At Corrata we understand that not everyone is a mobile endpoint security expert. Sometimes, no doubt, we lapse into jargon. So to avoid unnecessary confusion below you’ll find our explanation of some key terms.
Key terminology
- Acceptable use policy
- Acceptable use policies are rules established by organisations around the type of content considered inappropriate to access on company-provided equipment.
- Accessibility permission
- In Android, a permission which, if granted to an application, allows it to read and override screens. Very commonly used within Android malware to allow adversaries to take control of a user’s device.
- Adversary-in-the-middle
- Also known as Man-in-the-middle attacks. Covers a range of different network attack techniques where a bad actor inserts themselves between a device and its intended destination in order to intercept communications and steal sensitive data.
- Agentic AI
- AI that reads, decides, and acts across apps and company systems to complete a task, using the access it has been given and with nobody reviewing each step. On a phone, an agent can read a mailbox, open a file, and upload it in under two seconds, which is why agentic AI security risks centre on what the software does once it has access.
- AI agent
- Software that uses an AI model to take actions on a user’s behalf, such as reading email, opening files, or moving data to an online service. On mobile, AI agents often run inside ordinary apps, such as keyboards, document scanners, transcription tools, and note apps, that call model APIs directly and never appear as AI apps on an inventory. For that reason, detecting AI agents on mobile depends on how an app behaves rather than how it is labelled.
- AI governance
- The set of policies, processes, roles, and controls an organisation uses to keep its AI systems safe, transparent, accountable, and aligned with business goals, from the decision to use AI through to a system’s retirement. On mobile, it includes knowing which AI services employees reach from their phones and tablets, which our AI governance guide covers in detail.
- Android package kit (APK)
- The file format used to distribute and install applications on Android devices.
- Antivirus
- Software designed to identify and, where possible, disable malware.
- Banking trojan
- Malware that waits for a banking or payment app to open, then draws a fake login screen over it to capture the credentials entered. Banking trojans are among the most common mobile malware and usually arrive through sideloaded apps or dropper apps that pass store review.
- Business email compromise (BEC)
- A fraud in which an attacker impersonates a colleague, executive, or supplier to persuade staff to move money, change payment details, or share sensitive information. BEC messages often contain no malicious link or attachment, so email filters rarely catch them, and AI-written scams have made them harder to spot.
- BYOD
- Bring your own device. Refers to the policy of allowing employee-owned devices to be used to access company applications.
- Certificate pinning
- Certificate pinning is used to ensure that the server to which your device connects is legitimate. Usually it involves storing within a mobile app information about the legitimate site’s TLS certificate.
- Cipher suites
- Cipher suites are sets of cryptographic algorithms that are used to secure network communications. A cipher suite is a combination of encryption, authentication, and key exchange algorithms that determine the level of security used to protect the communication.
- Command and control (C2)
- The servers attackers use to send instructions to compromised devices and receive stolen data. Blocking connections to command and control infrastructure cuts malware off from its operator, even while the malware remains on the device.
- Common vulnerabilities and exposures (CVE)
- A list of publicly disclosed cybersecurity vulnerabilities and exposures that have been identified by security researchers or vendors.
- Conditional access
- A security feature that allows organisations to control access to applications based on specified conditions or policies. For example, an organisation may require that any mobile devices accessing company applications have a high security score.
- Credential harvesting
- Collecting usernames, passwords, and other login details, usually through a fake login page reached from a phishing link. On mobile, the link may arrive by SMS, messaging app, social media, or QR code as well as by email.
- Dangerous permissions
- Android permissions that give an app powerful access that malware can abuse. They include accessibility services, notification listener access, device administrator rights, draw over other apps, installing unknown apps, location, and file access. Each has legitimate uses, so a request from an app with no clear need for it is a warning sign, as our guide to dangerous permissions explains.
- Data loss prevention (DLP)
- The technologies, policies, and processes used to stop confidential information being accessed, shared, or disclosed without authorisation. A DLP programme finds where sensitive data lives, classifies it, monitors how it moves, and blocks or flags risky activity. On phones and tablets, DLP has to work within much tighter operating system limits, as our guide to mobile DLP explains.
- Data sovereignty
- The principle that data generated in a jurisdiction should be governed by that jurisdiction’s law and held by organisations answerable to it. In practice, it depends on where a supplier is established and who owns it, as well as where data is hosted, because those factors decide which authorities can require access to the data.
