The Hidden Vulnerabilities of Mobile Security

This article from Directors & Boards was first published on September 16, 2026. The article is also available at: https://www.directorsandboards.com/articles/the-hidden-vulnerabilities-in-mobile-security/

Having previously served as the director for cyber incident response at the U.S. National Security Council at the White House, Anthony J. Ferrante helped to manage the Vulnerabilities Equities Process (“VEP”).¹ In this role, Ferrante worked across the U.S. government to determine if zero-day vulnerabilities should be disclosed for patching or kept secret for intelligence and law enforcement agencies to keep in their offensive arsenal. Some of these vulnerabilities involved mobile malware. Ferrante witnessed firsthand the power of these attacks to gain persistent, undetected access to personal and corporate data.

Across the spectrum, from large enterprises to early-stage startups, the mobile threat landscape has fundamentally changed. The conventional wisdom that smartphones are inherently more secure than laptops and desktops because of built-in protections, controlled ecosystems, and hardware-embedded security features, is no longer true. Through highly effective mobile malware attacks, threat actors have shifted their focus to smartphones because of their deep access to organizational and personal information, thus changing the risk landscape.

Mobile malware is malicious software created to compromise devices such as smartphones and tablets, often without knowledge from the targeted individual. Designed to steal information, gain control of the device, or monitor activity, mobile malware presents significant risk to directors and boards due to their access to company information including sensitive client relationships, proprietary and nonpublic deal information or market-moving regulatory data. Directors and members of boards face a particularly specialized threat landscape due to the high-profile nature of their positions. In addition, they often are not direct employees and may fall outside of normal corporate security functions, including management of personal devices.

While the threat of mobile malware has existed for years, capabilities are increasingly accessible to less sophisticated threat actors, increasing the need for robust detection and response capabilities on mobile devices. The commoditization of mobile malware means attacks now extend well beyond high-profile executives and public figures who were traditionally targeted to all corporate boards, directors, and company leaders. Publicly available reporting shows multiple chairman and director-level phone numbers included in targets lists, such as in the Pegasus Project, published in 2021.²

This change requires an urgent reassessment of mobile device security, including personal devices under “bring your own device” (“BYOD”) programs. Boards play a crucial role in both protecting their own devices and ensuring their organization has adequate mobile device security policies in place.

Current Research Points to a Changing Landscape

FTI Consulting has previously detailed how mobile devices are prime targets for threat actors and shared insights into the techniques being leveraged in the wild.³ Over the past year, we have observed a significant rise in sophisticated mobile malware targeting and surveilling industry executives and high-profile individuals. This direct experience with clients supports the evidence collected by independent security researchers: A far greater percentage of devices are under active compromise at any given time than previously thought, and the profile of those targeted was broad across multiple industries and roles.⁴

This is the result of multiple factors:

Commoditization. Recent revelations regarding commercial spyware tools illustrate how nation-state-grade spyware has become increasingly commoditized, transforming zero-click exploit chains — a sequence of attacks that compromise a device without requiring user interaction — from tailored, sophisticated operations into off-the-shelf products available for purchase worldwide.^{5, 6}

Target economics. With the ongoing commoditization of mobile spyware, threat actors have expanded their targeting beyond those close to political power to those with financial, competitive or legal consequences. For example, a board member may have advanced knowledge of a major layoff or change in strategy, visibility into security weaknesses, or inside knowledge of major litigation. While threat actors have always understood the financial and reputational value of such information, the barriers to obtaining it through mobile device compromise have never been lower.

Speed of AI. Beyond the hype, research and reporting regarding emerging AI capabilities points to a clear and likely consequence: a significant increase in the volume of software vulnerabilities discovered in both new and legacy systems.⁷ More vulnerabilities in a faster time frame will put pressure on patch life cycles and allow more opportunity for exploit development, which will only further the commoditization of mobile spyware.

Mobile devices are a clear avenue for threat actors seeking sensitive and proprietary insider information. The mobile device of the board member or director will contain information highly valuable to the financial or reputational performance of the organization, its customers and its partners.

