What Is Really Inside Your Work Apps? Lookout's New Tool Aims to Tell You
A new scanning service from mobile security firm Lookout builds detailed ingredient lists for enterprise apps, exposing hidden vulnerable components before criminals can exploit them.
Key points
- Lookout launched the Mobile Security Exposure Center (MSEC) to scan business mobile apps for hidden security weaknesses.
- The service generates an SBOM, or software bill of materials, which is essentially a full ingredient list of every piece of code an app is built from.
- Many enterprise apps quietly rely on third-party software libraries that carry known, unpatched security flaws.
- Organisations using MSEC can find vulnerable components before criminals find them first.
What is Lookout actually doing here?
Lookout, a company that specialises in mobile security, has released a free scanning service called the Mobile Security Exposure Center, or MSEC, designed to peer inside the apps businesses use every day.
The tool builds what security researchers call an SBOM, short for software bill of materials. Think of it the way you would a food nutrition label: instead of listing calories and ingredients, it lists every chunk of code an app is made from, including pieces written by outside developers that the app quietly borrows to work properly.
Those borrowed pieces are the problem. Apps are almost never built from scratch. Developers stitch together dozens of ready-made software libraries, small reusable blocks of code, to save time. If one of those libraries contains a known security flaw, every app built on top of it inherits that flaw, often without the app's publisher even realising it.
Why should ordinary people care?
The apps running on your work phone almost certainly contain code you have never heard of, written by developers who have nothing to do with the company that published the app.
If one of those hidden components has a known vulnerability, meaning a documented weakness that criminals know how to exploit, it becomes a door into your organisation's data. That could mean customer records, internal communications, or payment information.
Security researchers have tracked numerous nation-state campaigns, including clusters linked to groups Mandiant tracks as APT41 and which Microsoft labels HAFNIUM, that specifically hunt for exposed mobile endpoints carrying outdated library versions. Attribution is always a caveat-laden exercise, but the pattern is consistent: known flaws in dependency code, often unpatched for months, serve as entry points.
What should businesses do with this information?
Generating the ingredient list is step one. Acting on it is the harder part.
MSEC surfaces which specific components carry known flaws, along with the CVE identifiers, which are the official numbered labels assigned to documented security flaws, that describe each weakness. Knowing CVE-2024-23456 sits inside your expense-reporting app gives your IT team something concrete to chase down, rather than a vague instruction to "keep apps updated."
As first reported by SecurityWeek, the service targets enterprise mobile applications specifically, the category most commonly overlooked when companies run their regular security audits.
If your company issues work phones or lets staff use personal phones for work, asking your IT contact whether mobile apps go through any kind of component-level review is a reasonable question. The answer, at most organisations, is no.
