Mobile threat defence (MTD) is security software for phones and tablets that detects harmful apps, fake links, unsafe Wi-Fi networks and weaknesses in the phone itself, and reports the phone's level of risk to the company. It is usually an app on the phone. It matters most for phones that employees own themselves, which the company cannot fully control.
Many employees read company email and use company apps on their own phones. This is called bring your own device, or BYOD. The company can manage a work profile on such a phone through unified endpoint management (UEM). But UEM does not check whether the phone itself is safe. And the kind of endpoint agent that runs on laptops cannot run on a phone, because phone operating systems do not let one app watch other apps closely.
So MTD checks what it can from the outside. It checks each installed app against lists of known harmful apps, and notes apps that were installed from outside the official app stores. It checks the links in SMS and chat messages, because phishing by SMS is common. It checks whether the Wi-Fi network is reading or changing the phone's traffic. It also checks whether the phone's operating system is out of date, or has been rooted, which means that its built-in protections have been removed. It does not read the employee's messages, photos or browsing history.
Imagine a medical representative in Patna who visits doctors all day and uses his own phone for the company's order app. One evening, a WhatsApp message offers an app to "update your electricity bill KYC". He installs the app from a link. The app asks for permission to read his SMS messages, which would let it steal the OTPs that banks send him. Within a minute, MTD flags the app as harmful. It warns him and shows him how to remove it. It also reports the phone as high risk. Until he removes the app, the phone cannot open the company's email or the order app, because zero trust network access (ZTNA) refuses connections from high-risk devices. Ten minutes after he removes it, his access returns. MTD also sends the event to the company's SIEM, so that the security team can check whether other employees received the same message.
MTD is different from mobile app shielding. MTD protects the phones that a company's own staff use. App shielding protects one of the company's own apps, such as a banking app, on every phone where customers install it, against tampering and copying.