Transport Boundary
network · path · carrierWhere signals leave the device. Cell, Wi-Fi, eSIM profile integrity, downgrade exposure, off-network exfiltration paths.
Mobile risk is currently underpriced, under-measured, and unevenly disclosed. The Trust Boundary Index (TBI) is the framework underneath every Mobile Risk Reduction Exercise. It scores four boundaries — Transport, Behavior, Identity, Inference — on the same axis, so a CISO, an auditor, and an insurer read the same number the same way.
TBI is a measurement framework. It consumes telemetry; it does not produce it.
Enterprise risk programs are mature on endpoints, identity, and cloud. The mobile fleet is treated as a billing relationship, not a control surface. The result is a measurement gap that shows up in three places at once: carrier underwriting prices the bandwidth, not the exposure; cyber insurers ask questions the customer cannot answer; audit committees inherit a posture they cannot quantify.
TBI closes that gap with a single ordinal scale every reader can defend.
A control is only meaningful relative to the boundary it defends. The boundaries are mutually exclusive at the moment of measurement and collectively exhaustive across the mobile attack surface.
Where signals leave the device. Cell, Wi-Fi, eSIM profile integrity, downgrade exposure, off-network exfiltration paths.
What the device and its apps do, observably, in production. Posture deviation, runtime anomaly, sideload exposure, configuration drift. Normalized into a canonical event schema.
Who the device claims to be, and how durable that claim is. SIM-to-account binding, session resilience, subscriber re-issue risk, recovery-flow integrity. Where SIM-swap, port-out, and step-up bypass live.
What can be derived about the principal without ever touching the device. Data-broker exposure, people-search surfaces, telemetry leakage, AI-assisted re-identification. Scored at parity with the other three boundaries.
The TBI is a normalized scoring procedure that any qualified assessor can apply, audit, and re-run twelve months later against the same anchors. Applied in practice through the Mobile Risk Reduction Exercise.
Heterogeneous signals normalized into a canonical event schema across all four boundaries. Source data stays with the customer. The schema is the standard, not the sensor.
Existing controls scored on coverage, depth, and recoverability against each boundary. Mapped against current audit anchors so the result reads cleanly into CMMC Phase 2 evidence and SEC 8-K Item 1.05 disclosure language.
The principal — the person, not the device — measured against the publicly derivable surface. The boundary most programs ignore is the one regulators and acquirers ask about first.
Reported as an ordinal index, four boundary sub-scores, and a documented delta on re-measurement.
The score and its sub-scores convert mobile risk from opinion into an ordinal claim the audit committee can interrogate. A delta on re-measurement is read as evidence that a specific boundary moved.
Travel-tech, MVNOs, and connectivity platforms interpret the four boundaries as a shared vocabulary for the trust claims they already make to enterprise buyers — independent of any single platform or carrier.
The four boundaries map cleanly into materiality determination, 8-K narrative, and cyber-policy questionnaires. Each boundary corresponds to a category of question already on the form.
A measurement standard earns trust by being honest about what it covers and what it does not.
| Claim | Position | Status |
|---|---|---|
| Replaces an MTD product | TBI is a measurement framework, not a sensor. Consumes telemetry; does not produce it. | Not in scope |
| Endorses a vendor | No product, platform, or carrier is named in any TBI output. | Enforced |
| Audit-defensible scoring procedure | Inputs, mappings, and ordinal anchors are reproducible. | In scope |
| Inference-surface as first-class boundary | Scored at parity with the other three. | In scope |
A weekly brief — vendor-neutral, source-traceable, CISO-grade — tracking what is breaking in mobile security and how the Trust Boundary Index reads the change.
Weekly · Vendor-neutral · Unsubscribe one-click