COMMENTARY: Security leaders have hardened networks, cloud infrastructure, data centers, endpoints, and applications. But another layer is where critical decisions are made, crisis response is coordinated, and sensitive information moves rapidly: mobile communications.
Mobile is now a core operational pillar for governments, critical infrastructure providers, and large enterprises. It is also a growing attack surface, as sensitive conversations increasingly happen across mobile-first channels where identity, location, and metadata move through global systems that are difficult to control and easy to underestimate.
[SC Media Perspectives columns are written by a trusted community of SC Media cybersecurity subject matter experts. Read more Perspectives here.]
BlackBerry’s State of Secure Communications 2026 research found that 83% of security leaders report WhatsApp is used for sensitive discussions, and 75% say employees bypass approved communications tools at least sometimes for efficiency.
Those findings should give security teams pause. The channels where critical decisions happen are often subject to less governance and security review than the systems those organizations work so hard to protect.
Consumer messaging apps have become unintentional business infrastructure
Consumer messaging apps became embedded in business life for understandable reasons. They are familiar, fast, easy to install, and widely used globally. They simplify communicating with partners, suppliers, external contractors, and field teams who don't share the same internal tools.
That convenience is why mobile channels are highly used. But it is also why they create risk.
Related reading:
Many consumer messaging platforms were not designed for government-grade or critical-infrastructure communications. They were not built around the assurance requirements, identity controls, audit needs, or crisis demands that high-risk organizations face. Yet in practice, they are frequently used as if they can support those needs.
This creates a significant gap between how these tools are used and what they were built to protect. A platform may be appropriate for routine coordination, but that does not make it appropriate for sensitive operational decisions, executive communications, or high-value data sharing.
Security teams need to map how people actually communicate
The problem is not simply employee carelessness. In many cases, employees are trying to solve an operational problem:
- Approved tools may be too slow, too limited, poorly adopted, or unavailable to external parties.
- Policies might be unclear.
- Partners may insist on using familiar channels.
- During a crisis, people may default to whatever works fastest.
Security leaders need to understand this behavior instead of only prohibiting it on paper. If unapproved tools are easier, faster, or more interoperable, they have already become part of the organization’s real communications environment and should be assessed accordingly. That process starts with practical questions.
Where do sensitive conversations actually happen? Which channels are formally approved, and which are merely tolerated? Which external partners or emergency workflows depend on mobile-first communications? What conversations should be restricted to secure, administratively controlled channels?
Until organizations can answer those questions, they do not have a complete view of their communications risk.
Once consumer messaging platforms are acknowledged as part of operational reality, the next question is whether they provide the security decision makers assume they do. Too often, mobile security discussions stop at encryption, creating a false sense of assurance that obscures broader risks.
The issue is not whether encryption matters, but whether it is being mistaken for a complete communications security strategy.
Encryption is not the same as a secure communications model
One of the most persistent misconceptions in mobile communications security is that end-to-end encryption is equivalent to a complete security model.
It is not.
End-to-end encryption is important. It helps protect message content in transit. But it does not, by itself, verify the identity of the people communicating. It does not secure a compromised device. It does not protect metadata, communication patterns, location information, or the broader context around a conversation. It does not protect information before it is encrypted or after it is decrypted. And it does not prevent a user from being tricked into communicating with the wrong person, clicking a malicious link, or adding an unauthorized participant to a group chat.
This distinction is notable because adversaries do not need to break encryption if they can exploit the systems, identities, and behaviors around it.
The real risk sits around the encrypted channel
An attacker may target account access through phishing, use impersonation or deepfakes to mislead staff, compromise a device to view messages after decryption, or collect metadata to map who is communicating, when, and how relationships inside an organization are structured.
The result is a dangerous confidence gap. Organizations may believe they are using a secure channel because messages are encrypted, while the actual risks sit outside the encrypted tunnel.
For security leaders, the lesson is clear: encryption is one layer of protection, not the entire model. A secure communications approach must also account for identity verification, device integrity, metadata exposure, account controls, data retention, group membership, administrative visibility, and the workflows that determine how information moves.
If those elements are not addressed, organizations may be relying on a protected channel inside an unprotected process.
The mobile threat model needs to include the full communications stack
Mobile communications security cannot be reduced to whether an app is encrypted. The full stack matters.
Security leaders should model telecom infrastructure, platform architecture, metadata, account access, identity verification, device integrity, storage, group membership, confidential and private conversation pathways, and crisis communications workflows. They should also consider the less visible — but still essential — channels that organizations often depend on during disruption, including landlines, cell phones, phone trees, and mobile email.
This is particularly important for governments and critical infrastructure organizations, where operational continuity may depend on communication under degraded conditions. When a cyberattack, outage, natural disaster, or infrastructure disruption occurs, normal channels may be unavailable, unreliable, or untrusted. Teams might need to coordinate across agencies, vendors, field personnel, and leadership while systems are isolated or under investigation.
In that environment, communication is not a side issue. It is part of the response architecture.
Crisis response depends on trusted coordination
Recent telecom and messaging platform risks reinforce this point.
Adversaries can target communications infrastructure, account access, devices, or metadata that reveals patterns of activity. State-backed actors have also targeted consumer messaging accounts through phishing, impersonation, and account takeover.
These risks can become more dangerous during a crisis, when systems are down and organizations are more exposed.
A modern mobile threat model should go beyond device management or app approval. It should examine how sensitive information flows during normal operations and crisis conditions, identify which pathways are essential or vulnerable, and determine which can still be trusted if infrastructure is degraded.
It should also test assumptions.
If an organization plans to use a consumer group chat during an incident, who controls access? How are identities verified? What happens if a phone is lost, stolen, or compromised? Can communications continue if mobile networks are disrupted?
These questions may seem operational rather than strategic. In reality, they are both. Communications failures can delay decisions, create confusion, expose sensitive information, and weaken response when pressure is highest.
Treat mobile communications as critical infrastructure
Mobile-first communications are now part of how modern organizations operate and should be governed with the same discipline applied to cloud, endpoint, network, and identity systems.
Organizations should identify where sensitive communications happen, determine which channels are approved versus tolerated, and ensure crisis plans include secure, verified alternatives before disruption occurs.
Mobile communications are no longer a convenience layer; they are critical infrastructure, and adversaries already know it. Attackers wait for moments when systems go down, when organizations are often most exposed.
The question is not whether these channels are convenient, but whether they can withstand adversarial pressure. Until organizations model the full communications stack with the same security lens applied elsewhere, they will keep securing the decisions that matter while leaving the channels they flow through exposed.
