Should you build or buy Mobile Threat Defense (MTD)?
Mobile threat defense software runs on employee phones and tablets to detect phishing links, malicious apps, rogue Wi-Fi networks and OS-level exploits, then quarantines the device or blocks corporate access through the mobile device management system. Enterprises with regulated data, sensitive IP or insurance requirements on mobile fleets buy it.
Buy MTD if mobile devices reach sensitive data or your regulators expect it; otherwise the real alternative is MDM plus built-in platform protections with the residual risk accepted, not a home-built detector. The public record shows organizations starting with MDM-only and then buying Zimperium, Check Point or Lookout, and MVT is for forensics, not defense.
Build it, buy it, or bridge?
When building makes sense
There is no credible build path for the detection core itself. What organizations actually do instead of building is decline mobile threat defense and rely on MDM compliance policies plus the platform's own protections, such as Google Play Protect and Apple's app-review model. That is a real choice, but it is accepting residual risk rather than a self-built equivalent: the one documented case of an organization starting there, an unnamed US government agency, moved to Zimperium once its fleet reached 275,000 devices. Mobile Verification Toolkit is sometimes raised as a counterexample, but it is a forensic tool built by Amnesty International's Security Lab for after-the-fact investigation of a suspected compromise, run manually against a single device's backup, not continuous defense across a fleet. If you are weighing whether to build, the honest options are MDM-only with accepted risk, or licensing a vendor. No organization has shipped a self-built detector as a third option in production.
When buying makes sense
Buy mobile threat defense when phones and tablets reach data that matters, and treat MDM-only as the deliberate alternative rather than a stepping stone to a build. Check Point Harmony Mobile, Lookout, Zimperium, Jamf Protect, ESET and Microsoft Defender for Endpoint's mobile threat defense capability all plug into your existing MDM and add the detection layer MDM policy alone does not provide, drawing on telemetry from far more devices and apps than any single enterprise's fleet generates. MTD is typically priced per device or per user per year on a quote basis, and even at the high end that licensing is a fraction of one security engineer's salary, so a DIY program that consumes meaningful engineering time erases the saving before you have counted the coverage gap. Buy the licensing for whichever devices actually carry risk, and put your internal effort into the MDM policies and response playbook that turn a vendor's alert into an action.
The desk read
Build-versus-buy analysis for Mobile Threat Defense (MTD) is being written. In the meantime, the framework that drives every B4 call is on the B4 Index page.
Frequently asked
If MDM already has compliance policies, do we need MTD too?
MDM enforces configuration and blocks noncompliant devices; it does not detect phishing links, malicious apps or network-based attacks in real time. Running MDM alone is a legitimate choice for low-risk fleets, but it is accepting residual risk rather than a substitute for continuous detection, and a regulator or insurer may not accept it as equivalent.
Is Mobile Verification Toolkit a free alternative to buying MTD?
No. MVT is a forensic investigation tool built by Amnesty International for analyzing a device after a suspected spyware compromise, run manually against a backup or forensic image. It is not continuous defense and was never designed to run across a fleet the way an MTD product does.
What actually drives the cost of mobile threat defense?
Mostly device count and vendor tier: most vendors price per device or per user per year and quote directly rather than publish a rate card. The bigger cost risk is skipping the vendor and trying to staff detection engineering internally, since one security engineer's salary alone exceeds the licensing cost for a fleet in the low thousands of devices.
When did an organization actually move from MDM-only to a vendor?
A US government agency documented starting with MDM compliance controls alone and later adopting Zimperium once its device count reached roughly 275,000, at a scale where the risk of skipping dedicated detection became harder to justify. That is the pattern to watch for in your own fleet growth.