Mobile security software is a category rather than a single product. It covers device management, threat detection, data loss prevention, and web filtering, each addressing a different part of the problem under names that overlap.
This page separates those product types into layers, covering products built for phones and tablets running iOS and Android rather than for laptops. For each it sets out what the software does, where its protection ends, and who sells it. Nothing here is ranked, because the right choice depends on what you already own.
Corrata publishes this guide and sells in two of the layers below. Vendors are included if they sell to organisations and have a documented offering for iOS or Android. Application shielding products such as Appdome and Guardsquare are out of scope, because they protect apps your organisation publishes rather than the phones your staff use.
What counts as mobile security software
The useful boundary is the operating system rather than portability.
Mobile security software protects phones and tablets running iOS and Android, along with the company data they reach. A laptop is portable too, but it is a different engineering problem, because a desktop operating system has long let security software install at a privileged level and observe the whole machine. A phone has never allowed that.
A vendor describing one agent across laptops, phones, and tablets is describing two engineering approaches under one brand, and the mobile half deserves separate evaluation.
A secure access client running on a phone is also not the same category as a product that detects threats on one, and treating them as interchangeable is how gaps get missed.
Why mobile security software is built differently
Desktop security consolidated over about two decades. Antivirus, host firewall, device control, and behavioural detection all merged into endpoint protection platforms, and those in turn became endpoint detection and response.
Mobile never went the same way, for reasons that come down to how the two operating systems are built.
The sandbox denies the view that desktop agents rely on: iOS and Android isolate applications from one another, so one cannot read another’s files or watch what the user does inside it. The level of system access that desktop agents have relied on has never existed on a phone. Desktop platforms are moving the same way, with Apple replacing kernel extensions with user-space system extensions and Microsoft building a platform for antivirus and endpoint detection to run outside the Windows kernel.
Products are built on sanctioned interfaces instead: What a mobile security product can see is set by the APIs each platform chooses to expose. Network extensions allow traffic to be inspected, management frameworks report configuration state and application inventory, and attestation services report whether an application or device meets the platform’s integrity criteria. Neither platform returns a jailbreak or root flag directly, so products infer that condition from other signals, and every vendor is working through the same set of interfaces.
The two platforms expose different things: Android allows an application to enumerate other installed applications and read their permissions, though since Android 11 it must declare which ones it needs to see or hold a permission that Google approves on Play. iOS allows none of it, so a product claiming identical capability on both platforms is worth questioning.
Mobile security fragmented into layers rather than consolidating into a single agent, because no one interface exposes all of it. Working out which layer a product occupies is most of the buying decision.
What the threats actually are
- Phishing outside email: Mobile phishing arrives through SMS (smishing), RCS, WhatsApp, Signal, Telegram, and LinkedIn, none of which an email gateway sees. A truncated address bar shows only a fraction of a URL, and there is no hover preview to check it against.
- QR code phishing: A code scanned with the native camera takes the user into a browser with a single tap and no security inspection in between, as our blog on QR code phishing sets out.
- Applications: Sideloading on Android, enterprise certificate abuse on iOS, and the alternative app marketplaces that the Digital Markets Act opened up on iOS in the EU all put software on a device without full store review. The more common problem is a legitimate store application requesting far more permission than its function requires.
- Networks: Phones join networks constantly and silently, and an attacker operating a network the device trusts can intercept any traffic that is not independently protected.
- Unpatched and unsupported devices: A phone on an operating system version that no longer receives security updates stays fully functional and fully exposed, and such devices accumulate quietly in any fleet that includes personally owned phones.
- Commercial spyware: Products sold to government customers and used against journalists, lawyers, and executives have repeatedly reached devices through zero-click delivery, as our history of iOS spyware documents.
- Data leaving through AI applications: Consumer AI services are installed on employee phones in volume, and company documents and client information are routinely pasted into them, making AI governance a necessity.
Built-in mobile protection on iOS and Android
Mobile platforms are more secure by default than a general-purpose desktop operating system, so the right starting point is a frank account of what you already have.
What the platforms cover
Application sandboxing, store review, and code signing are built in. Apple delivers OS security updates directly to every supported device. On Android, the full patch level depends on the handset maker, so two phones bought on the same day can sit months apart.
Apple offers Lockdown Mode for people at elevated risk of targeted attack, and Advanced Data Protection for end-to-end encrypted iCloud storage, though Advanced Data Protection has been unavailable to UK users since February 2025, when Apple withdrew it following a Home Office notice under the Investigatory Powers Act.
Google Play Protect scans Android applications, and work profiles separate company from personal data on one device.
Where it stops
Store review does not catch everything, and it does not apply to apps installed from outside the store. Android devices left on an old patch level are exposed to vulnerabilities fixed upstream months earlier.
Work profiles separate data without inspecting anything, so nothing stops a phishing link opened in the personal half of the device.
One limit applies to all of them, and it is the decisive one. None of these controls tells your security team anything. There is no alert, no console, and no record of what happened. Everything below exists to close that gap.
The layers, and who sells each
Each layer names the vendors that sell into it.
Device management: MDM and UEM
Management platforms enrol devices, apply configuration, distribute applications, enforce policy, separate company from personal data, and wipe company data remotely. Unified endpoint management extends the same model to laptops.
This is the foundation layer, and it is usually already in place. It is also the deployment path for much of what follows, because threat products are commonly distributed through it.
Management ends at administration. It verifies that a device is in a known good state, and it does not observe what happens on a device that is already in one.
