Color: Blue team.
What Is This Category?
Mix (9 tools)
- License: 1 open source · 8 proprietary
- Hosting: 1 self-hosted · 8 SaaS · 0 both
Mobile Threat Defense is the EDR equivalent for mobile devices. It runs as a per-device app (via MDM distribution) and watches for malicious apps, suspicious network connections, MitM attacks, OS- level exploits, phishing URLs, and side-loaded apps. Distinct from MAST (which audits a specific app’s security) and from MDM (which manages device configuration), MTD is the live threat-detection layer.
Distinct from neighbouring categories
- Endpoint Management & MDM – Endpoint management / MDM provisions and configures the device; MTD is the threat- detection layer on top
- EDR / XDR – EDR / XDR is the PC-class equivalent; MTD is the iOS / Android-specific tier
- Mobile App Security Testing (MAST) – MAST audits a specific app at build time; MTD defends a device at runtime
About this data & disclaimer
The information on these pages was researched by a combination of human review and large language models. This catalogue serves as a reference for the resources, applications, devices, deployment payloads, and other components that the ResorsIT platform integrates, deploys, and manages. To suggest an addition or correction, please contact us. Prepared by Rhodium Systems Inc., author of the ResorsIT platform — a unified IT operations management platform for IT teams and MSPs that integrates a curated suite of open-source, commercial, and SaaS applications into a single system with shared identity, single sign-on, access control, and a common audit trail. This information is compiled on a best-effort basis: it may be incomplete, contain errors, and become out of date as tools, vendors, licences, and features change. Use this catalogue only as a starting point for your own research, and independently verify and review any tool carefully against your own requirements before relying on it.
Comparison
Overview
MTD is an almost-entirely-commercial category. Lookout MES and Zimperium MTD are the two market leaders; Jamf Protect Mobile is the Apple-ecosystem choice; Pradeo / Check Point Harmony Mobile / SentinelOne Singularity Mobile / Microsoft Defender for Endpoint – Mobile compete on ecosystem-alignment axes. Wandera is a legacy post-Jamf-acquisition product line. The only OSS entry is Hypatia (Android-only local AV; consumer- scope, not enterprise MTD).
Capability Matrix
| Tool | iOS | Android | App Detection | Phishing | Network | OS-Integrity |
|---|---|---|---|---|---|---|
| Lookout MES | yes | yes | yes | yes | yes | yes |
| Zimperium MTD | yes | yes | yes (z9 on-device) | yes | yes | yes |
| Jamf Protect Mobile | yes (Apple-strong) | partial | yes | yes | yes | yes |
| Pradeo | yes | yes | yes (+ AppSec testing) | yes | yes | yes |
| Check Point Harmony Mobile | yes | yes | yes | yes | yes | yes |
| SentinelOne Singularity Mobile | yes | yes | yes (Singularity AI) | yes | yes | yes |
| Defender for Endpoint – Mobile | yes | yes | yes | yes | yes | yes |
| Wandera (Jamf) | yes | yes | yes (legacy) | yes | yes | yes |
| Hypatia (OSS) | – | yes | local AV only | – | – | – |
License Comparison
| Tool | License | OSI | Type |
|---|---|---|---|
| Lookout MES | Proprietary | – | Commercial SaaS (category co-leader) |
| Zimperium MTD | Proprietary | – | Commercial SaaS (category co-leader) |
| Jamf Protect Mobile | Proprietary | – | Commercial SaaS (Apple-aligned) |
| Pradeo | Proprietary | – | Commercial SaaS (French / EU) |
| Check Point Harmony Mobile | Proprietary | – | Commercial SaaS (Check Point) |
| SentinelOne Singularity Mobile | Proprietary | – | Commercial SaaS (SentinelOne) |
| Defender for Endpoint – Mobile | Proprietary | – | M365 E5 / Defender P2 included |
| Wandera (Jamf) | Proprietary | – | Legacy; migrating to Jamf Protect Mobile |
| Hypatia | GPL-3.0-only | yes | OSS Android-only consumer AV |
Composition Patterns
1. Microsoft-aligned customer
Defender for Endpoint -- Mobile (included in E5 / Defender P2)
+ Microsoft Intune for MDMOutput: M365-native MTD at no incremental cost. Defender XDR correlation across endpoint + mobile.
