Mobile devices are under constant and serious attack, which is bad news for enterprises in which an increasing number of workers are using the devices to access business apps, according to a new survey.

About 40 percent of devices will encounter a network threat in three months time, compared to 22 percent in one month’s time, according to the Mobile Threat Intelligence Report by Skycure, which provides predictive technology that crowdsources threat knowledge to proactively identify threats to help secure mobile devices. This shows that not only are threats to mobile devices real, but they increase as time goes on, the company said.

For the survey, the company developed a Mobile Threat Risk Score that categorizes devices from low- to high-risk, and found that 41 percent of mobile devices are at medium  to high risk of security threat, while nearly two in every hundred are high-risk devices. This means they are already compromised or under attack, according to the survey. The Mobile Threat Risk Score takes into account recent threats the device was exposed to, device vulnerabilities and configuration, and user behavior.

Perhaps even more troubling is that the devices under attack are not equipped to handle the threats, according to the survey, which reviewed data from devices with Skycure’s solution either installed by enterprises on employees’ mobile devices or by consumers. The report found that the majority of devices—more than 52 percent—are not password-enabled, while 30 percent of devices are running an outdated operating system, such as a recent high-profile Android OS that was vulnerable to attack.

To compile the data for the survey, Skycure reviewed worldwide threat Intelligence data based on millions of monthly security tests from July through September 2015. Both consumer and enterprise devices were included in the report.

Skycure’s technology, used to compile information for the survey, is based on a crowd wisdom engine, which monitors devices for attacks, threats and vulnerabilities. Skycure has both an enterprise version of its solution for sale but also offers a free version to anyone who wants to use the app to protect his or her device.

“Threats to mobile devices are real and based on what we’re seeing in this report people aren’t doing enough to protect themselves,” said Adi Sharabani, CEO of Skycure, in a press release about the report. “Skycure brings invisible mobile threats to the surface, so that enterprises can fight the bad guys on a level playing field.”

Skycure did have some good news for enterprises, finding that these devices are more protected than consumer devices. Very few iOS devices in the enterprise were jailbroken, which means that most of the inherent security features of the OS, according to the devices. Moreover, hackers were able to infiltrate about five times more personal Android devices than enterprise Android devices, according to the survey.

Indeed, the survey found that Android devices are generally at a higher risk than mobile devices running other operating systems. Nearly 3 percent of Android devices are infected with malicious apps that represent a medium to high severity, according to the report. Moreover, more than one in four—or 27 percent—of Android devices has third-party app installation enabled, which means it can install apps outside of the official Google Play store.