The Failure of Traditional Defenses

Traditional controls were not created to defend against this elevated threat landscape, and boards have a responsibility to understand these new trends and how their organizations are mitigating these risks. Mobile device protection in an enterprise setting generally includes a basic set of controls, but these are no longer completely effective against sophisticated mobile malware:

Version updates. The number one recommendation is to keep your device up to date. However, with the speed of AI quickening vulnerability discovery, patching cycles will fall further behind threat actors’ abilities to develop exploits and commoditize them into usable vectors. More access points mean more opportunities for mobile malware to be deployed.
Mobile device management (“MDM”). MDM allows enterprises to exert control over devices, such as initiating a remote wipe or disabling access. While MDM solutions can identify unauthorized or outdated applications, they lack the comprehensive monitoring and detection capabilities needed to detect mobile malware that is often designed to remain hidden. Mobile devices typically run on a single MDM application, while other endpoints, like laptops and desktops, have multiple layers of security tools installed.
Lockdown mode. This puts mobile devices into a more secure state by disabling features that are most likely to be exploited by spyware, such as preventing applications from interfacing with each other or being able to access the file system. Lockdown modes can be effective for users facing immediate, known threats, but are not long-term solutions, as the device becomes vulnerable to mobile malware once returned to its non-lockdown state.
Forensic analysis. Traditional MDM solutions are not prepared to identify advanced mobile spyware because it does not behave like conventional malware. It is purpose-built for persistence and evasion, leaving few artifacts visible to conventional solutions. Forensic analysis is required for an effective investigation and root-cause analysis but is resource-intensive and only backwards-looking, thus not making it a scalable solution for proactive threat prevention and monitoring.

Recalibrating Proactive Defense Across the Organization

In response to the threat of mobile malware, boards and directors need to ensure their security teams are evolving protections to keep pace with emerging mobile device threats. Tackling this challenge should involve working directly with experts to develop an effective response and applying the same rigor to all mobile devices, from executives to staff at every level, and to corporate network infrastructures and endpoints. Realistic and proactive defenses boards and directors should prioritize include:

Mobile threat detection. Implement the same caliber detection and response tooling for mobile devices as for traditional endpoints. Modern mobile threat-detection tools offer proactive monitoring, in-depth telemetry and introspection, and periodic forensic assessment, which operate independently of device manufacturer alerts or platform notifications that may never materialize.
Data access control. Limiting access to data minimizes the impact should a compromise occur. This requires ongoing cybersecurity hygiene and effective policy that prevents users from hoarding access to sensitive information or storing information locally on their devices.
Communications planning. Being clear on how sensitive information will be shared, such as who is working on particular deals, what communication channels will be used, who will be read in and what information will be disseminated, helps control the overall spread of information that a threat actor can access through mobile malware.
Include mobile in tabletops. Organizations can reduce the impact of potential incidents by practicing specific exercises that assume compromise of sensitive mobile devices. These exercises will help organizations identify specific controls they need to implement to reduce their direct attack surface.

Practical Ways for Boards and Directors to Protect Their Own Devices

As prime targets for mobile device attacks, boards and directors also have a responsibility to protect their own personal and work devices. Personal cybersecurity steps every board member and director should implement to mitigate their risk of mobile malware include:

Turning mobile devices off and back on at least once per day
Staying up-to-date on operating systems updates and patches
Avoiding the use of unverified applications
Evaluating messaging applications and considering using secure and encrypted enclaves where possible
Using advanced mobile threat detection solutions on devices

Advanced mobile threat detection and response solutions are gaining traction and should be an area of focus for boards. Organizations should ensure that, for both corporate-provided and BYOD devices, mobile threat detection tools are deployed effectively and mobile devices face the same compliance obligations as traditional endpoints before access to corporate data is granted. Mobile security must be approached with the utmost and proactive urgency. Otherwise, our most sensitive corporate data will remain vulnerable, with damaging implications.

Reprinted with permission of MLR Media.

Footnotes:

1: “Vulnerabilities Equities Policy and Process for the United States Government,” Unclassified (November 15, 2017).

2: “About the Pegasus Project,” Forbidden Stories (July 18, 2021).

3: David Youssef, “Threat Actors See Bigger Return for Smaller Devices: The Growing Threat of Mobile Malware” , FTI Consulting (November 5, 2025).

4: iVerify, "iVerify Uncovers Evidence of Zero-Click Mobile Exploitation in the U.S.," (June 5, 2025).

5: “Triple Threat: NSO Group’s Pegasus Spyware Returns in 2022 with a Trio of iOS 15 and iOS 16 Zero-Click Exploit Chains,” (2022).

6: Google Threat Intelligence Group, “Sanctioned but Still Spying: Intellexa’s Prolific Zero-Day Exploits Continue,” Google Cloud (December 3, 2025).

7: Ravie Lakshmanan, “Anthropic’s Claude Mythos Finds Thousands of Zero-Day Flaws Across Major Systems,” The Hacker News (April 8, 2026).

The views expressed herein are those of the author(s) and not necessarily the views of FTI Consulting, Inc., its management, its subsidiaries, its affiliates, or its other professionals.

Related Insights

Related Information

Published

November 09, 2026

Key Contacts

Anthony J. Ferrante

Senior Managing Director, Global Head of Cybersecurity

Matt McManus

Managing Director