A new survey from NowSecure of 485 enterprise mobile security uncovered a finding that contradicts conventional wisdom: the organizations most likely to describe their mobile security programs as “advanced” are actually suffering higher-than-average breach rates.
News earlier this week regarding LLM API credential leakage in iOS apps is an example of the blind spots our data surfaces. According to NowSecure, when organizations treat mobile security as a static checklist, they miss the invisible, dynamic risks introduced by AI and third-party code. The broader study found:
- 66% of enterprises experienced a mobile app security incident in the past 12–24 months
- 29% suffered a major breach involving data exposure, account takeover, or operational disruption
- 68% say more than half of their mobile app code now comes from third-party SDKs and libraries
- Organizations whose apps exceeded the 50% third-party code threshold experienced incident rates more than twice as high as those below it
The data raises a question for CISOs that manage mobile apps: Are traditional security maturity models creating a false sense of confidence while mobile attack surfaces continue to expand?
