- BFSIBanking, Financial Services & Insurance
- IT & ITESIT services, BPM, GCCs & SaaS
- Retail & e-commerceStore chains, D2C brands & marketplaces
- HealthcareComing soon
- ManufacturingComing soon
Omnissa Workspace ONE Mobile Threat Defense
A text says the parcel is held. Your sales lead taps the link on a phone with full mail access — Omnissa Workspace ONE Mobile Threat Defense is an add-on for Workspace ONE UEM customers: Lookout’s detection, running inside Intelligent Hub, guards iOS and Android phones against phishing, risky apps and rogue Wi-Fi — and a risky phone loses access automatically.
Buy through TechBag
Same software. Better outcome — at a lower cost.
How it’s rated
Full scoreboard ↓Quick answer
The Omnissa platform family
This page covers Omnissa Workspace ONE Mobile Threat Defense — an add-on that needs Workspace ONE UEM. The rest:
Quick facts
30-second orientation- Requires
- Workspace ONE UEM; it attaches to Mobile Essentials, UEM Essentials, Enterprise or Platinum only
- Engine
- Powered by Lookout’s threat intelligence, by Omnissa’s account; Omnissa sells and integrates it
- Platforms
- iOS and Android across corporate, BYOD and rugged; ChromeOS via Lookout for Work’s Android app
- Threats
- Phishing in email, SMS, social and chat apps; malicious apps; rogue Wi-Fi; device and OS flaws
- On the phone
- Intelligent Hub is the security agent, so protection needs no second app to activate it
- Response
- Risk score feeds UEM compliance and Access; Orchestrator can coach, uninstall or quarantine
- Price
- A per-device monthly add-on with no published price; not included even in Platinum
- Analysts
- No dated analyst placement for this add-on is published; ask Omnissa for current evidence
- India
- No MTD component on Omnissa’s status page, so where threat data is processed is not stated
- In India via
- TechBag — edition check, per-device quote in INR with GST, a Lookout and Zimperium comparison
Understand mobile threat defence before you buy it
Most product pages skip this. We start here — so you buy a capability, not a buzzword.
What is mobile threat defence?
MTD protects phones from phishing, risky apps and network attacks, the threats a laptop security tool never sees.
Phones left to their users vs Workspace ONE Mobile Threat Defense — the honest table
What consolidation actually replaces, dimension by dimension.
| Dimension | Phones left to their users | Omnissa Workspace ONE Mobile Threat Defense |
|---|---|---|
| Second app | A separate MTD app pushed to every phone | Protection switched on inside Intelligent Hub |
| Phishing by SMS | Staff told to be careful | Links in texts and chats checked before the tap |
| Risky phone | Found in a quarterly review | Risk score cuts access through UEM and Access |
| Response | Email the user and hope | Orchestrator coaches, uninstalls or quarantines |
| SOC view | No mobile events at all | Threat events forwarded to your SIEM |
| What it is NOT | — | A standalone product, or part of any edition |
The cheapest test is one smart group, such as field sales, for a month: count the phishing links and risky apps it catches before rolling out.
The four pieces of the platform
Vendors love diagrams; buyers need to know what they’re actually operating. Here’s the whole platform, demystified.
Intelligent Hub
The Hub app staff already use for enrolment and the app catalogue doubles as the security agent: it watches for threats and alerts the user, with no second app to deploy.
MTD console
A console for the security team with threat visibility, policy management and basic reporting, separate from the UEM console where IT administrators work.
Lookout engine
Omnissa says Lookout’s threat intelligence and global threat feeds power detection of phishing, risky apps and network attacks: the engine is Lookout’s, not Omnissa’s.
Policy layer
A device risk score feeds UEM compliance and Access conditional access; Freestyle Orchestrator and Intelligence can coach the user, remove apps or quarantine the phone.
Intelligent Hub carries Lookout’s detection on the phone; the risk score flows to UEM compliance and Omnissa Access, and Orchestrator acts on it.
Nine capabilities. Detect, respond, deploy.
Omnissa Workspace ONE Mobile Threat Defense turns Intelligent Hub into a phone security agent — and its risk score into an access decision.
