Lookout Mobile Endpoint Security

Detects novel mobile threats using behavioral heuristics and ML models without requiring known signatures, relevant for targeted attacks against specific organizations.

Detects device integrity compromise (jailbroken iOS and rooted Android), and can enforce conditional access policy or quarantine the device via MDM/UEM integration.

Checks each device for outdated OS versions, missing security patches, risky system parameters, and insecure configuration, flagging the vulnerabilities and misconfigurations that raise device risk.

Intercepts and evaluates URLs in SMS, email clients, messaging apps, and browsers, blocking malicious links regardless of which app the user opens them in.

Identifies connection to malicious or impersonation Wi-Fi networks (including captive portal attacks and SSLstrip-capable access points), and can block connection or alert the user.

Integrates with Jamf, Microsoft Intune, VMware Workspace ONE, and other UEM platforms to trigger automated response actions (wipe, quarantine, access revocation) upon threat detection.

Runs threat detection locally on the device for off-network protection and privacy, with optional cloud-assisted analysis where policy allows.

Analyzes installed application binaries for malicious behavior, excessive permission requests, data exfiltration patterns, and policy violations beyond what app store review catches.

Triggers automated remediation actions via MDM/UEM API (device quarantine, selective wipe, access policy enforcement) upon confirmed threat detection.

Provides detection, behavioral analysis, and response across iOS and Android from one console, with platform coverage depth varying by product.

Reconstructs compromised-device activity by assembling process, network, and app events into an incident timeline analysts can review.

Uses Android kernel interfaces (inotify, netlink, SELinux audit), for deep system visibility, enabling detection of sophisticated malware that evades user-space analysis.

Performs threat detection using an on-device model without requiring all telemetry to be sent to cloud infrastructure, relevant for regulated environments and privacy-sensitive deployments.