You probably assume your youngest employees have this covered. They’ve had smartphones since middle school, they move through apps faster than anyone else in the building, and nobody expects to walk them through a login prompt. Most owners make that assumption, and it’s a reasonable one.
Kaspersky surveyed 7,200 people in 18 countries in March 2026 and published the results on July 24. Among Gen Z respondents, 59% said they feel confident online, but only 28% rated their own digital skills as advanced. Just 27% use antivirus on their mobile devices, which Kaspersky says is considerably fewer than other generations (it doesn’t publish the comparison figure). And 52% have already had a device, an account or some data attacked.
Kaspersky sells security software, and none of the 18 countries is the US. I’d read the survey as a signal and not a verdict. The gap it points to still deserves your attention.
The phone is where the work happens
Say a new hire is at lunch when a sign-in request for their work email lands on their phone. It looks like the ones they tap every day, so they approve it. That one tap is all an attacker needed.
On that phone sit your company’s email, the files in Teams and OneDrive, and the authenticator app that guards both. In most companies it’s a personal phone that nobody set up for work, and the employee is the only person responsible for protecting it. Only 28% of Gen Z respondents regularly back up the important data on their phones. A lost or compromised phone takes company data with it, and you may not find out until someone mentions it.
When this comes up in conversations with other owners, the instinct is usually to get everyone to install an antivirus app. I’d skip that. An app on a personal phone belongs to the employee, and the company has no way to see whether it’s installed or running. The protection that matters is the kind the company controls.
What I would do
If you already require a passcode on work phones, that’s a good start. Next, cover every phone that touches company email. Require a passcode and encryption on each. Turn on multi-factor authentication (MFA) with number matching, so a sign-in request can’t be approved without typing in a number shown on the login screen. That alone stops the lunchtime tap.
After that comes mobile device management (MDM), software that lets the company manage work data on a phone without touching anything personal. It keeps email and files in a protected space on the device. When someone leaves, you remove company data in minutes and their photos stay where they are.
Security awareness training should cover everyone, owner included, in the same session. Nobody gets a pass for being young, and nobody gets a pass for being senior either.
You can phase all of this. Phones first, training next, in whichever order fits your calendar. That part is up to you.
Your youngest employee is probably the fastest person in the building on a phone. Fast doesn’t tell you whether company email on that phone is protected. If you want MFA and device management set up without anyone’s personal data getting touched, we can take care of that for you.