Zimperium vs Lookout puts a threat agent onto each phone

Two AWS Marketplace listings opened 3 Oct 2026 sell a 12-month contract capped at 100 devices. Zimperium’s unit is named MTD Base. Lookout’s lower unit is named Essentials, with a second unit named Advanced.

Those units are an app on the phone. Zimperium Mobile Threat Defense is the Zimperium agent. The AWS listing says that agent was formerly zIPS, and it says protection continues without a network connection. Lookout Mobile AI Security says app analysis is on-device and cloud-based. The AWS contract is still titled Lookout Mobile Endpoint Security. An MDM or UEM console can install either app. The comparison is the agent, where analysis runs, and how risk reaches UEM.

The consumer Lookout app left Lookout, Inc. when the sale to F-Secure closed on 1 June 2023. Zimperium’s Mobile Application Protection Suite is app protection, a separate order from the device agent. Lookout’s AI Visibility and Governance module governs AI use on the phone. Editions treats it as a module beside the detection agent.

OS coverage, what the agent checks, where analysis runs, privacy, response, and UEM come before any offline edge case. Offline behavior is a separate check. Zimperium’s MTD page says protection continues when the device is not connected to your network, and the AWS listing says it continues without a network connection. Lookout’s Mobile Threat Defense page documents on-device and cloud-based analysis. A statement that Lookout detection continues with the radio off was not found on that page or on the platform overview.

Overview

	Zimperium Mobile Threat Defense	Lookout Mobile AI Security
Primary use case	On-device detection across device, network, phishing, and apps, with a console the MTD page says can run in the cloud, on premises, or air-gapped	On-device and cloud-based behavioral analysis for apps, plus device, network, and phishing checks, sold as Lookout Mobile Endpoint Security
What you hand it	The MTD app on iOS, Android, or ChromeOS, plus a console. The AWS listing title is Zimperium Mobile Endpoint Security. The priced dimension is MTD Base	The endpoint app. The Mobile Threat Defense page names iOS, Android, and ChromeOS. Essentials and Advanced are the two public units on the AWS contract
Day-to-day workflow	The app raises a threat on the device. The console shows device, network, phishing, and app risk. The listing says remediation can be on-device, and UEM can enforce compliance	The app runs on-device analysis and cloud-based analysis. The Mobile Threat Defense page says detection can reduce access, and enforcement can run through MDM or UEM. Advanced SOC is the module for SIEM, SOAR, and XDR telemetry
License/pricing	MTD Base, 12 months, up to 100 devices. Dollar figure is in Editions. Mobile SOC Agent has no public price	Essentials and Advanced, each 12 months, up to 100 devices. Dollar figures are in Editions. The listing does not say what Advanced adds
Who operates it	Your team tunes policy and reads the console. Zimperium hosts a cloud option, or you run the console they say can be on premises or air-gapped	Your team works in the Lookout console. The AWS listing checked 3 Oct 2026 marks the product Deployed on AWS: Yes, and sold by Lookout, Inc.
Main buying consideration	Do you need the on-device engine, the listing’s claim that detection continues without a network connection, and a console that is not only SaaS?	Do you need app analysis that the Mobile Threat Defense page calls both on-device and cloud-based, on the contract named Lookout Mobile Endpoint Security?

We read the Zimperium MTD page and its AWS listing, the 6 May 2026 agent announcement, and the 25 Feb 2025 year note, plus the Lookout Mobile Threat Defense page, the platform overview, the 1 June 2023 consumer-sale release, the 12 May 2025 cloud-sale release, and the Lookout AWS listing, on 3 Oct 2026. We did not install either agent or open either console.

Zimperium Mobile Threat Defense

Lookout Mobile AI Security

Zimperium’s 25 Feb 2025 year note says the company is backed by Liberty Strategic Capital and SoftBank. The March 2022 Zimperium release described a controlling investment expected to close in the second quarter of 2022. A 17 May 2022 wire release said that acquisition had closed. The MTD page checked 3 Oct 2026 still sells the product as Zimperium. Lookout, Inc. is still independent. On 12 May 2025 it announced a sale of its cloud security business to Fortra. No later Lookout page checked today says that cloud sale has closed.

Editions and pricing

Dollar figures below are only the ones with a billing period on the listing opened 3 Oct 2026. Each table is labeled Cost/12 months. Both listings also offer a 24-month contract and a 36-month contract. Those selectors did not show a second dollar amount, so they are not printed here. A generic SaaS note on the pages mentions monthly usage fees. The price table is the 12-month contract. Do not turn these units into a per-month rate.

	Zimperium Mobile Threat Defense	Lookout Mobile AI Security
How you buy it now	AWS Marketplace contract sold by Zimperium Inc. One dimension. Refund policy on the listing: no refund	AWS Marketplace contract sold by Lookout, Inc. Two dimensions. Refund policy on the listing: no refund
Public price (3 Oct 2026)	MTD Base, up to 100 devices, $4,800 for 12 months. The listing calls a device any phone or tablet running the agent, corporate or personal	Essentials, up to 100 devices, $7,200 for 12 months. Advanced, up to 100 devices, $8,400 for 12 months. The listing does not say what Advanced adds
Outside that unit	The listing’s buyer Q&A says Mobile SOC Agent is a separate paid add-on to MTD Base and is not sold alone. No dollar is printed. The 6 May 2026 release says Mobile SOC Agent is available to MTD clients. The order has to say whether it is included. Mobile App Response Agent belongs to the app-protection suite	AI Visibility and Governance (29 Apr 2026), Social Engineering Protection, and Advanced SOC (Mobile EDR) are modules on the overview. None of them has a public dollar. The endpoint units above are the priced agent
Where the software runs	The MTD page lists cloud, on-premises, air-gapped, and a deployment it spells FedRamp. The AWS listing marks Deployed on AWS: No. The MTD page still lists a cloud console among the deployment options	SaaS. The listing marks Deployed on AWS: Yes. The overview names FedRAMP in a framework list. That list is not an authorization letter
Main buying consideration	Put MTD Base, the 12-month term, the 100-device cap, and the SOC agent line on the order	Put Essentials or Advanced, the 12-month term, the 100-device cap, and any extra module on the order. The public page will not define Advanced

