Mobile Attack Surface Expands as Enterprises Lose Control

Why It Matters

Outdated devices and vulnerable apps give attackers a direct path to corporate data, forcing enterprises to overhaul mobile governance or face costly breaches. The report highlights a pressing need for unified, proactive mobile security strategies.

Key Takeaways

• 53% devices run critically outdated OS
• 86% of top 135 apps have known flaws
• One in 850 devices jail‑broken, raising breach risk
• Zero‑click iOS CVEs scored 10.0 severity in 2025
• Shadow AI silently infiltrates third‑party mobile apps

Pulse Analysis

Enterprises are increasingly dependent on smartphones and tablets for frontline operations, from clinicians documenting patient records to pilots checking flight plans. This shift has turned mobile devices into high‑value data repositories, effectively extending the corporate perimeter to every pocket. As operating systems evolve to mirror desktop capabilities, the line between personal and corporate data blurs, amplifying the potential impact of a single compromised handset. Organizations that treat mobile assets as an afterthought risk exposing sensitive information across multiple industry verticals.

Jamf’s analysis of 1.7 million devices paints a stark picture: more than half run critically outdated operating systems, and a staggering 86% of popular business apps harbor known security flaws. The emergence of Shadow AI—undetectable code that rides within third‑party applications—adds a stealthy layer of risk that traditional antivirus tools often miss. Coupled with a surge in zero‑click exploits, such as CVE‑2025‑43300 and CVE‑2025‑24201, attackers can gain footholds without user interaction, targeting executives and journalists alike. These trends demonstrate that mobile threats are no longer peripheral but central to an organization’s overall risk profile.

To mitigate this expanding attack surface, firms must adopt a holistic mobile‑first security framework. Continuous inventory of all devices, automated patch deployment, and stringent app vetting are foundational steps. Leveraging mobile device management (MDM) platforms with zero‑trust controls can enforce policy compliance in real time, while AI‑driven anomaly detection helps surface hidden Shadow AI activities. By integrating these measures into broader cybersecurity programs, enterprises can shift from reactive firefighting to proactive defense, safeguarding both data and reputation in an increasingly mobile world.