Links in texts and chats
Phishing checks cover email, SMS, social media and messaging apps, and a pre-click smishing assessment arrived in September 2025.
Malicious and risky apps
Mobile malware, vulnerable apps, zero-day threats and risky app behaviour or configuration are flagged, per Omnissa’s product page.
Rogue Wi-Fi and web threats
Rogue Wi-Fi and web threats are detected, and the add-on coexists with Workspace ONE Tunnel, so app VPN and phishing checks run together.
Risk score into compliance
The device risk score becomes a UEM compliance input, so a compromised phone loses access to corporate resources until it is clean.
Conditional access follows risk
Omnissa Access reads the same risk score for conditional access, restricting sensitive apps on a phone as its risk level rises.
Coach, remove, quarantine
Freestyle Orchestrator and Omnissa Intelligence automate the response: coach the user, uninstall a risky app or quarantine the device.
Protected at enrolment
Phones are protected as soon as they enrol in Workspace ONE UEM, because activation rides on Intelligent Hub rather than a new app.
Work profile and COPE
Dual enrolment with Android work profile and COPE is supported, and smart-group assignment lets you roll out by team or site.
SIEM feed and audit evidence
Threat events forward to a SIEM, and built-in reports give audit evidence; OS posture shows which phones lag on updates.
Watch Workspace ONE Mobile Threat Defense in action
Two videos from Omnissa’s official channel: a 2025 demo embedded on the product page, and a 2024 explainer from Omnissa’s first months.
Protect Mobile Devices with Omnissa Workspace ONE Mobile Threat Defense | Demo
A 1:47 demo, embedded on Omnissa’s product page, of phishing and malicious content blocked on a managed phone.
Protect Mobile Devices from Security Threats with Workspace ONE Mobile Threat Defense
A two-minute explainer from Omnissa’s first months on the threats the add-on covers and how it ties into UEM.
Want a live, India-context walkthrough for your environment?
Book a guided demo →Phones carry company mail and no security agent. This add-on puts one inside Intelligent Hub.
Here’s what genuinely sets it apart — and exactly where it stops.
Threat defence through the app staff already have
Most mobile threat defence projects stall on getting a second app onto every phone. Here Intelligent Hub, installed at enrolment, is the agent, so protection starts the moment a device joins Workspace ONE UEM. Android work profile and COPE dual enrolment are supported, and smart groups let you phase it in.
Risk that changes access, not just a dashboard
A phishing tap or a rogue network raises the phone’s risk score, which UEM compliance and Omnissa Access conditional access both read. Orchestrator workflows then act: warn the user, remove the app or quarantine the phone until its posture recovers, with each event sent on to your SIEM.
Lookout’s engine, Omnissa’s integration
Detection comes from Lookout, a mobile security specialist that Omnissa names on its product page. You get Lookout-grade phishing, app and network detection without buying and connecting Lookout’s standalone product, and the smishing check added in September 2025 assesses a link before the user taps it.
Where it stops
It needs Workspace ONE UEM and Intelligent Hub, cannot attach to Employee or Desktop Essentials, and is extra even on Platinum. Only iOS and Android are covered natively, with ChromeOS through Lookout’s Android app. Omnissa prints no price and no processing region. Ask what happens if the Lookout arrangement changes.
The numbers behind the platform
What your Mobile Threat Defense rollout looks like
Count the phones in scope
List iOS and Android devices by ownership and team, and confirm each sits on an edition that can take the add-on.
Get the add-on quoted
Ask for the per-device monthly price in writing, plus where threat data is processed, since no region is published for it.
Pilot one smart group
Switch protection on through Intelligent Hub for one smart group, such as field sales, and watch the phishing and app alerts.
Wire up the response
Tie the risk score to UEM compliance and Access, build one Orchestrator workflow, and forward events to your SIEM.
Roll out and sign
Extend to every mobile smart group, review alert volume with the SOC, and settle the INR quote with GST through TechBag.
The review scoreboard
Modelled on Gartner Peer Insights structure. *Counts and breakdowns are illustrative pending verified review collection.
Quick poll — what’s driving your evaluation?
