In short: Lookout mobile security is a mobile threat defence and mobile EDR service for iOS, Android and ChromeOS devices. An app on each device detects phishing, malicious and risky apps, device compromise and network attacks, and passes the device's risk level to Microsoft Intune or another MDM, which can block a risky device from company data.
Why mobile devices need their own protection
Mobile device management (MDM) tools such as Microsoft Intune configure phones, push apps and enforce passcodes, but they do not detect active threats. Desktop EDR agents do not run on phones in the same way, and the mobile operating systems limit what any security app can see. Meanwhile attackers have moved to where people are least careful: phishing by SMS and messaging apps, fake login pages viewed on a small screen, and malicious or over-permissioned apps.
Lookout is a mobile security company. Its mobile endpoint security product, which Lookout now markets as Lookout Mobile AI Security, runs on iOS, Android and ChromeOS, adds threat detection to company-owned and personal devices, and connects it to your MDM. In 2025 Lookout sold its cloud security (SSE) business to Fortra, so Lookout today is a mobile security specialist. For CASB and secure web gateway needs, see our SASE and CASB guides instead.
What Lookout protects against
The Lookout app runs on each device and is backed by Lookout's cloud analysis of apps, web addresses and device states. It covers four groups of threat:
| Threat area | Examples |
|---|---|
| Phishing and malicious content | Malicious links in SMS, email, messaging apps and websites, blocked before credentials are entered |
| Apps | Malware, spyware and surveillanceware, risky sideloaded apps and apps that leak data |
| Device | Jailbreak and root detection, outdated operating systems and known OS vulnerabilities |
| Network | Man-in-the-middle attacks and hostile or unsafe Wi-Fi |
When a threat is found, the user sees clear guidance in the app on how to fix it, and the device's risk level changes in the console. That combination of self-service fixes and automatic access control keeps the load on your IT team low.
Lookout Essentials vs Advanced
We supply Lookout in two editions. Lookout describes Advanced as building on Essentials with proactive analysis and compliance policy enforcement, so the difference is how far you go beyond threat detection into app and patch compliance.
| Capability | Essentials | Advanced |
|---|---|---|
| Detection and response for phishing and malicious links | Yes | Yes |
| Malware, spyware and malicious app detection | Yes | Yes |
| Device compromise detection, including jailbreak and root | Yes | Yes |
| Risky network and man-in-the-middle detection | Yes | Yes |
| MDM integration for conditional access, and SIEM integration | Yes | Yes |
| App risk assessment and policies to block non-compliant apps | No | Yes |
| Visibility of outdated OS versions and security patch levels | No | Yes |
Lookout also sells a Premium bundle with threat hunting and incident research for security operations teams, and add-on modules such as Social Engineering Protection. Feature-level detail such as web content filtering and Secure DNS varies by bundle, so we confirm the exact feature list for your edition before you order.
Essentials covers the threats most small and mid-sized organisations face day to day. Advanced suits regulated organisations, or anyone who needs to enforce which apps are allowed and prove that devices are on supported, patched OS versions. Both are licensed per device, so a member of staff with a phone and a tablet needs two licences.
Working with Intune and other MDM
Lookout is designed to feed its risk assessment into the tool that controls access. With Microsoft Intune there are two models, both documented by Microsoft:
- Enrolled devices: an Intune compliance policy includes a Mobile Threat Defense rule that uses Lookout's risk level. A device that becomes high risk is marked non-compliant, and Conditional Access blocks it from Exchange Online, SharePoint and other company resources until the threat is fixed.
- Unenrolled (BYOD) devices: Intune app protection policies use Lookout's risk data to block access to company data in protected apps, or selectively wipe that data, without enrolling the whole phone.
Microsoft lists Intune Plan 1 and Microsoft Entra ID P1 as prerequisites for the Intune integration, both of which are included in Microsoft 365 Business Premium and E3/E5; our Microsoft Entra ID P1 and P2 page explains the identity side. Lookout also documents integrations with other MDM platforms, including Omnissa Workspace ONE, Ivanti, IBM MaaS360 and BlackBerry UEM, and can send alerts to a SIEM such as Microsoft Sentinel. For help with the MDM itself, see mobile device management from Forever Group.
BYOD, privacy and Cyber Essentials
Staff will only install a security app on their own phone if they trust it. Lookout states that it enforces security policies on personal devices without collecting personal content or monitoring private activity. Explain this clearly when you roll it out, and the app-protection model above lets you protect company data on personal phones without taking control of the device.
Mobile devices that access organisational data or services, including personal phones used for work, are in scope for Cyber Essentials, which expects devices to be protected from malware and kept on supported, updated operating systems. Lookout helps evidence both, particularly the Advanced edition's OS version and patch-level reporting. See Cyber Essentials requirements for the controls.
How Lookout compares and how we help
Lookout is one of several mobile threat defence options. Others include Check Point's Harmony Mobile, Sophos Mobile and Microsoft Defender for Endpoint on iOS and Android, which is included with Microsoft Defender for Endpoint licences. If you already own Defender for Endpoint, check what its mobile capabilities cover before buying another product; Lookout tends to suit organisations that want a mobile specialist, wide MDM support or cover for devices outside the Microsoft estate.
- Connect Lookout to your MDM and agree what happens when a device becomes high risk.
- Set policies for phishing, risky apps, minimum OS versions and network threats.
- Deploy to IT first, then company devices, then invite BYOD users with a short explanation.
- Route alerts to us or to your SIEM, and review the risk dashboard monthly.
Licensing detail is on softwarelicensing.uk. Contact us to protect your mobile fleet or ask us for a quote.
How Forever Systems helps with cloud security
We are an independent UK IT and cyber security provider. We supply and support a wide range of security platforms, so we recommend what fits your organisation rather than one vendor's answer to everything.
- Assess first: we review what you already own, especially your Microsoft 365 licences, before suggesting anything new
- Vendor-aware advice across secure access, email, identity, data protection, endpoint, MDR, cloud infrastructure, browser, AI and backup, including Cisco Secure, Check Point Harmony and Sophos
- Deployment and migration from a UK team, from tenant hardening to replacing a VPN or an endpoint product
- Ongoing support: policy tuning, alert handling, renewals and regular reviews
- People and certification too: security awareness training and Cyber Essentials
We work with businesses, schools, charities and public sector organisations.
Want an independent view of your cloud security?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Why do we need mobile threat defence if we already have Intune?
Intune manages device settings and apps but does not detect phishing, malicious apps or network attacks on the device. Lookout detects those threats and passes the device's risk level to Intune, which can then block a compromised device from company data.
Does Lookout work on personal phones (BYOD)?
Yes. Lookout protects both managed and unmanaged devices. With Intune app protection policies, company data in protected apps can be blocked or wiped on a risky personal device without enrolling the whole phone.
What is the difference between Lookout Essentials and Lookout Advanced?
Essentials provides detection and response for phishing, malicious apps, device compromise and risky networks, with MDM and SIEM integration. Advanced adds proactive analysis and compliance enforcement: assessing the risk of apps and devices, blocking non-compliant apps, and showing which devices run outdated OS versions or patch levels.
Does Lookout still sell cloud security or CASB?
No. Lookout sold its cloud security (SSE) business to Fortra in 2025 and now concentrates on mobile security.
Is Lookout licensed per user or per device?
Per device. Each protected phone or tablet needs a licence, whether it is company-owned or personal.