2. Apple-aligned customer
Jamf Protect Mobile + Jamf Pro MDM
Output: Apple-ecosystem-native MTD; tight integration; preferred for Apple-first fleets.
3. Mixed iOS / Android enterprise
Lookout MES (or Zimperium MTD)
+ Intune / Jamf / Workspace ONE MDMOutput: vendor-neutral MTD for mixed device fleets. Lookout vs Zimperium decision is incumbent / vendor preference.
4. SentinelOne-aligned customer
SentinelOne Singularity Mobile
+ SentinelOne endpoint EDR (the other side of Singularity)Output: unified endpoint + mobile under one XDR console.
Cost Tier
Per-device annual cost.
| Tier | Tooling | Approx Cost |
|---|---|---|
| Free | Hypatia (consumer Android only) | $0 |
| Included | Defender for Endpoint – Mobile via M365 E5 | (included) |
| Mid | Lookout / Zimperium / Pradeo / Check Point | $30-80 per device / year |
| High | SentinelOne Singularity Mobile | $50-100 per device / year |
Tools
9 tools.
Check Point Harmony Mobile
Check Point’s MTD platform; part of the Harmony Endpoint + Mobile + Email + SASE ecosystem; competitive in Check Point-aligned customer environments.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC, SAML
ResorsIT usage: Web App with SSO
Access & Identity: Single sign-on · Provisioned account
Hypatia
Open-source on-device malware scanner for Android; uses ClamAV signatures; DivestOS-adjacent; consumer / privacy-focused.
License: GPL-3.0-only (OSS) · Kind: mobile · Deploy: direct, package · SSO: none
ResorsIT usage: Deployment Payload
Access & Identity: Local host account
Jamf Protect (Mobile)
Jamf’s Apple-focused mobile + macOS threat defence; tight integration with Jamf Pro MDM; Apple-ecosystem-native.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC, SAML
ResorsIT usage: Web App with SSO
Access & Identity: Single sign-on · Provisioned account
Lookout MES
One of the longest-running mobile threat defence platforms; consumer roots, enterprise MES tier widely integrated with Intune / Jamf / Workspace ONE.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC, SAML
ResorsIT usage: Web App with SSO
Access & Identity: Single sign-on · Provisioned account
Microsoft Defender for Endpoint – Mobile
Microsoft Defender for Endpoint’s mobile tier; iOS + Android coverage; included in M365 E5 or Defender for Endpoint P2 licensing.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC, SAML
ResorsIT usage: Web App with SSO
Access & Identity: Single sign-on · Directory / LDAP · Provisioned account
Pradeo
French commercial mobile-security platform; combines MTD + mobile- AppSec testing; European data-residency option.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC, SAML
ResorsIT usage: Web App with SSO
Access & Identity: Single sign-on · Provisioned account
SentinelOne Singularity Mobile
SentinelOne’s MTD tier; built on SentinelOne Singularity AI platform; integrates with Singularity XDR for unified endpoint + mobile threat detection.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC, SAML
ResorsIT usage: Web App with SSO
Access & Identity: Single sign-on · Provisioned account
Wandera (Jamf)
Pre-Jamf Wandera mobile-security platform; now largely subsumed into Jamf Protect Mobile post-2020 acquisition; legacy / transitional product line.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC, SAML
ResorsIT usage: Web App with SSO
Access & Identity: Single sign-on · Provisioned account
Zimperium MTD
Zimperium’s mobile threat defence platform; z9 on-device detection engine; one of the two MTD market leaders alongside Lookout MES.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC, SAML
ResorsIT usage: Web App with SSO
Access & Identity: Single sign-on · Provisioned account
