Mobile security solutions often promise comprehensive protection against sophisticated threats, yet many fall into the trap of "security theater": implementing measures that appear effective on the surface, but which crumble under technical scrutiny.

In this talk, we will explore the recurring patterns of superficial security engineering found in widely used mobile defense products. We will examine how vendors often rely on easily spoofable identifiers, shallow verification logic, and misplaced trust boundaries to build critical features, creating a dangerous false sense of security for enterprises and users alike.

Drawing from real-world vulnerabilities observed in the wild, this session will dissect the architectural flaws often hiding behind malicious WiFi detection, anti-MitM measures, and app containerisation features. Rather than focusing on individual vendors, we will highlight the systemic design flaws we've observed across the board.