Your office antivirus doesn't cover the phones.

What it is

Mobile threat defence sits on each device and watches for the things that actually catch people out: a convincing text message with a link, a fake login page, an app that asks for more than it should, or a café Wi-Fi network that isn't what it claims to be.

It runs quietly, blocks what's dangerous, and tells you when it does. Staff notice it roughly never, which is the point — security that gets in the way is security that gets turned off.

Who it suits

If your staff read work email on their phones, this applies to you. It matters more if you hold client, patient or pupil data, and more again if you're in a regulated sector or bidding for work where security questions come up.

A lot of our conversations about this start with an insurance renewal or a tender document rather than an incident, which is the better order to do it in.

Why phones specifically

Attacks aimed at mobiles work because the screen is small and people are distracted. A shortened link looks the same as any other. A login page missing its usual branding is harder to spot at arm's length on a Tuesday morning.

The other reason is that phones move between networks constantly — office Wi-Fi, home broadband, a hotel, a client's guest network. Each one is a different risk, and none of them are yours to control.

This isn't a substitute for training people. The most effective thing you can do costs nothing: tell your team that you will never text them asking for a password or a payment. Software catches what slips past that.