What is included in ThreatDown Powered by Malwarebytes Mobile Security Corporate?

Real-time protection – Runs continuously on Android, iOS and ChromeOS devices.
Malicious app protection – Blocks harmful applications on Android devices only.
Safe web browsing – Filters sites in Chrome on Android and ChromeOS.
Safari web protection – Blocks suspicious sites in Safari on iOS devices.
Central policy management – Mobile policies and detections sit in the Nebula console.
Important – No malware or file scanning on iOS and iPadOS.

What are the main benefits of ThreatDown Mobile Security Corporate?

ThreatDown Mobile Security Corporate is an add-on module that extends ThreatDown endpoint protection to company Android, iOS, iPadOS and ChromeOS devices, managed from the same cloud console as your Windows, Mac and Linux endpoints. Malwarebytes sold it as Malwarebytes Mobile Security for Business before renaming its business range to ThreatDown in November 2023, so both names still appear in search results and in older quotes.

One console – Mobile and desktop detections appear in the same view.
MDM based rollout – Deploy silently using a configuration token from Nebula.
Email self activation – Send install links to users without an MDM.
Ransomware protection – Available on Android endpoints only, not on iOS.
Ad and tracker blocking – Blocks ads and trackers on ChromeOS and iOS.
Mobile endpoint inventory – Mobile devices appear alongside other endpoints for reporting.

Best antivirus? Why Windows Defender alone is not enough
Explains why the protection built into a platform rarely covers everything an organisation needs, and where an additional managed layer earns its place.

Which company size is ThreatDown Mobile Security Corporate suitable for?

The deciding factor is not headcount but whether you already run ThreatDown for your workstations. Because this is an add-on to an existing bundle, it is a natural extension for organisations already using Nebula, and a poor fit as a standalone purchase for a company that protects its desktops with something else.

Does ThreatDown Mobile Security Corporate meet the requirements of Swiss cybersecurity legislation?

The revised Information Security Act obliges operators of critical infrastructure in Switzerland to report cyberattacks, so a machine shop or an agency outside those sectors is usually not directly affected, while an energy supplier, hospital or public administration is. Where the obligation applies, an attack must be reported to the Federal Office for Cybersecurity (BACS) within 24 hours of discovery, which means the practical question is how quickly you can establish what happened on which device. Mobile Security supports that in one narrow way: every detection on an enrolled Android, iOS or ChromeOS device is written to the Nebula console with device identifier and timestamp, so a mobile endpoint can be ruled in or out during the first hours of an investigation instead of being a blind spot. It does not detect the incident for you, does not produce a forensic timeline, and on iOS records only web and ad-blocking events rather than file or application activity. It also covers nothing outside mobile devices, and most reportable incidents originate on servers, workstations or identity systems, so the reporting obligation cannot be met with this module alone. This description is a technical overview and not legal advice; whether your organisation falls under the reporting obligation should be clarified with qualified legal counsel.

Does ThreatDown Mobile Security Corporate meet the requirements of European cybersecurity legislation?

No software product makes an organisation NIS 2 compliant, because the directive addresses management responsibility and documented processes rather than tooling. NIS 2 requires member states to impose measures in defined categories, including risk analysis and information system security policies, incident handling, business continuity, supply chain security, security in the acquisition and maintenance of systems, procedures to assess whether measures actually work, basic cyber hygiene and training, cryptography, access control and asset management, and multi-factor authentication. Mobile Security contributes to two of those categories in a concrete way: basic cyber hygiene, because malware and web-threat protection is enforced centrally by policy rather than left to the user, and asset management, because enrolled mobile devices appear in the same endpoint inventory as the rest of the estate. It contributes nothing to incident handling as a process, business continuity, cryptography, access control or multi-factor authentication, and it does not assess your suppliers. Treat it as one measure inside a mobile hygiene control, not as evidence of a security programme.

Does ThreatDown Mobile Security Corporate help with security questionnaires from large customers?

Partly, and it helps most with the questions that ask whether mobile endpoints are protected and managed at all. It gives you a defensible answer to the items on managed anti-malware coverage for mobile devices, central policy enforcement, and a maintained inventory of mobile endpoints with detection history you can export from the console. On the vendor-assurance side, Malwarebytes holds SOC 2 Type II, ISO 27001 and PCI DSS attestations audited by Schellman, with the underlying reports released only under NDA, which is normally enough to satisfy a third-party risk section. It does not answer the device management questions at all: passcode enforcement, remote wipe, device compliance state, jailbreak or root posture, mobile encryption, mobile data loss prevention and multi-factor authentication are all outside its scope, and on iOS it also cannot answer application or file scanning questions. The cheaper route to closing the endpoint-side gaps is a higher ThreatDown bundle rather than a second vendor, since Advanced adds Drive Encryption and Patch Management and Ultimate adds identity threat detection, all in the same console. The device management gap is different in kind and can only be closed with an actual MDM, which you will need anyway for silent deployment.

Which limitations should you know before buying?

The most important one is that this is an add-on and not a standalone product: it requires an existing ThreatDown bundle and the Nebula console, so it cannot be used to protect mobile devices in an environment running a different endpoint vendor. Protection depth differs sharply per platform, and iOS is by far the thinnest, with Safari web filtering and ad blocking but no malicious app protection, no file scanning, no ransomware protection and no scan function at all. ChromeOS sits in the middle, and Android is the only platform where the full protection set applies, while curiously being the only one without ad and tracker blocking. It is also not a mobile device management system: enrolment runs either through your own MDM using a configuration token generated in Nebula, or by emailing an activation link to the user, and device control functions such as remote wipe or passcode policy remain with the MDM. Finally, on data location, Malwarebytes operates a European data centre for Nebula but describes it as applying to a limited set of accounts provisioned after 3 August 2026, recognisable by a login URL containing .euc1; because Switzerland is not an EU member state, Swiss buyers with data residency requirements should confirm in writing which data centre their tenant runs in before ordering.

What does a VPN protect against, and what doesn't it?
A useful companion read on drawing the line between what a security tool genuinely covers and what people assume it covers.

Frequently asked questions about ThreatDown Mobile Security Corporate

Does it replace a mobile device management system?

No. Malwarebytes designed it to sit alongside an MDM rather than to replace one, and the recommended rollout path is to add the app to your existing MDM together with a configuration token generated in the Nebula Download Center. Without an MDM you can still deploy by emailing an activation link, but the user then has to complete installation and grant permissions manually.

Can it be used on employee-owned phones?

Malwarebytes states that Mobile Security for Business is intended for use on corporate mobile devices, and places responsibility on the customer for ensuring lawful use and obtaining any necessary consents, explicitly including bring-your-own-device programmes. In practice that means a BYOD rollout needs a documented consent process and, in Switzerland and the European Union, a data protection assessment before you enrol private handsets.