Evaluate mobile threat defense in apps by naming the work flows a compromised phone could harm, then asking which part of the decision belongs to the app, the operating system and your backend. Otukan puts the detection inside your work app. It recognises malware aimed at the app, accessibility and overlay abuse on Android, screen sharing and remote control, hooking and loss of operating system integrity, then applies the response you set for that flow and passes the evidence on. It works on phones you will never enrol, with each detection scoped separately for Android and iOS. It protects the work app; it does not police the rest of the phone.
The underlying term is explained on what is mobile threat defense.
Threat and buyer task
Security teams rarely buy threat defense for its own sake. They buy it because a specific task is exposed.
The affected flows
Three kinds of work flow carry most of the risk. Approvals, such as purchase orders, access requests and payments, are what an attacker controlling the screen wants to trigger. Record views, such as customer files, patient notes and case documents, are what screen-reading malware wants to capture. Credential entry is what overlays and keyloggers target.
The trust boundary
The boundary sits between the work app and everything else on the phone. On a personal device, the organisation controls only the app. Anything else installed, from a game to a malicious utility, lives on the other side. Threat defense in the app watches that boundary from the inside, where your data actually is.
| Work flow | What a device threat does | What Otukan watches |
|---|---|---|
| Approving a request | Taps inserted or screens hidden by remote control | Remote access, accessibility abuse, overlays |
| Viewing a record | Content read by a screen-scraping service | Accessibility abuse, screen sharing |
| Entering credentials | Input captured by a fake screen or a hook | Overlays, hooking and code injection |
| Any sensitive step | App logic altered on a weakened system | OS integrity signals |
Control fit
A good design gives each layer the job it does best.
The app
The work app sees what happens on its own screens and in its own process. Otukan uses that position to detect threats at the moment they matter and to act on them without waiting for a server round trip.
The operating system
Android and iOS enforce sandboxing, permissions and signing. Otukan relies on those protections and reports when they are missing or weakened. On Android, where apps can draw over each other and accessibility access is broad, Otukan adds specific checks. On iOS, the platform restricts those paths, so Otukan concentrates on system integrity and the app’s own process.
Device management, where present
On company phones, device management reports compliance for the whole device. In-app threat defense adds what the app sees at the moment of use. The two views complement each other: one tells IT the phone met policy this morning, the other tells the security team what was happening on screen when an approval was made.
The backend
Your backend makes the final call on requests that matter. Otukan sends each detection with the next relevant request, so your server can refuse an approval that arrived from a phone under remote control. For signal handling, see runtime threat signals.
Evaluation
Judge threat defense by evidence on your own devices, not by a feature list.
Supported platforms
Ask for every detection per platform, with the OS versions it has been tested on. Detections that exist only on Android should say so. Include Flutter or React Native work apps in the pilot if you run them.
Evidence
For each threat, reproduce it in an authorised lab and confirm the signal. Then run the same flow on a legitimate phone and confirm it stays quiet. Finally repeat install, update, sign-in and your most sensitive flow on the protected build.
User impact
Run the pilot on the phones staff actually carry, including older ones. Record how often each detection fires and which legitimate tools trigger it, such as screen readers or support sessions. Adjust policy per flow before you restrict anything. The wider set of staff app controls is on enterprise application protection.