Mobile devices are sometimes inside the security perimeter and sometimes:

1. A laptop on the office network is protected by it. 2. The same laptop on the road is not. 3. Organizations use mobile devices sometimes connected within the security perimeter, and sometimes exposed directly. 4. So the answer is exposed directly. _Source: NIST SP 800-146, 'Cloud Computing Synopsis and Recommendations'_