- Deep packet inspection (DPI)
- A method of analysing network traffic beyond basic address and port information, using protocol details, metadata, and connection behaviour to identify threats. On-device deep packet inspection performs this analysis on the phone itself, so traffic is not routed through a cloud gateway.
- Deepfake
- Synthetic video, audio, or images generated by AI to impersonate a real person. Attackers use deepfakes to defeat identity checks and to make fraudulent requests, such as payment approvals, more convincing.
- Developer options
- A set of advanced settings in Android, which when enabled give access to, among other things, USB debugging.
- Device compromise
- Refers to a condition where the security of a device has been significantly undermined, meaning that the user can no longer rely on critical security features such as sandboxing and storage encryption.
- Device posture
- The security state of a device at a given moment, including its operating system version, configuration, integrity (for example, whether it is jailbroken or rooted), and any active threats. Posture is usually expressed as a risk level or score that feeds conditional access decisions.
- Device trust
- An approach in which only devices whose security has been verified can reach corporate applications and data. A device that fails the check, for example because it is compromised or running an outdated operating system, is blocked or limited until the issue is fixed, as described on our device trust page.
- DORA
- The Digital Operational Resilience Act, Regulation (EU) 2022/2554, which has applied to EU financial entities since 17 January 2025. It sets requirements for ICT risk management, incident reporting, resilience testing, and third-party risk, and it reaches any phone or tablet that accesses a financial entity’s systems or data, as our NIS2 and DORA guide explains.
- Endpoint detection and response (EDR)
- Security software for laptops, desktops, and servers that continuously records device activity, detects threats, and supports investigation and response. Desktop EDR relies on deep access to processes, files, and memory, which iOS and Android do not give third-party apps.
- EU AI Act
- Regulation (EU) 2024/1689, the EU’s risk-based law on artificial intelligence. It sets obligations according to the risk a system poses, from prohibited practices through to high-risk and transparency requirements, which apply in stages. It also reaches organisations outside the EU whose AI systems or outputs are used in the EU.
- Exploit
- Software which takes advantage of a vulnerability in an operating system or application to gain unauthorised access or perform malicious actions.
- Extended detection and response (XDR)
- An approach that correlates detections and telemetry across several security layers, such as endpoints, email, identity, network, and cloud, in a single platform. Mobile threat defence products can feed device signals into an XDR platform so phones are covered alongside other endpoints.
- GDPR
- The General Data Protection Regulation, the EU law governing how personal data is collected, used, stored, and transferred; a retained version, the UK GDPR, applies in the United Kingdom. Mobile security tools process personal data such as connection records and device information, so their design and data footprint matter for GDPR compliance.
- Infostealer
- Malware that harvests saved credentials, session cookies, authentication tokens, and cryptocurrency wallets, usually in a single pass. Because it captures live session tokens, an infostealer can let attackers bypass multi-factor authentication entirely.
- Install unknown apps
- An Android permission, granted app by app, that lets an app such as a browser or file manager install other apps from outside Google Play. It replaced the older global “unknown sources” setting and is required for sideloading.
- Jailbreaking
- Jailbreaking refers to the process of removing iOS’s built-in security features to gain root access to the device. Jailbreaking can allow users to install third-party applications or themes not available through the App Store. Once jailbroken, a device is highly vulnerable to malicious software.
- Malicious links
- Links on websites which lead to dangerous content such as malware downloads or phishing sites.
- Malicious website
- A website hosting content which is part of a cyberattack. This may be malware, or content designed to impersonate a legitimate site and lure the user into revealing sensitive information including passwords.
- Malware
- Any software written to damage, disrupt, or gain unauthorised access to a device or the data on it. The main types of malware include viruses, trojans, ransomware, spyware, and infostealers, and most mobile malware arrives disguised as a legitimate app.
- Mercenary spyware
- Highly targeted surveillance software developed by private companies and sold to government customers. Infection often requires no action from the target, and victims typically include journalists, activists, officials, and senior executives; Pegasus and Predator are well-known examples.
- Mobile application management (MAM)
- Controls that manage and protect corporate apps and the data inside them, rather than the whole device. MAM can restrict copying data between work and personal apps and remove corporate data selectively, which makes it common on personally owned phones.
- Mobile data loss prevention (mobile DLP)
- Data loss prevention applied to phones and tablets. iOS and Android withhold the operating system access that desktop DLP depends on, so mobile DLP usually works at the network layer, monitoring where data goes and how much moves without reading files.
- Mobile device management (MDM)
- Software IT uses to enrol phones and tablets, apply configuration and passcode rules, distribute apps and certificates, separate work and personal data, and lock or wipe lost devices. MDM administers devices but is not designed to detect attacks on them, and it only covers enrolled devices. Unified endpoint management (UEM) extends the same approach to laptops and desktops.
- Mobile endpoint detection and response (mobile EDR)
Continuous monitoring of phones and tablets for threats, with alerting, investigation, and automated response inside the security team’s existing workflow. iOS and Android restrict deep system access, so mobile EDR relies on network, app, configuration, and operating system integrity signals rather than the kernel-level telemetry that desktop EDR uses.
- Mobile endpoint management
The tools IT uses to enrol, configure, and control phones and tablets, including mobile device management (MDM) and unified endpoint management (UEM). It enforces policy and compliance rules but does not detect phishing, network attacks, or malicious apps.
- Mobile endpoint security
- The set of tools and controls that protect smartphones and tablets used for work, whether the company or an employee owns them. As our mobile endpoint security guide sets out, it usually spans three layers: mobile endpoint management, mobile threat defence, and mobile endpoint detection and response.
- Mobile malware
- Malicious software designed to harm users of phones and tablets through social engineering, unauthorised access to device features or data, or other illicit activity. Most arrives disguised as a legitimate app, and because sandboxing prevents file scanning, mobile malware detection relies on network and app signals instead.
- Mobile threat defence (MTD)
- Software that detects and blocks threats on iOS and Android devices at the device, app, and network layers, covering phishing, malicious apps, network attacks, and device compromise. It is also written as mobile threat defence and sometimes called mobile threat management or mobile threat protection. MTD usually runs alongside MDM and feeds device risk into conditional access, and our guide to mobile threat defense software compares the providers.
- Multi-factor authentication (MFA)
A login method that requires two or more independent factors, such as a password plus a one-time code, push approval, or biometric check. In many organisations the phone provides the second factor, which places it directly in the login path.
- NIS2
- The NIS2 Directive, Directive (EU) 2022/2555, the EU’s main cyber security law for essential and important entities in sectors such as energy, transport, health, banking, and digital infrastructure. It requires risk management measures including access control, asset management, multi-factor authentication, and incident reporting within set deadlines, and it makes senior management accountable for compliance.
- Overlay attack
- A technique in which a malicious app draws a fake screen over a legitimate app, such as a banking or single sign-on login, to capture what the user types. On Android, it typically abuses the draw over other apps or accessibility permissions.
- Passkey
- A sign-in credential based on public-key cryptography that replaces a password and is bound to the specific website or app it was created for. Because a passkey cannot be entered into a fake site, it resists phishing.
- Pegasus
- Spyware developed by Israeli surveillance-for-hire company NSO which has been implicated in the hacking of journalists, civil rights activists, politicians and other high-profile targets.
- Phishing
- An attempt to trick someone into revealing credentials, approving access, or installing malware by impersonating a trusted sender or website. On mobile, phishing arrives through SMS, messaging apps, social media, QR codes, and voice calls as well as email.
- Phishing-resistant MFA
- Multi-factor authentication that cannot be relayed or approved through a fake site, such as passkeys and hardware security keys. SMS codes and simple push approvals can be captured or socially engineered in real time, so they do not count as phishing-resistant.
- Predator
- Spyware developed by the Intellexa Group. Has been implicated in the surveillance of a range of high-profile individuals.
- Quishing
- Phishing delivered through a QR code. The malicious link is hidden inside an image that text-based filters cannot read, and the code is usually scanned with a phone camera outside any corporate control, as our QR code security guide explains.
- Remote access trojan (RAT)
- Malware that gives an attacker interactive control of a device, including reading files, capturing the screen, and switching on the camera or microphone. On mobile, remote access trojans usually arrive inside apps installed from outside the official stores.
- Robo texts
- Spam text messages often including phishing links. Also known as smishing texts.