Talk to an advisor“Hub was already on every phone, so switching on threat defence took a policy change, not a second app rollout to 3,000 users.”
“Smishing links aimed at our medical reps now get flagged before anyone taps. That alone justified the add-on for the field force.”
“A rooted handset fell out of compliance and lost mail access on its own. Nobody on the helpdesk had to chase that user down.”
“The MTD console’s reporting is basic, so our SOC investigates from the SIEM feed instead. Plan for that before you go live.”
“We assumed Platinum included it and found it did not. Budget this per device on top of whichever Workspace ONE edition you pick.”
“Compliance asked where threat data is processed. The status page lists nothing for this add-on, so the answer went into the contract.”
Where everyone sits — the grids
Analyst firms bury this view behind paywalls, and review-site grids score satisfaction, not fit for your estate. So here’s TechBag’s synthesis of the Mobile threat defence market — tap any vendor to see why it sits where it does.
TechBag Mobile Threat Defense Grid
Execution strength vs product vision — the classic market map, minus the paywall.
Add-on to Workspace ONE UEM; price unpublished.
Detection Breadth × Access Response
The grid nobody publishes — how many kinds of mobile threat a product detects vs how directly a detection changes what the phone can reach.
Phishing, apps, network, OS; risk drives UEM and Access.
Positions are TechBag’s illustrative synthesis of public review-platform data and vendor documentation — not a reproduction of any analyst graphic. Verify before relying on it.
Workspace ONE Mobile Threat Defense vs the MTD field
Against Lookout, Zimperium, Microsoft Defender for Endpoint, CrowdStrike Falcon for Mobile and Check Point Harmony Mobile — on platforms, phishing, apps, networks, UEM ties, price and India data.
| Dimension | Omnissa Workspace ONE Mobile Threat Defense | Lookout Mobile AI Security | Zimperium Mobile Threat Defense | Microsoft Defender for Endpoint | CrowdStrike Falcon for Mobile | Check Point Harmony Mobile |
|---|---|---|---|---|---|---|
| What it is | MTD add-on to UEM | The engine, sold direct | On-device MTD specialist | MTD in Defender licence | Mobile on Falcon | Now ‘Mobile Security’ |
| Deployment | Omnissa cloud, via Hub | SaaS only | Cloud, on-prem, air-gap | Microsoft cloud | Falcon cloud | Infinity Portal SaaS |
| Platforms | iOS, Android; Chrome app | iOS, Android; Chromebooks | iOS, Android, ChromeOS | iOS and Android | Android and iOS | iOS and Android |
| Phishing and smishing | SMS, chat, pre-click | SMS, RCS, chat, calls | AI smishing checks | Web protection | Links in texts and QR | Smishing: iOS blocks |
| Malicious apps | Malware, risky apps | App risk plus EDR | On-device app checks | Android scanning only | Mobile malware | Apps and downloads |
| Network attacks | Rogue Wi-Fi, web | Rogue Wi-Fi, MITM | Unsafe networks | Network Protection | Network disruption | MITM prevention |
| Device and OS risk | Device and OS flaws | Vulnerable OS and apps | OS risk, jailbreak | Vulnerability assessment | Jailbreak; CVEs unstated | OS CVEs, root |
| UEM integration | Workspace ONE only | Many MDM connectors | Broad UEM partners | Intune-first | Your UEM, unnamed | Eleven UEMs listed |
| Response and access | UEM and Access act | Via MDM, plus EDR | MDM, SIEM, SOAR, XDR | Intune and Entra act | One Falcon console | Risk to your UEM |
| Pricing model | Per device, add-on | Not published | Quote only | Per user, in bundles | In Falcon bundles | Quote only |
| Published entry price | Not published | Not published | Not published | $3 a user for SMBs | $59.99/device/yr bundle | Not published |
| India data region | Not on status page | Not documented | On-prem possible | India listed, conflict | India cloud planned | India hosting, 2021 |
| Lock-in and exit | Tied to Workspace ONE | MDM-neutral | Works with many UEMs | Tied to Microsoft | Tied to Falcon | Tied to Infinity |
| Best fit | Workspace ONE estates | Multi-MDM estates | Air-gapped, regulated | Microsoft E5 shops | Falcon-first SOCs | Check Point estates |
Which approach fits you?
