You’ve locked down endpoints, hardened networks, and enforced strict mobile policies. So why are mobile threats still getting through?
If you’re a CISO, you have firewalls, EDR, MDM, zero-trust policies—the whole security playbook. Your organization might even operate in a Corporate-Owned Business-Only (COBO) environment, meaning you control the devices, the network, and the apps employees use.
So what’s left to secure?
MDM? Check? MTD? Check, check. Employees are still using approved apps that leak data, expose credentials and create backdoors, but most importantly they find ways around the restrictions to be productive, undermining their efforts to be secure.
CamScanner delivered malware inside enterprises and a simple Caller ID app leaked sensitive user data (more on each of these apps below).
It’s time to rethink what “secure” really means, because there’s still this unwavering trust that Mobile Device Management (MDM) and Mobile Threat Defense (MTD) is enough.
The False Sense of Security in Mobile
Every tap and swipe by your employees could expose sensitive corporate data to malware, phishing schemes, and data-hungry third-party SDKs. Yet, many organizations assume that if an app is available in the App Store or Google Play, it must be secure enough for business use.
Locked-down devices don’t mean locked-down security. Employees still interact with mobile apps daily, and not all of them are as secure as they seem.
If mobile app risks were fully covered at the platform level, why would 64% of security leaders feel they’re at significant or extreme risk from mobile device threats? (2024, Verizon Mobile Security Index)
- 51% of organizations have already faced incidents caused by malware or unpatched vulnerabilities.
- 85% say mobile threats have increased in the last year.
- 74% of popular mobile apps collect more data than necessary for their functionality.
- 67% of unwanted app installs come from app stores. (Arxiv Study, 2023)
- 160+ iOS vulnerabilities published in 2024.
- 50% of apps with five to ten million downloads include a security flaw.
These risks apply to enterprise-approved apps as well. The assumption that MDM-approved equates to secure—is dangerous.
Mobile Apps Leak Data—Even in a COBO Environment
Securing the mobile ecosystem isn’t about simply labeling apps as ‘good’ or ‘bad’—it’s about making informed, risk-based decisions. The widespread adoption of an app does not guarantee its security in a COBO environment.
Factors such as data access permissions, network behavior, and third party integration all play a role in determining whether an app aligns with an organization’s security framework.
Security teams often rely on outdated best practices:
- Check app store reviews before downloading.
- Only install from trusted developers.
- Block third-party app stores (sideloading apps).
These steps don’t address the real problem—apps that are:
- Overly-permissioned (requesting access to sensitive data they don’t need).
- Insecurely coded (exposing data to unauthorized third parties).
- Backdoored post-installation (via SDK updates that introduce hidden threats).
Many security teams assume that if an app doesn’t appear malicious, it must be safe. That’s exactly the kind of thinking that leads to breaches.
Let’s look at some real-world examples of how trusted apps can expose data by making it past Apple and Google’s app vetting process.
Real-world Enterprise-Approved Apps Gone Wrong
The Fitness App That Exposed Movement of World Leaders
The Strava fitness app—a widely used, well-reviewed application—exposed the locations and movements of US military personnel and Secret Service agents. By aggregating user data into a global heat map, it highlighted the exercise routes of individuals in sensitive locations, such as military bases, potentially compromising operational security.
If military leaders and government officials are unknowingly leaking sensitive data through approved apps, what’s stopping enterprise employees from doing the same?
- The app wasn’t malware.
- It didn’t need to be installed by attackers.
- It collected and shared user data in ways security teams didn’t anticipate.
The app wasn’t malicious. How many organizations evaluate these apps for unintended data exposure (leaky apps)?
The Productivity Apps that Harvest Credentials
Enterprise users trusted these productivity apps—until they became security liabilities. Mobile apps designed for productivity can inadvertently become vectors for credential theft and breaches, posing significant risks to enterprises.
A Popular Document Scanner Caught Delivering Malware
CamScanner, one of the most downloaded document scanning apps, was pulled from Google Play after researchers found it had a malicious module embedded through an advertising SDK.
