Lookout Mobile Endpoint Security

Analyzes installed application binaries for malicious behavior, excessive permission requests, data exfiltration patterns, and policy violations beyond what app store review catches.

Detects device integrity compromise (jailbroken iOS and rooted Android), and can enforce conditional access policy or quarantine the device via MDM/UEM integration.

Runs threat detection locally on the device for off-network protection and privacy, with optional cloud-assisted analysis where policy allows.

Intercepts and evaluates URLs in SMS, email clients, messaging apps, and browsers, blocking malicious links regardless of which app the user opens them in.

Identifies connection to malicious or impersonation Wi-Fi networks (including captive portal attacks and SSLstrip-capable access points), and can block connection or alert the user.

Integrates with Jamf, Microsoft Intune, VMware Workspace ONE, and other UEM platforms to trigger automated response actions (wipe, quarantine, access revocation) upon threat detection.

Detects novel mobile threats using behavioral heuristics and ML models without requiring known signatures, relevant for targeted attacks against specific organizations.

Checks each device for outdated OS versions, missing security patches, risky system parameters, and insecure configuration, flagging the vulnerabilities and misconfigurations that raise device risk.

Provides detection, behavioral analysis, and response across iOS and Android from one console, with platform coverage depth varying by product.

Performs threat detection using an on-device model without requiring all telemetry to be sent to cloud infrastructure, relevant for regulated environments and privacy-sensitive deployments.

Triggers automated remediation actions via MDM/UEM API (device quarantine, selective wipe, access policy enforcement) upon confirmed threat detection.

Uses Android kernel interfaces (inotify, netlink, SELinux audit), for deep system visibility, enabling detection of sophisticated malware that evades user-space analysis.

Reconstructs compromised-device activity by assembling process, network, and app events into an incident timeline analysts can review.