70% of mobile devices impacted by a cyberattack are personal, not corporate-issued, according to Verizon’s 2025 Mobile Security Index, and 85% of organizations say mobile attacks are increasing overall. The personal phone has become the soft edge of the enterprise: 80% of organizations saw mobile phishing attempts aimed at employees, and in phishing simulations the median click rate in mobile-centric channels such as voice and text messaging is 40% higher than via email (Verizon, 2026 Data Breach Investigations Report). Consequences are getting heavier too, with 50% of organizations reporting lost data after a mobile-related incident and 36% facing cyber insurance penalties. Remote access is part of the same picture, covered in our corporate VPN usage statistics. We aggregated data from Verizon, the UK Department for Science, Innovation and Technology, Zimperium, Cybersecurity Insiders, the US Securities and Exchange Commission, the CFTC, NIST, the FTC, IBM and Mordor Intelligence.
TL;DR
- 70% of mobile devices impacted by a cyberattack are personal, not corporate-issued (Verizon Mobile Security Index 2025).
- 85% of organizations say mobile attacks are increasing overall (Verizon Mobile Security Index 2025).
- 82% of organizations actively enable BYOD to at least some extent (Cybersecurity Insiders, 2021 BYOD Security Report).
- 66% of UK businesses only allow access via organisation-owned devices, up from 61% (DSIT, Cyber Security Breaches Survey 2025/2026).
- Mobile-centric phishing simulations get a median click rate 40% higher than email (Verizon DBIR 2026).
- Phishing events on employee mobile devices grew 380% since January 2025 (Zimperium, 2026 Global Mobile Threat Report).
- 50% of organizations lost data and 46% suffered downtime in mobile-related incidents (Verizon Mobile Security Index 2025).
- 63% of organizations that rejected MDM experienced lost data in a security incident (Verizon Mobile Security Index 2025).
- Only 4% of organizations implemented all eight recommended mobile security practices (Verizon Mobile Security Index 2025).
- 67% of users access AI services with non-corporate accounts on corporate devices (Verizon DBIR 2026).
- SEC off-channel communications cases, many involving personal devices, passed 2 billion dollars in penalties against more than 100 firms (SEC, FY2024 enforcement results).
- The BYOD market is estimated at 152.79 billion dollars in 2026 (Mordor Intelligence, BYOD Market 2026).
1. BYOD Adoption and Device Policy: Permissive by Default, Tightening at the Edges
BYOD stopped being a pilot program years ago, and the best available survey still shows how broad the practice is. 82% of organizations actively enable BYOD to at least some extent, and the people bringing unmanaged devices are not only employees (70%) but also contractors (26%), partners (21%), customers (18%) and suppliers (14%) (Cybersecurity Insiders, 2021 BYOD Security Report). That is the core problem: a BYOD program is really an access program for people whose devices the company never sees.
Policy is moving the other way in the most rigorous government dataset. In the UK, 66% of businesses now only allow access via organisation-owned devices, up from 61% in 2024/2025, and the share climbs steeply with size, from 64% of micro firms to 96% of large businesses (DSIT, Cyber Security Breaches Survey 2025/2026). Charities, which rely heavily on volunteers and their personal phones, sit at 35%.
| Metric | Value | Source |
|---|---|---|
| Organizations that actively enable BYOD to some extent | 82% | Cybersecurity Insiders, 2021 BYOD Security Report |
| Who brings unmanaged devices | Employees 70%, contractors 26%, partners 21%, customers 18%, suppliers 14% | Cybersecurity Insiders, 2021 BYOD Security Report |
| Top barriers to BYOD adoption | Information security 30%, employee privacy 15%, support cost 9% | Cybersecurity Insiders, 2021 BYOD Security Report |
| UK businesses allowing access only via organisation-owned devices | 66% (61% in 2024/2025) | DSIT, Cyber Security Breaches Survey 2025/2026 |
| Same control by size | Micro 64%, small 82%, medium 90%, large 96% | DSIT, Cyber Security Breaches Survey 2025/2026 |
| UK charities with the same control | 35% | DSIT, Cyber Security Breaches Survey 2025/2026 |
| Mobile devices impacted by a cyberattack that are personal | 70% | Verizon Mobile Security Index 2025 |
Context note: the Cybersecurity Insiders figures are the most recent available data from a dedicated BYOD survey (2021), and the landing page does not publish the sample size. The UK survey interviewed 2,112 businesses and 1,085 charities between August and December 2025 using random probability sampling. The gap between “most firms allow BYOD” and “two thirds of UK businesses restrict access to company devices” is less contradictory than it looks: many organizations allow personal phones for email and chat while gating sensitive systems.
