Endpoint security for mobile devices means managing and protecting phones and tablets that touch company data: enrolling and configuring them, checking apps before and after they run, detecting threats on the device, and limiting access when a device is unsafe. NIST SP 800-124 Revision 2 describes these building blocks and how to choose among them.
Why are mobile devices their own problem?
NIST's guidance observes that mobile devices began as personal consumer communication devices but are now permanent fixtures in enterprises, used to reach modern networks and process sensitive data. Its scope includes organization-provided and personally owned devices, centralized device management and endpoint protection technologies, and recommendations for deployment, use and disposal across the device lifecycle. So the question is never only "which product", it is "which devices, owned by whom, doing what".
What are the main building blocks?
NIST describes several technologies, and says most organizations will not need all of them.
Enterprise mobility management, sometimes called unified endpoint management, is a solution to deploy, configure and actively manage mobile devices. A suite may include mobile device management, mobile application management, mobile threat defense and other tools, and relies on the management interfaces built into the platforms to monitor devices, deploy policies and configure device side security technologies such as secure containers.
Mobile threat defense systems are designed to detect malicious apps, network based attacks, phishing attacks, improper configurations and known vulnerabilities in apps or the operating system. They often run an agent on the device, give continuous monitoring of apps during runtime, and reside on the device so they can work even if network connectivity is blocked or compromised. In an enterprise they may integrate with management to notify users or administrators, or to remediate vulnerabilities and quarantine apps or devices.
Mobile app vetting aims to detect software or configuration flaws that could create vulnerabilities or violate security or privacy policies. NIST says it is commonly used before an app is deployed, unlike threat defense, which can analyze apps already downloaded and installed. It also covers apps that users install outside of management, and recognizes that flaws may be mistakes by app developers, OS developers or administrators, or intentional malicious functionality.
What goes wrong most often?
Mismatched assumptions. A company enrolls corporate phones and leaves personal phones out, and then someone reads email on a personal phone. NIST also points out that connecting an improperly configured device to an enterprise resource such as a file share could expose information to entities monitoring the network or improperly accessing the device. Configuration matters inside apps too: authentication to the app, tracking users and the proper use of encryption.
A constructed example
A 200 person company lets employees use their own phones for email and chat. It decides on three tiers. Company owned phones are fully enrolled with a device policy, an app allow list and threat defense. Personal phones are allowed through a managed app container with a screen lock requirement and no local file storage. Anything else gets browser access only, with no downloads. A lost phone is handled by removing the managed container remotely, which leaves the user's photos alone. Nobody argues about whether the company may see personal messages, because the design never needed to.
How to check or apply this
- List the device types and owners that reach company data, including personal phones.
- Decide a tier for each, with what is required and what access results.
- Require a screen lock, current operating system and encryption as a baseline.
- Choose management tools for the controls you actually need, using NIST SP 800-124r2 section structure as the menu.
- Vet apps you build or approve for security and privacy flaws before deploying them.
- Consider threat defense where phishing and malicious apps are a real risk for your staff.
- Make access decisions depend on device state, so a jailbroken or outdated device loses access.
- Plan the full lifecycle: enrollment, loss, offboarding and disposal.
If your company builds mobile apps, Safeguard's dependency scanning can check the code and libraries you ship. It does not provide mobile device management or threat defense.
Quick check
Is mobile threat defense the same as mobile device management?
No. Management configures and controls devices. Threat defense detects malicious apps, network attacks, phishing and misconfigurations. NIST describes them as separate, often integrated, technologies.
Do personal devices fall under NIST SP 800-124r2?
Yes. The guidance covers both organization-provided and personally owned deployment scenarios.
Sources
- NIST SP 800-124 Rev. 2: Guidelines for Managing the Security of Mobile Devices in the Enterprise
- NIST SP 800-124 Rev. 2 full text (PDF)
Last reviewed: 18 October 2026.