What the agent checks

OS coverage: the Zimperium MTD page names Android, iOS, and ChromeOS, and it does not print a minimum OS version. Lookout’s Mobile Threat Defense page names iOS, Android, and ChromeOS. The platform overview’s device narrative is iOS and Android.

Privacy: Zimperium’s AWS listing calls the app privacy-first and says it protects the device without sacrificing privacy or personal data. Lookout’s Mobile Threat Defense page says the product does not collect personal content or monitor private activity. A field list of what each agent stores was not found on those pages.

Response: Zimperium’s listing highlights on-device remediation and UEM-driven compliance. Mobile SOC Agent is a separate paid add-on, not in MTD Base. Lookout’s platform overview lists Advanced SOC (Mobile EDR) as the module that sends raw mobile telemetry to SIEM, SOAR, and XDR. That module is not described as included in Essentials.

UEM: Zimperium’s MTD page says the product integrates with MDM, EMM, and UEM, plus SIEM, SOAR, and XDR. Lookout’s Mobile Threat Defense page says enforcement can run through existing MDM and UEM workflows. A named UEM vendor list was not found in those sentences.

	Zimperium Mobile Threat Defense	Lookout Mobile AI Security
Device integrity	Jailbreaks, rooting, and other compromise checks before corporate access. The page also describes a forensic scan after an unknown network or travel	Rooting, jailbreaking, and OS tampering, plus vulnerable OS versions. The overview lists those under the base platform section
Apps	Risky or unauthorized app behavior against enterprise policy, including third-party apps, with privacy settings the page says are configurable	Malicious apps, malware, trojans, and spyware, plus a behavioral risk score. The overview’s first app count is 420 million. A later block on the same page says 438 million
Network	The MTD page and the AWS listing include network attacks in the on-device engine	The overview lists rogue Wi-Fi and machine-in-the-middle detection, plus secure DNS, in the base platform section
Phishing on the phone	Advanced AI Smishing on the MTD page inspects Apple iMessage and Android Google Messages from unknown senders. No separate price is printed. The page does not say those are the only channels	The base section says phishing protection blocks malicious links across browsers, apps, and SMS. Social Engineering Protection is the extra module for WhatsApp, iMessage, Signal, and voice
Main buying consideration	Is iMessage and Google Messages coverage, with no printed add-on price, enough for the phishing you actually see?	Is SMS in the base section enough, or does the order also need the social-engineering module?

One organization said the prices were close and that Zimperium produced more false positives, which is why they moved to Lookout. A single deployment note is not a false-positive rate. The product pages opened 3 Oct 2026 do not print one.

How a detection is produced

Shared checks are not an on-device-only versus cloud-only split. Lookout’s Mobile Threat Defense page says app analysis is continuous, on-device and cloud-based behavioral analysis. Zimperium’s MTD page describes an on-device dynamic detection engine, and the same company also lists a console that can run in the cloud, on premises, or air-gapped. Both products document work on the device and a service behind it.

Offline is separate from where analysis runs. Zimperium’s MTD page says the agent keeps protecting the device when it is not connected to your network, and that secure access continues even when offline. The AWS listing says protection continues without a network connection, and that on-device detection continues when the device is offline. Those pages do not use the words radio off. A statement that Lookout detection continues with the radio off, or with no network connection, was not found on the Mobile Threat Defense page or the platform overview. That is not found in this research. It is not a finding that Lookout stops when the radio is off.

The Lookout overview prints 230 million devices in one block and 242 million devices in another, with app and URL totals that also differ (420 million apps and 569 million URLs, then 438 million apps and 583 million URLs). The AWS listing’s figure is more than 210 million endpoints. Use the order’s data-processing note for what leaves the phone. These totals do not answer it.

Mobile SOC Agent, the response add-on in Editions, investigates threats on employee devices. That workflow sits on top of the detection agent. It does not replace the on-device check. Lookout’s Advanced SOC module is the parallel idea on the other side: raw mobile telemetry into the SOC tools you already run. It is a module beside the Essentials unit.

Choose Zimperium Mobile Threat Defense when the order needs the on-device engine, the listing’s claim that detection continues without a network connection, and a console that can be on premises or air-gapped, with MTD Base as the 12-month unit in Editions and the SOC agent line written down. Choose Lookout Mobile AI Security when the order needs the on-device and cloud-based app analysis on the Mobile Threat Defense page, the endpoint contract titled Lookout Mobile Endpoint Security, and the line that personal content is not collected. A statement that Lookout detection continues with the radio off was not found. Leave AI Visibility, Social Engineering Protection, and Advanced SOC off the order unless it names them. Leave the F-Secure consumer app, the announced Fortra cloud business, and Zimperium’s app-protection suite on their own orders.