Jamf Executive Threat Protection release: AI Analysis beta launch

Jamf Executive Threat Protection is a mobile forensics tool that helps organizations detect sophisticated attacks targeting mobile devices. It’s designed for users like traveling executives, journalists, politicians and more, who are susceptible to advanced mobile threats. (Since 2021, Apple has sent threat notifications to high-profile users in over 150 countries about mercenary spyware.)

Jamf Executive Threat Protection provides forensic and SOC teams with an advanced threat detection and response tool to detect mercenary spyware and zero-day threats, without impeding on Personally Identifiable Information (PII). By simplifying the forensics analysis process, security teams can more easily detect advanced attacks. And with version 3.0, we are elevating its capabilities even more.

AI Analysis

Highlighted on the JNUC 2025 stage, we are pleased to announce the beta release of AI Analysis, available to all Jamf Executive Threat Protection cloud customers. AI Analysis adds a forensics expert to your team that provides clear, concise details on suspicious activity in just minutes.

Jamf Executive Threat Protection already gives SOC and forensics teams in-depth visibility and data about what's happening on a device. However, for many teams, using that data can take time to digest and may require specific expertise. But AI Analysis makes that effort much easier. It reduces the manual research required, particularly for teams analyzing device crashes and anomalies that don’t clearly indicate an attack or benign behavior. And the workflow is simple.

One click of the AI Analysis button activates the device being analyzed.

After analysis is complete, it provides a summary of the incident and recommendations for the next steps. To help with those next steps, it generates a detailed report that teams can use to immediately act on what's been found or to share with team members.

This feature will shorten escalation times and break down the learning curve to better understanding the process of digital forensics.

Threat Protect app for on-prem

Log deletion is a standard post-attack practice, typically performed immediately after a successful compromise to conceal an attacker gaining access. Because of this tactic, it is vital to continuously monitor devices for signs of attack before they disappear. For this reason, the Threat Protect app is designed to inspect devices for APTs and mercenary spyware.

What’s the Threat Protect app?

It’s the binary app of Jamf Executive Threat Protection, installed natively on iOS and Android devices, that inspects them for signs of attack. Additionally, the app allows end users to receive device security notifications and perform security scans. This update greatly enhances on-premises customers providing the level of inspection those users and devices require.

How does the Threat Protect app keep endpoints safeguarded?

With this launch, Jamf Executive Threat Protection customers with on-premises deployments can use the Threat Protect app, providing security teams an easier, time-reducing way to inspect sensitive mobile devices while comprehensively protecting high-profile users.

Devices are continuously monitored, enhancing the ability to catch an attack before evidence is deleted. On top of that, this update simplifies the onboarding process: users go through a one-time, one-minute activation, receive up to 48 scans per day, and devices can be scanned anywhere in the world for on-premises customers.

When combined with Jamf for Mobile for app deployment, and our Incident Management feature, Jamf Executive Threat Protection customers can rest easy knowing that by integrating Jamf’s market-leading solutions they can cut through the noise to detect signs of compromise and mitigate advanced attacks effortlessly.

If you would like to learn more about getting AI Analysis or Threat Protect On-Prem enabled, reach out to your Jamf representative.