UK's on-device scanning plan poses serious risks to enterprise security

Full text

In June, Keir Starmer announced at London Tech Week that tech firms have until September to introduce device controls that prevent children from sending and receiving sexually explicit images. The plan requires on-device or client-side scanning, and has been framed as a child safety measure. For enterprise security teams, it raises a different set of questions entirely.

For enterprises, the proposal challenges one of the core assumptions underpinning modern cybersecurity: that devices can be trusted to process sensitive information without external inspection.

If software is required to scan content before it is encrypted or transmitted, it introduces new attack surfaces and weakens the privacy and integrity that businesses depend on to protect intellectual property and confidential information.

It’s a concern being felt widely across the industry, with organizations including Signal and the British Computer Society issuing statements warning that client-side scanning can create systemic vulnerabilities that could ultimately be exploited by cybercriminals and other malicious actors, fundamentally reshaping digital trust.

As organizations prepare for the September deadline, they must equip teams with the necessary skills to evaluate potential risks that client-side scanning could cause, adapting security strategies where necessary.

Why the proposed plan has led to conversations around security

The greatest risk posed by mandatory on-device scanning is the disruption of trust architecture on which enterprise security depends. Modern mobile security frameworks, including mobile device management (MDM), endpoint protection and zero-trust access controls, are built on the assumption that the operating system functions as a controlled and trusted layer.

Enterprises use this trusted foundation to enforce security policies and verify the integrity of managed devices.

Introducing a government-mandated scanning agent beneath or alongside that trusted layer fundamentally changes the security model. Once an additional privileged component can inspect device content, the integrity of the operating system can no longer be assumed, making the security controls that sit above it less reliable.

This structural change to the trust boundary that underpins enterprise mobile security, creates new opportunities for exploitation if the capability is ever compromised or repurposed.

The operational problems for security teams

The consequences extend beyond security architecture into day-to-day enterprise operations. The underlying issue is not privacy , which is what the government’s plan is concerned with, but architecture. A scanning agent at the operating system level sits outside the boundaries that enterprise security teams are able to govern, disrupting security processes that organizations rely on to verify whether endpoints remain in a trusted state.

Government-run scanning agents also create the potential for compliance failures, particularly in highly regulated sectors where organizations must demonstrate control over how sensitive data is processed and monitored. If the scanning function operates outside the managed work profile used by enterprise MDM platforms, it remains effectively invisible to IT administrators.

As a result, security teams have no practical mechanism to audit its behavior or control how it acts with secure data. This also disrupts device attestation - the process by which MDM platforms verify a device is in a known, trusted state - which could cause managed devices to be flagged as non-compliant and blocked from corporate resources.

In an environment where visibility and assurance are fundamental principles of cyber defense, introducing a privileged component that falls outside enterprise oversight creates a blind spot that weakens, rather than strengthens, organizational security.

While intended to improve online safety, client-side scanning raises significant concerns for organizations. Because it requires privileged access to device content and is widely considered incompatible with true end-to-end encryption, it could weaken security, increase the risk of sensitive data exposure, and force organizations to navigate difficult trade-offs between compliance and protecting critical systems.

The lack of clear exemptions for legally privileged, healthcare and financial data also leaves regulated sectors facing uncertainty over how to meet competing legal obligations.

What organizations can do to prepare

Organizations cannot afford to treat this proposal as a policy issue alone. Security leaders should already be engaging with the compliance and governance issues it raises, assessing how any mandated changes to mobile operating systems could affect device trust, regulatory obligations and existing security controls.

This also means investing in the skills needed to assess security risks at the architectural level, rather than simply responding to threats after they emerge.

Security teams will need a deeper understanding of operating system security models, trusted execution environments, encryption, endpoint architecture and mobile device management, enabling them to evaluate how changes to core platform designs could affect an organization's overall security posture.

Building these capabilities will help organizations make informed decisions about adopting new technologies, understand the implications of regulatory changes, and identify potential weaknesses before they become exploitable.

As trust increasingly becomes embedded within the architecture itself, having teams with the expertise to assess and challenge these foundations will be just as important as the security tools used to defend them.

Safety cannot erode trust

As the debate surrounding the UK’s on-device scanning proposal continues, the conversation must move beyond the framing of privacy versus safety and consider the wider architectural consequences for enterprise environments.

Weakening the trusted computing model on which modern mobile security is built risks introducing new vulnerabilities, reducing visibility for security teams and undermining confidence in the platform’s organizations depend on.

Making the internet safer for children is crucial, but achieving that goal should not come at the expense of the security foundations that businesses rely on every day. The challenge for policymakers and technology providers is not just to implement new safeguards, but to do so without eroding the trust that underpins the wider digital ecosystem.

We've featured the best secure file sharing.

This article was produced as part of TechRadar Pro Perspectives , our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit