Mobile Threat Defense

How it works

An MTD agent watches three layers. At the app level, it scans installed packages against known malware signatures and flags risky behaviors such as an app requesting accessibility permissions it doesn't need. At the network level, it checks the Wi-Fi the device connects to for man-in-the-middle setups, SSL stripping and captive portals that impersonate a known network. At the OS level, it looks for exploitation attempts, outdated patch levels and integrity failures like a jailbreak.

Phishing detection is the feature most teams end up valuing. The agent inspects URLs opened from SMS, messaging apps and email before the browser loads them, and blocks pages that match known phishing infrastructure. Given that roughly 80% of phishing sites now render correctly on mobile, according to Zimperium's 2024 threat report, that's where the exposure is.

The main products are Lookout, Zimperium, Check Point Harmony Mobile, Microsoft Defender for Endpoint and CrowdStrike Falcon for Mobile. Each publishes a risk score per device, and that score is what an MDM consumes.

Why it matters for a fleet

An MDM tells a device what it may do. It doesn't know whether the device is under attack right now. If a user taps a phishing link in WhatsApp and enters their Microsoft 365 password, the MDM sees a compliant device with a valid passcode and up-to-date OS. Nothing looks wrong.

That gap matters more as phones become the primary way people authenticate. Push-based MFA, authenticator apps and passkeys all live on the phone. Compromise the phone and you've compromised the identity layer.

NIS2 makes this concrete for regulated sectors. Article 21 of directive 2022/2555 requires risk management measures that cover endpoints, and a mobile device with no threat detection is hard to defend in an audit. You don't necessarily need MTD on every device, but you'll want it on the ones that carry privileged accounts or customer data.

How Appaloosa handles it

Appaloosa doesn't try to replace an MTD vendor. It deploys the MTD agent to the fleet like any other managed app, pre-configured with your tenant settings so the user doesn't have to sign in or enable anything. Once the agent is running, Appaloosa enforces the outcome: a device flagged as high risk can be blocked from managed apps or selectively wiped through the same compliance rules you use for jailbreak or missing passcodes.

Everything stays in one console. The device inventory of your MDM platform shows whether the MTD agent is installed and active, so you can spot the 3% of devices where the user uninstalled it before an auditor does.