Your Mobile Fleet Has a Blind Spot
Mobile devices are the one corner of the enterprise where security teams are perpetually flying blind. They sit outside the corporate perimeter, beyond the reach of traditional monitoring tools. You might know what apps are installed on an employee’s phone. But do you know what’s actually inside those apps?
Usually not. And that’s a problem.
Lookout’s CEO Jim Dolce illustrates the issue with a stark example: WolfSSL. It’s a compact, portable SSL/TLS library written in ANSI C, designed for devices with limited memory. It runs on over a billion devices worldwide. “If you have a banking app on a mobile device for online banking, that app is likely using WolfSSL,” Dolce says. “It has a very serious vulnerability. If exploited by a bad actor, it can mimic your bank, and when you put in your credentials, it will steal your banking credentials.”
The Mythos Glasswing project discovered and publicized that WolfSSL flaw. So the bad guys know the app may be vulnerable. Does your security team know an employee is using it? Almost certainly not.
Enter the Mobile Security Exposure Center
Lookout’s answer is a new platform called the Mobile Security Exposure Center (MSEC). It’s designed to give security teams full visibility into the software components buried inside their organization’s mobile apps.
Here’s how it works: MSEC scans every device in the fleet to catalog which apps are present. Then it creates a proprietary software bill of materials (SBOM) directly from the binary of each app. That SBOM reveals every component and dependency inside the app, which MSEC then cross-references against known vulnerability databases, including CISA’s Known Exploited Vulnerabilities (KEV) catalog.
The findings feed into the organization’s existing threat and exposure management (CTEM) workflows, so security teams can act on the data rather than just stare at another dashboard.
“The system will identify which apps use WolfSSL, the version of that app, the user and the device that is using that app, and all of that information then can be used to remediate the exposure,” Dolce explains. “MSEC basically identifies the exposure and provides that information.”
More Than Just an Inventory Tool
MSEC also complements Lookout’s existing AI Visibility & Governance product. While that tool helps organizations understand AI adoption across the enterprise, MSEC reveals the software composition and exposure profile of those applications. Together, they offer a more complete picture of application risk, security, and governance.
Lookout frames the shift as moving “from reactive application management to proactive exposure management.” It’s a meaningful distinction. Instead of waiting for a vulnerability to be exploited and then scrambling to respond, security teams can identify risky components before they become a problem.
The Known Vulnerability Problem
There’s an obvious limitation here, though. MSEC correlates app components against databases of known vulnerabilities. No database can include vulnerabilities that haven’t been discovered yet. So what happens when a new frontier AI model like Mythos uncovers a fresh flaw that isn’t in any catalog?
Lookout says it has that covered.
“Bad actors can use frontier AI models, Mythos as an example, in order to find vulnerabilities and exploit them,” Dolce acknowledges. “That’s the offensive use of a frontier AI model. Well, Lookout can use that same model defensively. We can go beyond KEV and the other vulnerability databases by using the frontier models ourselves to find unknown vulnerabilities across the SBOM. That will be the next iteration of MSEC.”
The plan is to take the SBOM data MSEC generates and run it through frontier AI models defensively, hunting for unknown vulnerabilities and cataloging them. “We will take our SBOM and use the frontier AI models defensively to go and find unknown vulnerabilities for ourselves, and catalog those as well,” Dolce says.
What This Means for Enterprise Security Teams
For CISOs and security operations teams, the practical takeaway is straightforward:
- You need accurate app inventories across your entire mobile fleet — not just names and versions, but the actual components inside each app.
- SBOMs are becoming a critical tool for mobile security, not just for software supply chain management.
- Correlating SBOM data against vulnerability databases like KEV should be a standard practice.
- AI-powered vulnerability discovery is coming — both from attackers and defenders.
The whole process starts with knowing what’s on your devices, building accurate SBOMs, and correlating those components against known vulnerabilities. Then comes the harder part: using AI defensively to find the unknown flaws before the bad guys do.
As Dolce puts it, “The last step is find unknown vulnerabilities using the same frontier AI models defensively that the bad guys are using offensively.”
For more on the broader mobile threat landscape, check out our coverage of the mobile attack surface expansion and AI-powered mobile threats.