2. Mobile Phishing and Smishing: The Inbox Moved Into the Pocket
Email security improved, so attackers followed people to their phones. In phishing simulations, the median successful click rate in mobile-centric vectors such as voice and text messaging is 40% higher than via email (Verizon, 2026 DBIR Executive Summary). On a personal device, the work message and the delivery text arrive in the same thread, on a small screen, with no corporate email gateway in between.
Telemetry from mobile threat vendors points the same way. Zimperium reports that phishing events detected on employee mobile devices grew 380% since January 2025, that the number of devices where an employee clicked a malicious link grew 110% in 2025, and that almost 86% of phishing attacks now contain AI-generated elements (Zimperium, 2026 Global Mobile Threat Report press release). Its 2024 entry-point analysis put SMS at 27.8% and messaging apps at 24.4% of mobile phishing, ahead of email at 18.8% (Zimperium zLabs Mishing Report). SIM-based fraud is a close cousin of this trend, covered in our telecom fraud and SIM swap statistics.
| Metric | Value | Source |
|---|---|---|
| Organizations reporting mobile phishing attempts on employees | 80% | Verizon Mobile Security Index 2025 |
| Organizations where a quarter to half of staff clicked in smishing tests | 39% of those running simulations | Verizon Mobile Security Index 2025 |
| Organizations running phishing or smishing drills at least annually | 76% | Verizon Mobile Security Index 2025 |
| Mobile-centric vs email click rate in simulations | Median 40% higher | Verizon DBIR 2026 |
| Phishing events on employee mobile devices since January 2025 | +380% | Zimperium, 2026 Global Mobile Threat Report |
| Devices where an employee clicked a malicious link, 2025 vs 2024 | +110% | Zimperium, 2026 Global Mobile Threat Report |
| Mobile phishing entry points, 2024 | SMS 27.8%, messaging apps 24.4%, email 18.8%, PDF 14.4%, social 12.9%, QR 1.7% | Zimperium zLabs Mishing Report |
| QR-code phishing attacks detected, July 2025 to June 2026 | 145+ million | Microsoft Digital Defense Report 2026 |
Context note: vendor telemetry counts detections on devices running that vendor’s software, so growth rates partly reflect a growing customer base. Zimperium’s smishing detections concentrated in India (37%), the United States (16%) and Brazil (9%), and about 3% of analyzed phishing sites served different redirect paths depending on device type, hiding the mobile payload from desktop-based scanners. Consumer data show the scale outside the enterprise: people reported 470 million dollars in losses to text message scams in 2024, more than five times the 2020 figure (FTC, Top text scams of 2024).
3. Breach Consequences: Data Loss, Downtime and Insurance Penalties
Mobile incidents used to be treated as a nuisance, a lost phone and a password reset. The 2025 survey data say otherwise. 50% of organizations reported lost data, 46% experienced downtime and 36% faced cyber insurance penalties after a security incident, and among those that suffered downtime, 63% were down for more than one day, a 16-point jump year over year (Verizon, 2025 Mobile Security Index infographic).
Size does not buy immunity. 52% of enterprise respondents experienced a mobile cyberattack that resulted in system downtime, compared with 37% of SMBs, even though enterprises train more (66% train new hires on mobile security). Larger fleets and more integrations simply create more paths in. Broader breach data put a price on the outcome: IBM’s 2026 report puts the global average cost of a data breach at 4.99 million dollars, a 12% increase and a record high (IBM, Cost of a Data Breach Report 2026).
| Metric | Value | Source |
|---|---|---|
| Organizations reporting lost data | 50% | Verizon Mobile Security Index 2025 |
| Organizations reporting downtime | 46% | Verizon Mobile Security Index 2025 |
| Organizations facing cyber insurance penalties | 36% | Verizon Mobile Security Index 2025 |
| Downtime victims down for more than one day | 63% (up 16 points year over year) | Verizon Mobile Security Index 2025 |
| Mobile attack causing downtime: enterprises vs SMBs | 52% vs 37% | Verizon Mobile Security Index 2025 |
| SMBs saying they are at a resource disadvantage | 57% | Verizon Mobile Security Index 2025 |
| Global average cost of a data breach | 4.99 million dollars (up 12%) | IBM, Cost of a Data Breach Report 2026 |
| UK businesses with any breach or attack in the past 12 months | 43% (medium 65%, large 69%) | DSIT, Cyber Security Breaches Survey 2025/2026 |
Context note: the Verizon percentages come from a survey of security professionals, so they describe what respondents report, not audited incident counts. The IBM average covers all breaches, not mobile-only incidents, and is included to size the downside rather than to attribute it to BYOD.
