking apps, out-of-date operating systems, unsafe Wi-Fi and jailbroken or rooted devices.
What is the difference between MTD and MDM?
Mobile device management configures and controls devices: passcodes, encryption, apps and remote wipe. Mobile threat defence detects and blocks attacks on the device. They work together: the MTD product passes a risk level to the MDM, which can block a compromised device from company data.
Do iPhones need mobile threat defence?
iOS is a well-protected platform, but it does not stop staff tapping a phishing link in a text message, joining a hostile Wi-Fi network or running an out-of-date iOS version. Mobile threat defence on iPhones focuses on those risks rather than traditional antivirus scanning.
Can mobile threat defence be used on personal phones?
Yes. The products we supply support personal devices with privacy controls. CrowdStrike states that Falcon for Mobile does not read personal texts, emails or photos, and Lookout states that it collects only the data needed to detect and remediate threats.
Still have a question about mobile threat defence?
Ask us and a member of our team will reply by email.