The App That Leaked Sensitive User Data
Quokka researchers uncovered that the Who – Caller ID app was leaking sensitive PII into system logs, making it an easy target for attackers. If a simple caller ID app can leak data, imagine what an app handling scanned business contracts could do.
Concerns About Data Sales in Mobile Apps
Back in 2019, a Reddit user raised concerns about budgeting apps selling anonymized user data, emphasizing the need for transparency in how these apps handle and safeguard user information. Six years later, those concerns about data privacy and management remain just as relevant.
What Do Risky Apps Mean for COBO Environments?
If attackers can bypass security and find other ways to distribute malware through seemingly legitimate apps, what’s stopping a malicious app from entering your corporate environment?
Credential-based attacks are taking longer to uncover and resolve. Breaches caused by stolen credentials or malicious insiders now take an average of 292 and 287 days to identify and contain. That’s nearly 10 months of potential damage before action is taken—highlighting the urgent need for stronger security measures.
As malware grows, attackers are getting more sophisticated—blending malicious code into trusted apps.
“We Have EDR/XDR—Our Endpoints Are Covered.”
Typically, the first layer of defense in the multi-layered security infrastructure is EDR/XDR systems that focus on endpoint monitoring. However, mobile environments operate differently and require a dedicated layer of security—one purpose-built for the mobile ecosystem.
“We Have MDM—Why Isn’t That Enough??
Many security teams rely on Mobile Device Management (MDM) to lock down corporate devices, control app installations, and manage permissions on corporate devices. Although MDM is effective in these areas, it does not evaluate the actual risk or determine the malicious extent of an app’s behavior post-installation. MDMs do not detect malicious SDKs, especially those introduced after an app update. MDM controls app access, but it doesn’t verify what an app does once installed.
“We Use MTD—So We’re Covered, Right?”
Mobile Threat Defense (MTD) solutions are built to identify active threats on devices, such as malware or phishing attacks. However, these solutions don’t analyze apps directly on the device, as doing so would require significant resources.
Instead, apps are sent to a “lab” for inspection, which can delay security reports by as much as 48 hours. By the time teams discover their trusted productivity app is covertly working with other apps (app collusion) to transmit keystrokes or sensitive data to overseas servers (hello, credential theft!), the damage may already be done. MTD only alerts after an app is compromised—it doesn’t prevent risky apps from being installed in the first place
“I’m missing something…MAV”
Enter Mobile App Vetting (MAV) the missing piece in mobile security. Traditional tools focus on reactionary tactics and monitoring. MAV takes a proactive approach, analyzing apps before they ever reach an employee’s device.
MAV assesses apps for security vulnerabilities, risky behaviors, and compliance with corporate policies, ensuring only trusted apps are allowed within the organization’s environment.
A purpose-built MAV solution leverages machine learning-driven detection engines to:
- Identifies unknown malware before it executes.
- Detects hidden malicious behaviors often overlooked in traditional scans.
- Maps malicious characteristics, so security teams don’t waste time deciphering red, yellow, and green indicators—they get clear, actionable intelligence.
Without MAV, organizations lack full visibility into the risks apps introduce. With MAV, they gain deeper insight and control over mobile security threats.
Quokka’s Q-scout brings effortless Mobile App Vetting (MAV) to your workflow, ideal for businesses handling sensitive customer data, financial records, or proprietary assets. Q-scout automated solution scans, analyzes, and delivers clear, actionable insights—empowering you with the same comprehensive reports trusted by the CISA MAV program. Make informed decisions with confidence.
- Instant Risk Assessments: Know immediately whether an app is safe or dangerous. No guesswork.
- Automated Compliance & Reporting: Generate proof to justify blocked apps and support reciprocity.
- Deep Threat Analysis: Detects malware, excessive permissions, and risky third-party code before deployment.
- Enterprise-Ready Scalability: Vet thousands of apps without slowing down business operations.
Start your Mobile App Vetting (MAV) assessment today. Contact us for a free app risk assessment on an app of your choice.