Products in this layer include Microsoft Intune, Omnissa Workspace ONE UEM, Jamf Pro, Ivanti Neurons for MDM, SOTI MobiControl, IBM MaaS360, Scalefusion UEM, and Hexnode UEM.
The line between management and detection is the one buyers most often misread, and our comparison of MDM and MTD covers where each of them stops.
Mobile threat defence
Mobile threat defence products detect threats that device management cannot see, including on phones that are fully compliant and up to date, and they work at the device, application, and network levels.
Device-level detection covers the state of the operating system, including jailbreak and root detection, weak configurations, and unsupported releases. Application-level detection goes deeper on Android, where packages and permissions can be inspected, than on iOS, where visibility into other applications is limited to what a management platform reports. Network-level detection is where phishing is caught, because a malicious link resolves to a destination that can be blocked before the page loads.
A management platform tells you a phone is patched and configured to policy. It does not tell you the person holding it has just entered their credentials on a page registered an hour earlier. The device stays compliant throughout.
Corrata, Check Point, CrowdStrike, Ivanti, Jamf, Lookout, Microsoft, Pradeo, SentinelOne, and Zimperium all sell in this layer, each covered in more detail in our guide to mobile threat defense software.
Mobile data loss prevention and AI governance
This layer governs where company data goes once it is on a phone. The destinations that matter are consumer AI services, unsanctioned cloud storage, personal accounts in otherwise sanctioned applications, and the advertising and analytics infrastructure embedded in applications installed for other reasons.
Detection and data control are different problems. One asks whether something harmful is reaching the device; the other asks where information is leaving it. An employee pasting a client contract into a consumer AI service has not been attacked, and the data has still left the organisation.
The mobile version of this problem is harder, because the traffic does not traverse a corporate network and the applications are often on devices the organisation does not manage.
Two kinds of product address this, and they are not interchangeable. Mobile-native tools apply controls on the phone itself, and Corrata, for example, discovers and classifies AI applications across a fleet and blocks uploads to unapproved services.
Security service edge platforms such as Netskope and Zscaler apply comparable controls across a whole estate, which suits an organisation already running one rather than one solving a mobile problem.
DNS and web filtering
Filtering products block known-bad or policy-prohibited destinations, either by refusing to resolve a domain or by blocking the connection at a gateway. They are inexpensive and effective against threats that rely on reaching a known destination.
DNS filtering works on domain lookups, so a connection made directly to an IP address bypasses it, as does a lookup sent to an encrypted resolver that the filter does not control. It also works from lists, so it is weak against a domain registered an hour ago.
Cisco Umbrella, Cloudflare Gateway within Cloudflare One, and DNSFilter sell here, and filtering is bundled into several management platforms. On phones, each works through the vendor’s own client, so check which platforms that client supports.
Choosing by situation
The criteria below matter most when a particular problem is driving the purchase.
When phishing arrives by text, chat, and QR code
- Channel coverage: Establish which channels the product can see. A product that inspects only browser traffic will miss links opened inside a messaging app’s own in-app browser, so ask about each channel individually.
- Inspection method: A product filtering on domain lookups misses a connection made directly to an IP address.
- Where analysis runs and how fresh it is: Phishing infrastructure is short-lived, so ask what the product does with a destination it has never seen, and whether assessment happens on the device or in the vendor’s cloud.
- What happens after detection: Products vary between alerting the administrator, warning the user, and blocking the connection outright. Only the last of those prevents credential entry.
Two things remain out of reach of any product here. Voice social engineering that carries no link puts nothing in the traffic to inspect, and a QR code scanned with the native camera on an unprotected phone takes the user wherever it points.
When the fleet is BYOD or unmanaged
- The population is larger than it looks: Beyond personally owned devices, this group includes contractors, board members, seasonal staff, suppliers with system access, and employees who were offered enrolment and declined it. None of them appear in the enrolled device count.
- Deployment without management: Ask whether the product deploys to a device that is not enrolled. Apple restricts system-wide content filtering on iOS to supervised devices, and the per-app alternative needs the targeted apps installed through a management platform, so any product covering an unenrolled iPhone is reaching it another way.
- What is collected: Establish what telemetry leaves the phone and what an administrator sees in the console, asking both separately.
- Where data is processed and stored: Ask where processing happens, where data rests, and whether that is contractual or current practice.
- How much it interrupts the user: Software that prompts, warns, or slows the device gets uninstalled or worked around, whatever the detection is like. Ask what the employee experiences when nothing is wrong.
When you are building zero trust
- Identity provider integration: Posture only matters if it reaches the access decision, so establish which identity providers are supported and what the integration passes.
- Continuous against point-in-time: A check at enrolment and one at sign-in both leave a session running on a device whose state may have changed. Ask how often posture is re-evaluated.
- Coverage of unenrolled devices: An architecture that only evaluates enrolled devices has left out the devices that most need evaluating. Corrata Identity Gate allows access from personal devices only where Corrata is installed and the device has a good security score.
- Revocation: Establish what happens when a device fails, and whether existing sessions are terminated or only new ones refused.
- Output to the rest of the stack: Check what the product sends to your SIEM or XDR platform. Corrata integrates with SIEM platforms.
Conclusion
Mobile security software is a set of layers, each solving a different problem, and vendors describe them in language similar enough to make them look interchangeable.
Work out which question you need answered, identify the layer that answers it, and establish what your existing licensing already covers before buying anything, because several management platforms bundle filtering and several security suites include a mobile tier that may already be paid for but not yet deployed.
If mobile phishing and data loss on employee devices are your problems, you can request a demo to see how Corrata handles both.