Honest fit signals — because the fastest way to lose your trust is to pretend one product wins every scenario.
Choose Omnissa Workspace ONE Mobile Threat Defense if…
- ✓You already run Workspace ONE UEM on Mobile Essentials or higher and want phone threat defence with no second app
- ✓Phishing by SMS and messaging apps is reaching your field and sales staff
- ✓You want a risky phone to lose access automatically through UEM compliance and Omnissa Access
Compare alternatives if…
- ✓You need on-premises, air-gapped or native ChromeOS protection — Zimperium documents all three
- ✓Your users hold Microsoft 365 E5 — Defender for Endpoint already covers iOS and Android
- ✓You may change MDM later — Lookout and Check Point connect to many UEMs
Do not expect…
- ✓A standalone product for phones outside Workspace ONE UEM
- ✓Threat defence inside any Workspace ONE edition — even Platinum charges for it
- ✓A published price or a documented processing region
TechBag has no mobile threat defense guide yet, so Omnissa Workspace ONE Mobile Threat Defense sits outside the category guides. Browse all products to compare it with the rest of the catalogue. →
What does handling mobile threats by hand cost you?
Drag the sliders (phones you manage; security-hour cost). Estimates model the time spent investigating phishing reports, suspect apps and lost or compromised phones by hand, at an assumed 0.3 hours per phone a month, with 50% of it removed by automatic detection and risk-based access. Both figures are assumptions. Illustrative.
Loaded cost = salary + overheads per productive hour. Illustrative only — your TechBag quote models your actual environment and modules.
Three ways to consume it
Quote only. Omnissa sells Workspace ONE Mobile Threat Defense as a per-device, per-month add-on to Workspace ONE UEM but publishes no figure for it. It can be added to Mobile Essentials, UEM Essentials, Enterprise and Platinum (and the matrix’s unpriced Standard and Advanced columns), is not offered with Employee or Desktop Essentials, and is not included in any edition, Platinum among them. TechBag gets the per-device rate quoted in INR with GST, on top of your Workspace ONE edition.
Mobile Threat Defense add-on
Best for Workspace ONE fleets with phones in the field
- Per device per month; quoted
- Runs in Intelligent Hub, no new app
- Risk feeds UEM and Access
+ Platform add-ons
Best for a broader rollout
- Scoped to your estate
- Add-on modules as needed
- Phased, right-sized deployment
Workspace ONE UEM edition
Needed first: Mobile Essentials or above
- Mobile Essentials $3.00 a device a month
- Not available on Employee or Desktop Essentials
- Not included even in Platinum
Buy it for less — TechBag pricing beats list
Whatever the list prices above, TechBag negotiates a significantly better deal — with GST-compliant INR invoicing and local support. Ask us for your discounted quote.
Get an India-ready quote
Tell us your requirements and current tools — we’ll model it against what you spend today.
The 8 questions to ask every vendor
Take this into your next vendor call — including ours.
Is every phone group on Mobile Essentials, UEM Essentials, Enterprise or Platinum, the editions this add-on attaches to?
What is the per-device monthly price, for what term, and how does it compare with Lookout or Zimperium bought direct?
Where is mobile threat data processed and stored? No MTD component is on Omnissa’s status page, so get it in writing.
If Omnissa’s arrangement with Lookout changed, what would happen to detection, the console and your contract?
Do you run Chromebooks? Protection there runs through Lookout for Work’s Android app, so test it before you count it.
Which responses run automatically, which need an admin, and how quickly does an access block take effect on a phone?
What does Hub collect from BYOD phones for threat detection, and how will you explain it to staff under the DPDP Act?
Which SIEM does your SOC run, and does the event feed carry enough detail to investigate without the MTD console?
Questions buyers ask
Ready to evaluate Workspace ONE Mobile Threat Defense?
List your phones by team and ownership, or let a TechBag advisor check your edition, get the per-device price and processing region from Omnissa in writing, and compare Lookout direct.
Stats, ratings, review counts and pricing are illustrative and sourced from public materials; verify before purchase.