Earlier this year, the UK government unveiled plans requiring Big Tech companies, including Apple and Google, to activate built-in features or implement technical solutions to detect and block sexually explicit images involving children. The proposals represent a long-awaited push for technology companies to do more to protect children online, but also raise important questions for enterprise security teams about the wider implications of on-device scanning.
The proposed approach, which would require on-device or client-side scanning protections, has attracted criticism from across the cybersecurity community over concerns that it could undermine privacy and security. The move has attracted criticism from privacy and security organisations, which have warned that measures of this kind could expand surveillance capabilities and weaken existing protections. Critics argue that such measures could remove an important layer of data protection by increasing the storage and sharing of sensitive personal information, potentially creating new opportunities for large-scale leaks and attacks.
For businesses, the central question is whether devices can continue to be trusted to process sensitive information when external inspection is introduced at the device level. If software is required to scan content before it is encrypted or transmitted, it could create new attack surfaces and potentially weaken the privacy and integrity that organisations rely on to protect intellectual property, customer data and confidential business information.
Technology providers are working towards the September deadline, so businesses should begin preparing for changes that could affect the confidentiality, trust and governance of managed devices. Security teams will need the skills and oversight to assess the risks associated with client-side scanning and determine whether existing security strategies and controls need to evolve accordingly.
How on-device scanning could disrupt traditional security models
The greatest risk posed by mandatory on-device scanning is the disruption of trust architecture on which enterprise security depends. Modern mobile security frameworks, including mobile device management (MDM), endpoint protection and zero-trust access controls, are built on the assumption that the operating system functions as a controlled and trusted layer. Enterprises use this trusted foundation to enforce security policies and verify the integrity of managed devices.
Introducing a government-mandated scanning capability beneath or alongside that trusted layer could fundamentally change the security model. If an additional privileged component can inspect device content, it could alter the trust assumptions enterprises make about the operating system and affect the reliability of security controls that depend on those assumptions. This structural change to the trust boundary that underpins enterprise mobile security, creates new opportunities for exploitation if the capability is ever compromised or repurposed.
What on-device scanning could mean for enterprise security
The consequences extend beyond security architecture into day-to-day enterprise operations. While the government’s plan centres on privacy, the underlying issue is architecture. A scanning capability at the operating system level could sit outside the boundaries that enterprise security teams are able to govern, disrupting security processes that organisations rely on to verify whether endpoints remain in a trusted state.
Government-mandated device-level scanning capabilities could also create the potential for compliance failures, particularly in highly regulated sectors where organisations must demonstrate control over how sensitive data is processed and monitored. If the scanning capability operates outside the managed work profile used by enterprise MDM platforms, it remains effectively invisible to IT administrators. As a result, security teams could have no practical mechanism to audit its behaviour or control how it acts with secure data. This could also affect device attestation – the process by which MDM platforms verify a device is in a known, trusted state – which could cause managed devices to be flagged as non-compliant and blocked from corporate resources.
In an environment where visibility and assurance are fundamental principles of cyber defence, introducing a privileged component that falls outside enterprise oversight creates a blind spot that weakens, rather than strengthens, organisational security.
Although they are intended to improve online safety, client-side scanning protections raise significant concerns for organisations. Because it requires privileged access to device content before or after encryption, it could weaken the confidentiality guarantees organisations normally associate with end-to-end encryption, it could weaken security, increase the risk of sensitive data exposure, and force organisations to navigate difficult trade-offs between compliance and protecting critical systems. The lack of clear exemptions for legally privileged healthcare and financial data may also leave regulated sectors facing uncertainty over how to meet competing legal obligations.
How businesses should approach compliance and governance
Organisations cannot afford to treat this proposal as a policy issue alone. Security leaders should already be engaging with the compliance and governance issues it raises, assessing how any mandated changes to mobile operating systems could affect device trust, regulatory obligations and existing security controls.
This also means investing in the skills needed to assess security risks at the architectural level, rather than simply responding to threats after they emerge. Security teams will need a deeper understanding of operating system security models, trusted execution environments, encryption, endpoint architecture and mobile device management, enabling them to evaluate how changes to core platform designs could affect an organisation’s overall security posture.
Building these capabilities will help organisations make informed decisions about adopting new technologies, understand the implications of regulatory changes, and identify potential weaknesses before they become exploitable. As trust increasingly becomes embedded within the architecture itself, having teams with the expertise to assess and challenge these foundations will be just as important as the security tools used to defend them.
Balancing security safeguards with trust
As technology companies work towards the September deadline, organisations should be assessing not only the governance and regulatory implications of on-device scanning, but also the wider architectural impact on their enterprise environments. Introducing scanning capabilities at the device level could challenge the trusted computing model that underpins modern mobile security, creating the potential for new vulnerabilities and reducing the visibility security teams have over how sensitive information is processed.
For security teams, this means preparing for new ways of managing risk and maintaining visibility across increasingly complex device environments. Organisations should be considering how their existing security controls, governance frameworks and threat models may need to adapt as these capabilities are introduced.
Protecting children online is an important objective, and technology providers have a clear role to play in achieving it. However, these measures should not come at the expense of the security foundations that organisations rely on every day. The challenge for policymakers and technology providers is to introduce effective safeguards while preserving the trust, privacy and security that underpin the wider digital ecosystem.
Matthew Lloyd Davies
Matthew Lloyd Davies is Principal Security Author at, Pluralsight where he specialises in offensive security and hands-on learning. Matthew creates video courses, labs and assessments that help learners build practical skills in areas like AI for security professionals, hardware hacking and red-team tradecraft.