- Rogue access point
- A Wi-Fi network set up or controlled by an attacker, often imitating a legitimate hotspot, so that traffic from connected devices can be intercepted or altered. Rogue access points are a common route for adversary-in-the-middle attacks.
- Rooting
- Equivalent to jailbreaking but for Android devices. It’s the process of bypassing the built-in security features of Android to gain root access to the device.
- Sandboxing
- A security feature on iOS and Android which ensures that, under normal circumstances, a mobile application will only have access to its own data and to system capabilities authorised by the operating system. Sandboxing is designed to prevent an application from accessing data or capabilities belonging to any other application.
- Security information and event management (SIEM)
- A platform that collects and correlates logs and security alerts from across an organisation’s systems so analysts can detect and investigate incidents. Sending mobile alerts to the SIEM lets security teams investigate phones alongside laptops and servers.
- Security operations centre (SOC)
- The team, in-house or outsourced, that monitors an organisation’s security alerts, investigates incidents, and coordinates the response.
- Session token theft
- Stealing the cookie or token a service issues after a successful login, so an attacker can reuse the authenticated session without the password or a second factor. Infostealers and adversary-in-the-middle phishing kits commonly use this technique.
- Shadow AI
- An AI agent acting on company data without the organisation’s knowledge or approval, using the employee’s own access to read, decide, and act across company systems. It extends shadow AI beyond an employee pasting content into an unapproved chatbot to software that moves data on its own.
- Sideloading
- The installation of mobile applications other than from an official app store such as Apple App Store or Google Play.
- Smishing
- Short for “SMS phishing.” Phishing delivered by text message, including SMS, RCS, and iMessage, usually with a link to a fake login page or a malicious download, as our guide to smishing explains.
- Social engineering
- Manipulating people into taking an action that benefits an attacker, such as clicking a link, sharing a code, installing an app, or approving a payment. Most phishing, and most mobile malware infections, begin with social engineering rather than a technical exploit.
- Social media phishing
- A phishing link which is delivered within a social media application such as Facebook, WhatsApp, or Linkedin.
- Spyware
- A type of malware specifically designed to steal sensitive data such as passwords, messages, photos, and other content from a device.
- Telemetry
- Data a security tool collects from a device and sends for analysis, such as connection records, app inventory, and configuration status. What telemetry a product gathers, and where it is processed, determines its privacy footprint on employee devices.
- TLS
- Transport layer security. The key internet protocol which provides end to end encryption between a device and the application it is connecting to.
- Unified endpoint management (UEM)
- A platform that manages phones, tablets, laptops, and desktops from a single console, extending mobile device management to every endpoint type. Examples include Microsoft Intune and Workspace ONE.
- Unmanaged device
- A phone, tablet, or computer that reaches company data without being enrolled in the organisation’s management platform, such as a contractor’s phone or a personal phone used for work email. IT has no view of its health unless another control, such as a mobile threat defence app, reports on it.
- Vishing
- Phishing carried out over a voice call, in which the attacker impersonates a bank, colleague, or service desk to obtain credentials or persuade the target to act. AI voice cloning has made vishing calls more convincing.
- Voice cloning
- Using AI to reproduce a specific person’s voice from a short sample of their speech. Fraudsters use cloned voices to create urgency or to pass telephone-based verification.
- Vulnerability
- A flaw in software which can be exploited by an attacker to gain unauthorised access to capabilities and data.
- Web filtering
- Web filtering is a technique for blocking access to risky or inappropriate content in accordance with an organisation’s security and acceptable use policies.
- Work profile
- A separate, managed space on an Android device that keeps work apps and data apart from the personal side. The organisation controls the work profile but cannot see personal apps, which protects employee privacy and also limits what security teams can observe.
- Zero trust
- An increasingly prevalent approach to cybersecurity that assumes that no user, device, or network should be automatically trusted. In a zero trust model, every access request is treated as potentially malicious and must be verified before being granted access to resources.
- Zero-click exploit
- An attack that compromises a device without any action from the user, typically through a flaw in software that processes incoming data, such as a messaging app. Zero-click exploits are expensive to develop and are mostly associated with mercenary spyware.
- Zero-day attack
- An attack which exploits a vulnerability that, at the time of the attack, was unknown to the vendor or the security community.
See Corrata on your own devices
A short call, a live look at the product, and a straight answer on whether it fits your estate.