A phone can be encrypted, fully patched, and compliant with every policy IT has set. An attacker might still be able to get in. All they need is the employee’s password or session token, phished through a fake login page sent by text. The device stays compliant the whole time.
That’s the problem with how most teams handle mobile device management today. MDM answers one question: is this device healthy? It doesn’t answer the questions that attackers count on going unanswered. Who is signing in? Which apps are touching company data? Where does that data go next?
The CIS Controls v8.1 Mobile Companion Guide, published in March 2026, recognizes that mobile brings security challenges of its own. The seven challenges below show where mobile device management often falls short and what security teams can do about it.
1. BYOD Creates a Security-vs-Privacy Tradeoff
Employees don’t want their employer managing an entire personal phone or laptop. The more control IT gets, the more privacy concerns come up.
Apple and Google now design BYOD modes around this compromise. Apple’s User Enrollment is built for BYOD and intentionally limits what an organization can manage because the employee owns the device. IT can manage only the organization’s accounts, settings and information, never a personal account. Android’s work profile works in a similar way. It keeps corporate apps, data and management policies inside the work profile and leaves the personal profile private.
Reduced visibility isn’t necessarily an MDM failure. It can be a deliberate privacy feature. For most teams, the answer is to establish enough control to protect company data, and no more.
2. Contractors and Unmanaged Devices Don’t Fit Neatly into MDM
Contractors and temporary staff now make up a large part of the workforce. A September 2026 study of 700 senior HR and procurement leaders at large enterprises found that 75% say contractors, freelancers and temporary workers account for at least 11% of their workforce. Some say the share is above 20%.
Most of these workers use devices IT doesn’t own. Enrolling them in MDM is impractical. A short engagement may not justify the setup, or the contractor may not accept it in the first place.
The logic is the same as BYOD. The primary objective is to protect company data, not to control the entire endpoint. Controls built around company apps, accounts and access fit that reality better than full device enrollment.
3. A Managed Device Can Still Be Phished
Phishing might represent higher levels of risk on mobile than desktop devices, as employees have to deal with phishing over SMS and WhatsApp on top of the usual email and Teams.
Attackers can capitalize the fact employees depend on mobile devices for email, messaging, and MFA. Their goal isn’t even to compromise the device. Just gaining access to a user’s credentials or session token is enough to access cloud applications as a legitimate user. From there, the fact that the device is compliant doesn’t matter.
July 2026 research says phishing events detected on employee mobile devices grew 380% since January 2025. The number of devices where an employee clicked a malicious link grew 110% during 2025. To fight this trend, security teams should pair MDM with phishing-resistant MFA and conditional access. Employee social engineering training also matters, as the person holding the phone also holds the power to spot the scam that technical controls miss.
4. Shadow AI Is Creating Data Paths MDM Can’t Govern
According to the aforementioned study, AI adoption inside mobile applications has grown 14× on Android and 7× on iOS, becoming a growing security and compliance blind spot. Platforms are already taking action. Apple has added declarative management controls for external intelligence integrations. Admins can restrict whether integrations are allowed, whether users can sign in, and which workspace can be used.
But the control requires iOS 26.4 or later and a supervised device, and it supports only Automated Device Enrollment. That leaves BYOD phones out of reach. App blocklists alone are also inadequate, because AI is a capability inside approved software rather than a separate app IT can block.
The solution is creating a clear AI usage policy and giving employees approved AI tools that work on mobile. Shadow AI grows when the sanctioned option is missing or slow. Then back the policy with controls that follow the data, such as DLP and app-level protection.
5. Keeping Every Device Patched Is Still Hard
IT can define minimum OS requirements, but control over when updates are installed is limited on personal and unenrolled devices.
Security teams have to rely on compliance checks and conditional access instead. Compliance policies combined with conditional access can block users from company resources until their OS meets the requirement. On unmanaged devices, app protection policies can warn users or block access when the OS is too old.
So essentially, IT’s job shifts from patching to deciding whether an outdated device should be granted access to company data.
6. App-Level Data Leakage Can Happen Anywhere
Data leakage happens when people move company data out of approved apps. Employees often do it unconsciously, to make their lives easier, but it’s not ideal from a security and compliance standpoint.
Having sensitive client data on an employee’s personal cloud storage, for example, violates most corporate data handling policies and can put the company in breach of its client agreements.
That’s why app and data-level controls matter more. Some MDM solutions support app protection policies that prevent users from copying corporate data into personal apps or saving it to local storage, without requiring device enrollment.
7. MDM Visibility Is Not the Same as Security Visibility
MDM only tells the security team if a given device is encrypted and compliant. To monitor security events, teams need to implement additional measures.
Identity and conditional access show who is signing in and whether the sign-in looks risky. MAM and DLP show what happens to company data inside apps. Endpoint detection tools like Defender can pick up phishing or malicious apps. All of these signals can come together inside a SIEM, giving security analysts a full picture.
When MDM works alongside these tools, the organization can be more proactive about its mobile device security rather than just relying on compliance status.
MDM Still Matters, But Security Can’t Stop There
Mobile device management still matters in 2026. But a compliant device isn’t the same as a secure one. Many of the challenges above sit outside the device. The answer isn’t to drop MDM. It’s to surround it with controls that protect the identity, the app and the data.
