License & Deployment Mix: 9 tools – 1 OSS (Android-only consumer-scope), 8 commercial. Almost-entirely-commercial category.
Color: Blue team.
What Is This Category?
Mobile Threat Defense is the EDR equivalent for mobile devices. It runs as a per-device app (via MDM distribution) and watches for malicious apps, suspicious network connections, MitM attacks, OS- level exploits, phishing URLs, and side-loaded apps. Distinct from MAST (which audits a specific app’s security) and from MDM (which manages device configuration), MTD is the live threat-detection layer.
Distinct from neighbouring categories
- Endpoint Management & MDM – Endpoint management / MDM provisions and configures the device; MTD is the threat- detection layer on top
- EDR / XDR – EDR / XDR is the PC-class equivalent; MTD is the iOS / Android-specific tier
- Mobile App Security Testing (MAST) – MAST audits a specific app at build time; MTD defends a device at runtime
The information on these pages was researched by a combination of human review and large language models. To suggest an addition or correction, please contact us. Prepared by Rhodium Systems Inc., author of the ResorsIT platform — a unified IT operations management platform for IT teams and MSPs that integrates a curated suite of open-source, commercial, and SaaS applications into a single system with shared identity, single sign-on, access control, and a common audit trail. Use this catalogue only as a starting point for your own research, and review any tool carefully against your own requirements before relying on it. Catalogue data version 2026.197.
Comparison
Overview
MTD is an almost-entirely-commercial category. Lookout MES and Zimperium MTD are the two market leaders; Jamf Protect Mobile is the Apple-ecosystem choice; Pradeo / Check Point Harmony Mobile / SentinelOne Singularity Mobile / Microsoft Defender for Endpoint – Mobile compete on ecosystem-alignment axes. Wandera is a legacy post-Jamf-acquisition product line. The only OSS entry is Hypatia (Android-only local AV; consumer- scope, not enterprise MTD).
Capability Matrix
| Tool | iOS | Android | App Detection | Phishing | Network | OS-Integrity |
|---|---|---|---|---|---|---|
| Lookout MES | yes | yes | yes | yes | yes | yes |
| Zimperium MTD | yes | yes | yes (z9 on-device) | yes | yes | yes |
| Jamf Protect Mobile | yes (Apple-strong) | partial | yes | yes | yes | yes |
| Pradeo | yes | yes | yes (+ AppSec testing) | yes | yes | yes |
| Check Point Harmony Mobile | yes | yes | yes | yes | yes | yes |
| SentinelOne Singularity Mobile | yes | yes | yes (Singularity AI) | yes | yes | yes |
| Defender for Endpoint – Mobile | yes | yes | yes | yes | yes | yes |
| Wandera (Jamf) | yes | yes | yes (legacy) | yes | yes | yes |
| Hypatia (OSS) | – | yes | local AV only | – | – | – |
License Comparison
| Tool | License | OSI | Type |
|---|---|---|---|
| Lookout MES | Proprietary | – | Commercial SaaS (category co-leader) |
| Zimperium MTD | Proprietary | – | Commercial SaaS (category co-leader) |
| Jamf Protect Mobile | Proprietary | – | Commercial SaaS (Apple-aligned) |
| Pradeo | Proprietary | – | Commercial SaaS (French / EU) |
| Check Point Harmony Mobile | Proprietary | – | Commercial SaaS (Check Point) |
| SentinelOne Singularity Mobile | Proprietary | – | Commercial SaaS (SentinelOne) |
| Defender for Endpoint – Mobile | Proprietary | – | M365 E5 / Defender P2 included |
| Wandera (Jamf) | Proprietary | – | Legacy; migrating to Jamf Protect Mobile |
| Hypatia | GPL-3.0-only | yes | OSS Android-only consumer AV |
Composition Patterns
1. Microsoft-aligned customer
Defender for Endpoint -- Mobile (included in E5 / Defender P2)
+ Microsoft Intune for MDMOutput: M365-native MTD at no incremental cost. Defender XDR correlation across endpoint + mobile.
2. Apple-aligned customer
Jamf Protect Mobile + Jamf Pro MDM
Output: Apple-ecosystem-native MTD; tight integration; preferred for Apple-first fleets.
3. Mixed iOS / Android enterprise
Lookout MES (or Zimperium MTD)
+ Intune / Jamf / Workspace ONE MDMOutput: vendor-neutral MTD for mixed device fleets. Lookout vs Zimperium decision is incumbent / vendor preference.
4. SentinelOne-aligned customer
SentinelOne Singularity Mobile
+ SentinelOne endpoint EDR (the other side of Singularity)Output: unified endpoint + mobile under one XDR console.
Cost Tier
Per-device annual cost.
| Tier | Tooling | Approx Cost |
|---|---|---|
| Free | Hypatia (consumer Android only) | $0 |
| Included | Defender for Endpoint – Mobile via M365 E5 | (included) |
| Mid | Lookout / Zimperium / Pradeo / Check Point | $30-80 per device / year |
| High | SentinelOne Singularity Mobile | $50-100 per device / year |
Tools
9 tools.
Check Point Harmony Mobile
Check Point’s MTD platform; part of the Harmony Endpoint + Mobile + Email + SASE ecosystem; competitive in Check Point-aligned customer environments.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC, SAML
Hypatia
Open-source on-device malware scanner for Android; uses ClamAV signatures; DivestOS-adjacent; consumer / privacy-focused.
License: GPL-3.0-only (OSS) · Kind: mobile · Deploy: native, package · SSO: none
Jamf Protect (Mobile)
Jamf’s Apple-focused mobile + macOS threat defence; tight integration with Jamf Pro MDM; Apple-ecosystem-native.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC, SAML
Lookout MES
One of the longest-running mobile threat defence platforms; consumer roots, enterprise MES tier widely integrated with Intune / Jamf / Workspace ONE.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC, SAML
Microsoft Defender for Endpoint – Mobile
Microsoft Defender for Endpoint’s mobile tier; iOS + Android coverage; included in M365 E5 or Defender for Endpoint P2 licensing.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC, SAML
Pradeo
French commercial mobile-security platform; combines MTD + mobile- AppSec testing; European data-residency option.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC, SAML
SentinelOne Singularity Mobile
SentinelOne’s MTD tier; built on SentinelOne Singularity AI platform; integrates with Singularity XDR for unified endpoint + mobile threat detection.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC, SAML
Wandera (Jamf)
Pre-Jamf Wandera mobile-security platform; now largely subsumed into Jamf Protect Mobile post-2020 acquisition; legacy / transitional product line.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC, SAML
Zimperium MTD
Zimperium’s mobile threat defence platform; z9 on-device detection engine; one of the two MTD market leaders alongside Lookout MES.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC, SAML
