Uncover hidden threats in your mobile apps: Lookout MSEC exposes security risks. Post Views: 9 Mobile devices introduce critical security challenges as they function outside conventional security perimeters, operating beyond the visibility of enterprise security teams. The security challenges of mobile devices. While organizations may track the applications installed on these devices, they often lack insight into the underlying components, dependencies, and vulnerabilities embedded within those apps. Understanding the WolfSSL vulnerability. The WolfSSL example. Jim Dolce, CEO of Lookout, highlighted this issue through the example of WolfSSL, a lightweight SSL/TLS library designed for memory-constrained devices. Used in over a billion devices, including banking applications, WolfSSL recently revealed a critical vulnerability. Exploitation of this flaw could enable attackers to impersonate financial institutions and steal user credentials during transactions. The Mythos Glasswing project identified and disclosed this vulnerability, underscoring the risks posed by third-party libraries. Introducing Lookout's Mobile Security Exposure Center (MSEC). Lookout's Mobile Security Exposure Center (MSEC) addresses this gap by providing comprehensive visibility into an organization's mobile device ecosystem. The system scans all devices, identifies installed applications, and generates a proprietary software bill of materials (SBOM) for each app's binary. This SBOM maps every component and dependency, cross-referencing them against vulnerability databases such as the CISA Known Exploited Vulnerabilities (KEV) catalog. Proactive risk mitigation. By correlating app components with known vulnerabilities, MSEC enables security teams to pinpoint risks and take targeted remediation actions. For instance, the system can identify which devices use WolfSSL, the specific app versions, and the associated users. This data feeds into the organization's Cybersecurity Threat Exposure Management (CTEM) framework, allowing for proactive mitigation. Expanding Capabilities with AI and SBOM Analysis. Dolce emphasized that MSEC's approach shifts focus from reactive management to proactive exposure reduction, ensuring organizations address risks before they are exploited. The solution also integrates with Lookout's AI Visibility & Governance product, which tracks AI adoption across enterprises. While AI Visibility & Governance focuses on usage patterns, MSEC delves into the software composition and risk profiles of applications. Together, these tools create a holistic view of application security, bridging gaps in traditional risk assessment. Limitations and future plans. However, MSEC's reliance on existing vulnerability databases like KEV presents limitations. These repositories only include known flaws, leaving organizations vulnerable to newly discovered threats. Dolce acknowledged this challenge, noting that attackers could leverage advanced AI models, such as frontier AI systems, to identify and exploit unknown vulnerabilities. Lookout plans to counter this by adopting similar AI technologies defensively. Staying ahead of evolving threats. By analyzing SBOMs with frontier AI models, the company aims to detect previously unidentified vulnerabilities and expand its threat detection capabilities. The process begins with inventorying all mobile applications, generating accurate SBOMs, and correlating components with known vulnerabilities. The next phase involves using AI-driven analysis to uncover hidden risks. Dolce stated that this iterative approach will enable organizations to stay ahead of evolving threats, combining traditional vulnerability management with cutting-edge AI techniques. The future of application risk management. This initiative reflects a broader industry shift toward comprehensive application risk management. As mobile ecosystems grow more complex, tools like MSEC are critical for ensuring transparency, accountability, and resilience against emerging cyber threats.

A study by Lookout and ZK Research reveals that 93% of security executives are overconfident about their AI governance capabilities, whilst 59% of mobile AI traffic flows undetected through corporate networks. The research exposes a critical blind spot as 67% of generative AI usage now occurs on mobile devices, bypassing traditional security controls. Despite organisations spending 18% of their security budgets on AI compliance, 66% cannot track autonomous AI agent workflows and 72% cannot audit AI software development kits embedded in mobile applications. Additionally, 71% of organisations investigated data leaks involving generative AI tools in the past year, whilst 68% cannot produce audit evidence required by regulations like the EU AI Act. Lookout has launched AI Visibility & Governance to address these gaps through mobile-native security architecture operating directly on devices.

Lookout launches mobile-native tool to expose shadow AI on enterprise devices. Cybersecurity company Lookout Inc. today announced the launch of Lookout AI Visibility & Governance, a new mobile-native solution designed to provide organizations with the visibility needed to discover, govern and secure artificial intelligence adoption across their mobile ecosystem. The new offering provides a missing layer of visibility that allows organizations to identify shadow AI activity on mobile devices, detect unauthorized agent behavior and enforce policy where traditional controls have no reach. Lookout AI Visibility & Governance delivers a real-time view of an organization's AI footprint by identifying sanctioned and unsanctioned AI use on mobile devices and, in doing so, exposes activity that Lookout says traditional endpoint and cloud-centric discovery tools cannot detect. The solution, offered as part of Lookout's mobile security platform, provides actionable, evidence-based visibility to enforce policy, reduce risk and maintain control over AI usage across the mobile domain. "AI adoption is accelerating faster than most organizations can see or control, especially on mobile, where AI activity often operates outside traditional corporate boundaries and remains largely invisible," said Chief Executive Jim Dolce. "With the launch of Lookout AI Visibility & Governance, we're closing that gap, giving organizations the ability to see, understand and govern AI usage at the mobile layer, bringing mobile AI activity out of the shadows into full visibility and control." Key features and benefits include comprehensive AI app discovery and shadow AI visibility. Users can obtain a real-time inventory of all AI apps, whether they be sanctioned and unsanctioned, across corporate and bring-your-own devices, exposing hidden shadow AI and turning mobile risks into governed assets. Agentic behavior monitoring continuously analyzes AI-driven behavior and maps permissions to ensure autonomous agents do not execute unauthorized workflows or access sensitive enterprise data. There's also intelligent data guardrails and policy enforcement prevent sensitive data from reaching unsanctioned AI services with real-time controls that stop unauthorized access and exfiltration. Lookout AI Visibility & Governance also offers users automated compliance alignment. The offering can generate audit-ready evidence aligned to the European Union's Artificial Intelligence Act, the U.S. National Institute of Standards and Technology's AI Risk Management Framework and the international standard ISO/IEC 42001 to deliver the traceability required for effective AI risk management and regulatory compliance. Lookout says that the new solution acts as a strategic force multiplier across its mobile security platform, extending protection from the device to the AI activity occurring on it. It strengthens layered defense to secure not only devices and users but also the AI-driven interactions that operate on their behalf. Image: siliconangle/ideogram. A message from John Furrier, co-founder of SiliconANGLE: Support its mission to keep content open and free by engaging with theCUBE community. Join theCUBE's Alumni Trust Network, where technology leaders connect, share intelligence and create opportunities. * 15M+ viewers of theCUBE videos, powering conversations across AI, cloud, cybersecurity and more * 11.4k+ theCUBE alumni - Connect with more than 11,400 tech and business leaders shaping the future through a unique trusted-based network. About SiliconANGLE Media SiliconANGLE Media is a recognized leader in digital media innovation, uniting breakthrough technology, strategic insights and real-time audience engagement. As the parent company of SiliconANGLE, theCUBE Network, theCUBE Research, CUBE365, theCUBE AI and theCUBE SuperStudios - with flagship locations in Silicon Valley and the New York Stock Exchange - SiliconANGLE Media operates at the intersection of media, technology and AI. Founded by tech visionaries John Furrier and Dave Vellante, SiliconANGLE Media has built a dynamic ecosystem of industry-leading digital media brands that reach 15+ million elite tech professionals. Its new proprietary theCUBE AI Video Cloud is breaking ground in audience interaction, leveraging theCUBEai.com neural network to help technology companies make data-driven decisions and stay at the forefront of industry conversations.