Governments and defence forces invest in encrypted communications, satellite systems and camouflage, yet smartphones can still expose personnel locations and operational details. Cyprus-based privacy company Malloc is developing mobile security technology to address these risks.

Five years after its founding, the company, led by co-founder and CEO Maria Terzi, is expanding beyond consumer privacy into enterprise, government and defence. The move reflects a growing challenge: smartphones can expose sensitive communications, location data and operational information, even in highly secured environments.

Follow THE FUTURE on LinkedIn, Facebook, Instagram, X and Telegram

From Consumer Privacy To High-Risk Environments

“To be honest, nothing changed. In fact, Malloc is not even near to what it can become,” Terzi said.

Malloc initially focused on protecting people from spyware, hacking and online privacy threats. Its users included privacy-conscious individuals, people living in censored environments, investigative journalists, politicians and government personnel.

As the company began serving users in more sensitive environments, it expanded from a consumer app to enterprise- and government-level security technology. This required adapting to different operational needs and technology restrictions while keeping protection seamless.

Applying AI Without Compromising Privacy

AI security systems often rely on large amounts of data, creating potential privacy risks when information is sent to remote servers. Malloc instead performs much of its AI processing directly on users’ devices.

“There is always a trade-off between privacy, usability, and speed, but Malloc balances them to maintain high precision and a seamless experience without compromising security,” Terzi said.

The company trains general-purpose models in the cloud before adapting them on individual devices using local data. It also applies federated learning to improve its core models without transmitting personal user data from devices.

Developing AI To Detect Unusual Behaviour

Malloc is working with The Cyprus Institute on DAEMON-AI, a project supported by the Research and Innovation Foundation and co-funded by the EU under the Thalia 2021–2027 programme. It aims to develop lightweight AI systems that run directly on devices and strengthen mobile protection.

One component detects unusual behaviour by learning typical user patterns and identifying anomalies, such as unexpected bursts of outgoing data. Another classifies encrypted network traffic using metadata, including packet size and frequency, without decrypting message content.

These systems aim to identify patterns that could indicate sensitive activities, such as location sharing or screen recording. Their findings feed into Malloc’s broader security infrastructure to improve spyware detection and help prevent data leaks.

Why Defence Raises The Stakes

Malloc says it is the only company from Cyprus selected for the EU’s EUDIS defence accelerator, joining 20 companies chosen from 499 applicants across Europe.

The defence sector demands particularly high reliability, Terzi said. “As my co-founder and CTO Liza Charalambous says, we have zero room for error. To lead globally, Malloc must perform flawlessly in mission-critical environments.”

She describes mobile devices as “defence’s weakest link”, arguing that smartphones can reveal locations and operational plans despite investment in encrypted communications, satellite systems and other protective measures.

The accelerator will allow Malloc to test its dual-use technology against military requirements. It also provides a €120,000 non-dilutive voucher and access to European networks. Terzi said she aims to establish long-term partnerships with EU ministries of defence.

Measuring Success By Preventing Data Leaks

Cybersecurity threats are not always easy to identify. Sophisticated spyware and zero-day exploits may be blocked before their precise identity is known, leaving users unaware that an attack was attempted.

“Success often looks like complete silence,” Terzi said.

Malloc uses behavioural detection to intervene when unauthorised data is being transmitted, even if a threat has no recognised signature. In the short term, the company monitors indicators such as blocked data flows and real-time risk mitigation.

Ultimately, Terzi said, the goal is to protect devices and communications by preventing data leaks before they cause damage.