Systems and methods herein relate to monitoring traffic for mobile devices for threats. One method includes defining, in a data structure, groups based on a characteristic. A mobile device is then enrolled under one of the groups. In so doing, a security application monitors traffic for the device for threats, based on the device's enrollment group, when the device is associated with a characteristic on which its enrollment group is based. When the device is no longer associated with the characteristic on which its enrollment group is based, the device is re-enrolled under a different group.