What Is Really Inside Your Work Apps? Lookout's New Tool Aims to Tell You
A new scanning service from mobile security firm Lookout builds detailed ingredient lists for enterprise apps, exposing hidden vulnerable components before criminals can exploit them.
Key points
- Lookout launched the Mobile Security Exposure Center (MSEC) to scan business mobile apps for hidden security weaknesses.
- The service generates an SBOM, or software bill of materials, a full ingredient list of every piece of code an app is built from.
- Enterprise apps quietly rely on third-party software libraries that carry known, unpatched security flaws.
- Organisations using MSEC can find vulnerable components before attackers do.
What is Lookout actually doing here?
Lookout, a mobile security company, has released a free scanning service called the Mobile Security Exposure Center, or MSEC, designed to peer inside the apps businesses use every day.
The tool builds what security researchers call an SBOM, short for software bill of materials. Think of it like a food nutrition label: instead of listing calories, it lists every chunk of code an app is built from, including pieces written by outside developers that the app quietly borrows.
Those borrowed pieces are the problem. Developers stitch together dozens of ready-made software libraries, small reusable blocks of code, to save time. If one of those libraries contains a known security flaw, every app built on top of it inherits that flaw, often without the app's publisher realising it. We explored how this same dependency risk now extends to AI-generated code in our 7 July story on supply chain strangers.
Why should ordinary people care?
The apps running on your work phone almost certainly contain code you've never heard of, written by developers who've nothing to do with the company that published the app.
If one of those hidden components has a known vulnerability, a documented weakness that criminals know how to exploit, it becomes a door into your organisation's data. Customer records or payment information can walk out through a flaw nobody knew was there.
Mobile endpoints are a consistent target. Known flaws in dependency code, often unpatched for months, serve as entry points. Attribution is always a caveat-laden exercise, but the pattern is well-documented across public threat research.
What should businesses do with this information?
Generating the ingredient list is step one. Acting on it is harder.
MSEC surfaces which specific components carry known flaws, along with CVE identifiers, the official numbered labels assigned to documented security weaknesses. Knowing a specific CVE sits inside your expense-reporting app gives your IT team something concrete to chase, rather than a vague instruction to keep apps updated.
As first reported by SecurityWeek, the service targets enterprise mobile applications specifically, the category most commonly overlooked in regular security audits. That matches what we found in our 7 July report on software safety labels: most component lists companies publish are already wrong before anyone acts on them.
If your company issues work phones or lets staff use personal phones for work, ask your IT contact whether mobile apps go through any component-level review. At most organisations, they don't.
