While there hasn't yet been a major reported breach of U.S. businesses via a smartphone, both Google's open-sourced and Apple's proprietary operating systems (OS) are vulnerable to phishing attacks that can cull data as personal as bank account passwords.

“Mobile phones operate like computers, and networked computers at that,” said Scott Godes, counsel in the Insurance Coverage Practice at Dickstein Shapiro and leader of the firm's Intellectual Property Insurance Practice.

“Similar data and privacy risks apply in the perspective of overall risk to the company and for insurance coverage,” he adds. “These considerations include a data breach and/or a lost device containing personally identifiable information, protected health information, and corporate or trade secrets—or confidential information that would be devastating if seen by the wrong party.”

Whether email is passed through a PC at the office or during the morning bus commute, the enterprise must keep in mind state and federal laws, and contractual obligations to its business partners.

For example, under the Health Insurance Portability and Accountability Act (HIPAA), health practitioners are liable for information leaked while communicating with patients through unencrypted texts.

Moreover, not every mobile phone is created equally; there are unique vulnerabilities in both the popular Android and iPhone platforms.

Companies who provide phones to employees should set aside time to educate them in spotting malware, say the tech experts.

“Security isn't a product, it's a process of educating users before moving onto software solutions,” says Steuer. Organizations like PaRaBaL provide training and white papers on the topic.

The Mobile Application Assurance Tool (MATS) created by PaRaBaL to analyze the legitimacy of Android apps is only available to the government, but the company is developing a service to conduct security scans for private customers.

Currently, companies can utilize a Mobile Device Manager (MDM), which can wipe data remotely from a device if a phone is lost.

What risk managers should do is to comb through their insurance policies at renewal time for peace of mind.

Says Godes, “I would recommend a careful review of the Commercial General Liability (CGL) or Cyber policies, and how the terms 'computer' or 'computer network' are defined in terms of cyber fraud. Many are written broadly and may include mobile devices specifically.”