4. The Human Element and the Wider Breach Picture
BYOD risk is mostly a human problem expressed through a device. The human element was present in 62% of breaches in Verizon’s 2026 DBIR, up from 60%, and the report notes attackers “increasingly using voice and other mobile-centric techniques to catch people off guard in the middle of the workday” (Verizon, 2026 DBIR). Pretexting reached 6% of all breaches as an initial access vector, while phishing held at 16%.
The rest of the DBIR explains why a single compromised phone matters. Exploitation of vulnerabilities is now the top initial access vector at 31%, ransomware appears in 48% of breaches and third-party involvement reached 48%, up 60% from the prior dataset. Only 26% of critical vulnerabilities in the CISA KEV catalog were fully remediated in 2025, down from 38%, which is the same patch-lag problem BYOD programs face when they cannot force operating system updates on personal hardware. Voice-based pretexting is increasingly aided by synthetic voices, a trend tracked in our voice cloning fraud statistics.
| Metric | Value | Source |
|---|---|---|
| Incidents and confirmed breaches analyzed | 31,000+ incidents, 22,000+ breaches, 145 countries | Verizon DBIR 2026 |
| Human element present in breaches | 62% (60% prior year) | Verizon DBIR 2026 |
| Pretexting / phishing as initial access vector | 6% / 16% of breaches | Verizon DBIR 2026 |
| Exploitation of vulnerabilities vs credential abuse as initial access | 31% vs 13% | Verizon DBIR 2026 |
| Ransomware share of breaches | 48% (44% prior year); 69% of victims did not pay | Verizon DBIR 2026 |
| Breaches with third-party involvement | 48% (up 60%) | Verizon DBIR 2026 |
| Critical KEV vulnerabilities fully remediated | 26% in 2025 (38% prior year); median 43 days | Verizon DBIR 2026 |
| Edge devices and VPNs as exploitation targets | 22% (3% the previous year) | Verizon DBIR 2025 |
Context note: the 2026 DBIR dataset covers October 2024 through November 2025. The edge-device figure comes from the 2025 DBIR, as cited in Verizon’s zero trust use case sheet. In the 2025 DBIR, Verizon analyzed 12,195 confirmed breaches and found third-party involvement at 30% (Verizon, 2025 DBIR news release), which shows how quickly that share climbed.
5. Controls That Work: MDM, Zero Trust and the Eight Best Practices
The most useful finding in the mobile data is the size of the gap between organizations that manage devices and those that do not. Organizations that rejected MDM were twice as likely to report extreme mobile risk (31%) as those with MDM (15%), and 63% of organizations that considered and rejected MDM experienced lost data in a security incident (Verizon, MDM use case sheet 2025). The organizations that implemented all eight recommended practices reported major repercussions only 12% of the time, against a survey average of 63%.
Almost nobody gets there. Only 4% of respondents implemented all eight mobile security best practices, and protections against newer threats are thin: 16% of businesses have protections against zero-day exploits and 17% have controls specific to AI-assisted attacks (Verizon, phishing use case sheet 2025). The practical message for BYOD programs is that management and access policy, not device ownership, decide most outcomes. NIST’s BYOD practice guide frames the trade-off directly, noting that BYOD creates “new privacy risks to employees” by giving the employer access to personal devices (NIST SP 1800-22, Mobile Device Security: BYOD, 2023).
| Metric | Value | Source |
|---|---|---|
| Extreme mobile risk: rejected MDM vs using MDM | 31% vs 15% | Verizon Mobile Security Index 2025 |
| Organizations that rejected MDM and lost data | 63% | Verizon Mobile Security Index 2025 |
| Major repercussions: all eight practices vs survey average | 12% vs 63% | Verizon Mobile Security Index 2025 |
| Organizations implementing all eight best practices | 4% | Verizon Mobile Security Index 2025 |
| Auto-revoking mobile access on risk signals: MDM users vs non-users | 71% vs 57% | Verizon Mobile Security Index 2025 |
| Zero trust adoption: large enterprises vs SMBs | 47% vs 38% (average 43%) | Verizon Mobile Security Index 2025 |
| Businesses with protections against zero-day exploits | 16% | Verizon Mobile Security Index 2025 |
| UK businesses with up-to-date malware protection | 81% (charities 63%) | DSIT, Cyber Security Breaches Survey 2025/2026 |
Context note: the MDM comparisons are correlational. Organizations that adopt MDM tend to have larger and more mature security teams, so the gap reflects more than the tool itself. Verizon’s eight practices are MDM and UEM, mobile threat defense, zero trust, SASE, secure enterprise browser and secure web gateway, EDR, MDR and cyber risk quantification. NIST’s broader mobile guidance, SP 800-124 Rev. 2 (May 2023), explicitly covers both organization-provided and personally owned deployment scenarios.
6. Shadow AI, Off-Channel Messaging and the Market Response
Two newer risks ride on personal devices. The first is generative AI: 93% of organizations report employees using genAI tools on mobile devices, and 64% name data compromise from employees entering sensitive information into genAI as their top mobile device use risk (Verizon Mobile Security Index 2025). Verizon’s 2026 DBIR found 67% of users access AI services with non-corporate accounts on corporate devices, while regular AI users on corporate devices jumped from 15% to 45%. MDM users are more likely to have defined and enforced genAI policies (59% vs 45%).
The second is regulated communications. US regulators have turned personal-device messaging into one of the most expensive compliance failures on record. The SEC’s first case found JPMorgan employees “often communicated about securities business matters on their personal devices, using text messages, WhatsApp, and personal email accounts” and imposed a 125 million dollar penalty (SEC, December 17, 2021). Since December 2021 the initiative has charged more than 100 firms with more than 2 billion dollars in penalties (SEC, FY2024 enforcement results). The CFTC added more than 710 million dollars against 11 institutions for messages sent “via personal text, WhatsApp or Signal” (CFTC, September 27, 2022). Approved collaboration channels are the alternative, as tracked in our enterprise unified communications statistics.
| Metric | Value | Source |
|---|---|---|
| Organizations reporting employee genAI use on mobile | 93% | Verizon Mobile Security Index 2025 |
| Users accessing AI with non-corporate accounts on corporate devices | 67% | Verizon DBIR 2026 |
| Regular AI users on corporate devices | 45% (15% prior year) | Verizon DBIR 2026 |
| SEC off-channel cases since December 2021 | More than 100 firms, more than 2 billion dollars | SEC, FY2024 enforcement results |
| SEC, September 27, 2022 action | 16 firms, more than 1.1 billion dollars combined | SEC press release 2022-174 |
| CFTC, September 27, 2022 action | 11 institutions, more than 710 million dollars | CFTC press release 8599-22 |
| BYOD market size | 132.22 billion dollars (2025), 152.79 billion dollars (2026), 315.07 billion dollars (2031), 15.62% CAGR | Mordor Intelligence, BYOD Market 2026 |
| MDM market size | 11.11 billion dollars (2026) to 26.04 billion dollars (2031), 18.57% CAGR | Mordor Intelligence, MDM Market 2026 |
Context note: in Mordor’s MDM report, corporate-owned devices still held 56.91% of spending in 2025, while BYOD is the faster-growing ownership segment (21.32% CAGR). Its BYOD report gives North America 38.10% of the market and smartphones 48.02% by device type (Mordor Intelligence, BYOD Market; Mordor Intelligence, MDM Market). The SEC actions of August 14, 2024 (26 firms, 392.75 million dollars) and January 13, 2025 (12 firms, 63.1 million dollars) continued the sweep.
