Techstep Pulse shares practical insights from our day-to-day work across mobility and security, focused on what matters when devices, threats and updates move faster than your policies can.
In this edition, we focus on:
- AI is speeding up phishing, moving into everyday work apps and creating data exposure that most device policies do not yet cover.
- Security updates are heavy on every platform at once, and attackers keep favouring flaws whose fixes are known but not yet installed.
- A busy hardware season shows why the length of a device's update period and its repair options matter more than the launch itself.
AI speeds up mobile attacks and opens new paths for data to leave
The 2026 Global Mobile Threat Report from Zimperium, a mobile security firm, describes a sharp shift in the speed and scale of attacks. Almost 86% of phishing attacks now contain AI-generated elements. That share has grown 380% since January 2025. Spyware is now present on nearly one in ten devices.
The risk also reaches well beyond email. AI lowers the barrier to social engineering, meaning attackers can trick people instead of breaking systems. The same believable lure can now arrive through text, chat and any other app on one phone. Each reply can give away valuable metadata about the business and the person's private life.
The report also looks inside the organisation. Employees install several generative AI apps and feed them sensitive company data. Many established apps, including enterprise ones, now also carry embedded AI features. On the development side, 45% of AI-generated code samples failed basic checks against the OWASP Top 10, a standard list of common application security weaknesses.
Software vendors face the same pattern. A prompt injection flaw in the AI assistant of a widely used office suite affected 19 mobile apps across iOS and Android. An attacker could hide instructions in a message or file that the assistant reads. The assistant would then follow them and reveal sensitive company information or internal details of how it runs. The issue is patched, and no active exploitation has been reported (CVE-2026-26133).
In practice, an approved app list is no longer enough. An app cleared a year ago may now include AI features that can reach company data. IT teams need to know which AI tools sit on managed devices, what data they can access, and whether those apps are updated as fast as the operating system. Governance has to follow capabilities and permissions, not a static list of apps.
The phone is a place where AI meets corporate data every day, so the AI policy and the device policy need to be tied together. The broader signal is that AI now sits on both sides. It makes attacks cheaper to run, and it creates new routes for data to leave through tools the company chose itself.
Why this matters: AI helps attackers write better lures and helps employees move company data into tools nobody has reviewed. Both risks sit on the phone, so the policy needs to cover it.
Heavy patch loads on every platform leave little room to fall behind
Security updates were large across all major mobile platforms last month. Apple released a security-only update with 82 fixes for organisations staying on its previous iOS generation, while its new major release launched on 14 September. Android's September security update carried between 180 and 200 fixes, including Critical and High severity vulnerabilities in system, kernel and chipset components. Samsung's monthly patch fixed 90 vulnerabilities across Galaxy phones, tablets and smartwatches. Samsung also noted that 40 of the issues fixed in Android's update do not apply to Galaxy devices.
Volume matters because of how attackers get in. Verizon's 2026 data breach report found that exploiting vulnerabilities is now the most common initial access route. It also found that SMS phishing was only detected because the devices were managed. Both findings point the same way: unpatched or unseen devices are where incidents start.
That turns patching into a security control. Apple's two release tracks show why. Staying on the previous generation is a legitimate choice, but it only works if the security-only update is deployed as fast as the new release. On Android, fixes arrive in steps, first on the platform, later to the device maker's own release, so protection reaches different models at different times.
The pace is the practical problem. A mobile OS typically ships 15 to 25 large updates a year, and a share of them fix zero-day flaws that attackers already use. In our experience, that means updating devices 20 to 22 times a year. Only silent enforcement keeps up: OS updates, security patches and enterprise app updates need to be pushed through MDM without waiting for users.
Enforcement is only as good as the data behind it. Techstep added Managed Monitoring to its Lifecycle solution to close that gap, showing enrolment status, compliance, activity, OS version and last signed-in user next to lifecycle data. IT can spot devices that are not enrolled, non-compliant, inactive or managed in the wrong platform without comparing several systems.
The same data matters when a device gets returned. If nobody is sure whether it was used for company work, treat it as holding corporate data. A certified wipe protects both the business and the employee.
See how Lifecycle can help: https://www.techstep.io/offering/solutions/lifecycle-platform
Why this matters: Attackers favour flaws that are already fixed, but patches are still to be installed. How quickly a fleet closes that gap is now a measurable business risk.
A crowded hardware season puts update periods at the centre of fleet planning
- Apple presented new iPhone Pro models, new Apple Watch models and a new AirPods generation, available from 18 September. iPhone Duo, its first foldable, follows on 23 October.
- Google has discontinued its Pixel Tablet. Software updates continue through 2028, and no successor is planned.
- Jabra has published battery replacement guides showing that batteries in its Evolve3 headset series can be replaced without voiding the warranty.
These stories look unrelated. Each one changes the answer to the same question: how long does a device stay useful, and who decides when it stops? They touch different parts of the fleet.
The tablet shows the planning problem. It still receives updates until 2028, so it stays safe to use. But organisations that built workflows on it now need a replacement decision before the update period ends, not after it. Launch seasons create the opposite pressure, an urge to refresh early because something new exists.
Cost per device raises the stakes at the premium end. Gartner calls Apple's foldable a platform test for personal AI. Omdia, a market research firm, counts 18.2 million foldables sold in 2025 and expects 45 million by 2030, while IDC, another research firm, expects 35.8 million, which is 3.1% of units but about 10% of revenue. When a small share of units takes a tenth of the spend, a wrong buying decision costs more.
Repair options work in the other direction. Replaceable batteries, as in the Jabra range, extend service life, protect the warranty and cut waste. For a large headset fleet, that lowers lifetime cost and supports sustainability goals.
Most fleet plans track the purchase date. Fewer track the date a model stops receiving updates, or the repair route that keeps it in service. Holding those dates per model in MDM and asset data turns hardware news into a planning input instead of a surprise. The broader signal is that product lines will keep coming and going, so fleet strategy has to rest on update periods and repairability, not on a favourite model.
Why this matters: A device is only a good buy while it gets updates and can be repaired. Planning around those dates avoids both early refresh costs and unsupported devices at the end.
The three stories share one question: do you know what is on your devices, what state it is in and how long it will stay supported? AI is adding new tools and new risks to the phone faster than policies change. Patch volumes leave little room for manual tracking. Hardware cycles keep moving the dates that matter. Organisations that can answer the question quickly treat each of these as routine work.
Wondering what the next device cycle will ask of your fleet? Subscribe to Techstep Pulse for monthly insights.
/TCO%20calculate3.jpg)
