Why Mobile Became
the Enterprise Trust Anchor.

The quiet convergence

Over roughly a decade, a series of individually sensible decisions put an extraordinary amount of enterprise trust onto a single consumer-form-factor device.

• Identity and directory access
• MFA push approvals and authenticator applications
• Passkeys and platform authenticators
• Enterprise email and collaboration
• SaaS applications and AI tools
• Banking and payment approvals
• Corporate applications, communications and active sessions

Each move was defensible. Push MFA is better than SMS. Passkeys are better than passwords. Mobile collaboration is better than being unreachable. But the cumulative effect is that one device now mediates whether the enterprise believes a user is who they claim to be.

The thesis

The mobile device increasingly determines whether the enterprise believes the user is who they claim to be. Mobile security has therefore become an enterprise identity and trust problem, not merely a device-security problem.

This reframing matters because it changes what "good" looks like. If a phone is just another endpoint, protecting it means malware prevention and a compliance check. If a phone is the trust anchor, protecting it means continuously evaluating whether the identity assertions it produces should still be believed.

What follows from it

A compromised trust anchor does not announce itself as a mobile incident. It presents as a legitimate approval, from an enrolled device, by an authenticated user — because from the enterprise’s point of view, that is exactly what it is.

That is why the evaluation has to be continuous and has to consider the whole picture: device integrity, network path, session behaviour and identity context together. Any one of those signals in isolation looks fine in precisely the scenario you most need to catch.