Summary: BYOD Security by the Numbers
| Metric | Value | Source |
|---|---|---|
| Mobile devices impacted by cyberattacks that are personal | 70% | Verizon Mobile Security Index 2025 |
| Organizations saying mobile attacks are increasing | 85% | Verizon Mobile Security Index 2025 |
| Organizations enabling BYOD to some extent | 82% | Cybersecurity Insiders, 2021 BYOD Security Report |
| UK businesses allowing access only from organisation-owned devices | 66% | DSIT, Cyber Security Breaches Survey 2025/2026 |
| Organizations reporting mobile phishing attempts | 80% | Verizon Mobile Security Index 2025 |
| Mobile-centric vs email simulation click rate | Median 40% higher | Verizon DBIR 2026 |
| Phishing events on employee mobile devices since January 2025 | +380% | Zimperium, 2026 Global Mobile Threat Report |
| SMS share of mobile phishing entry points, 2024 | 27.8% | Zimperium zLabs Mishing Report |
| Organizations reporting lost data / downtime | 50% / 46% | Verizon Mobile Security Index 2025 |
| Organizations facing cyber insurance penalties | 36% | Verizon Mobile Security Index 2025 |
| Downtime longer than one day | 63% of downtime victims | Verizon Mobile Security Index 2025 |
| Global average cost of a data breach | 4.99 million dollars | IBM, Cost of a Data Breach Report 2026 |
| Human element in breaches | 62% | Verizon DBIR 2026 |
| Extreme mobile risk without vs with MDM | 31% vs 15% | Verizon Mobile Security Index 2025 |
| Organizations with all eight mobile practices | 4% | Verizon Mobile Security Index 2025 |
| Users on non-corporate AI accounts on corporate devices | 67% | Verizon DBIR 2026 |
| SEC off-channel penalties since December 2021 | More than 2 billion dollars, 100+ firms | SEC, FY2024 enforcement results |
| Text message scam losses reported to the FTC, 2024 | 470 million dollars | FTC Data Spotlight 2025 |
| BYOD market, 2026 | 152.79 billion dollars | Mordor Intelligence, BYOD Market 2026 |
Methodology and Sources
Every figure above was read during research for this article in a primary report, survey publication, government release or regulator press release. Vendor telemetry and vendor-sponsored surveys are labelled as such, and we do not combine figures from different methodologies into new totals.
- Verizon Business: 2025 Mobile Security Index (landing page), 2025 MSI infographic, MDM use case sheet, phishing use case sheet, zero trust use case sheet, enterprise and SMB infographic
- Verizon Business: 2026 Data Breach Investigations Report, 2026 DBIR Executive Summary, 2025 DBIR news release
- UK Department for Science, Innovation and Technology: Cyber Security Breaches Survey 2025/2026 (April 30, 2026), Cyber Security Breaches Survey 2025
- Cybersecurity Insiders: 2021 BYOD Security Report
- Zimperium: 2026 Global Mobile Threat Report press release (July 29, 2026), zLabs Mishing Report
- Microsoft: Microsoft Digital Defense Report
- IBM: Cost of a Data Breach Report 2026
- US Securities and Exchange Commission: JPMorgan, December 17, 2021, 16 firms, September 27, 2022, 26 firms, August 14, 2024, FY2024 enforcement results, 12 firms, January 13, 2025
- US Commodity Futures Trading Commission: 11 institutions, September 27, 2022
- US Federal Trade Commission: Top text scams of 2024 (April 14, 2025)
- NIST: SP 1800-22, Mobile Device Security: BYOD (September 2023), SP 800-124 Rev. 2 (May 2023)
- CISA: Mobile Communications Best Practice Guidance, aimed at highly targeted individuals in government, military and political roles (page dated March 13, 2026)
- Mordor Intelligence: BYOD Market, Mobile Device Management Market
- Data watch: Public BYOD-specific survey data is thin. The only dedicated BYOD adoption survey we could verify is Cybersecurity Insiders’ 2021 report, so its 82% adoption figure is the most recent available data and is older than three years; its landing page does not state the sample size. The Verizon Mobile Security Index 2025 full PDF sits behind a registration form, so its figures were taken from Verizon’s published infographic and use case sheets, which cite the report (dated October 22, 2025); the survey sample size is described only as hundreds of security professionals. Two Verizon infographic figures (recovery confidence and access-control shares) could not be mapped to their labels with certainty and were excluded. Zimperium figures are vendor telemetry from its own customer devices and the press release does not give device counts. The BYOD market estimate comes from a single firm: Grand View Research blocked access with a CAPTCHA and other market pages we tried returned unrelated or missing reports, so we could not cross-check it with a second firm; Mordor’s own UEM report (7.07 billion dollars in 2025 to 27.03 billion dollars by 2031) shows how much these segment definitions vary. Microsoft’s digital defense report page is labelled 2026 and covers July 2025 to June 2026, while its URL carries a 2025 slug. The full Verizon 2025 MSI, Lookout and Jamf mobile threat reports could not be read and were not used.
Last updated: October 3, 2026. We update this roundup quarterly, and the next refresh is expected when Verizon publishes its next Mobile Security Index and DSIT releases the next Cyber Security Breaches Survey.