--- title: "9 of 12 UEMs lock a device to one app; 2 of 14 access tools control only the browser" summary: "Device lockdown against browser lockdown, counted across TechBag's UEM and zero-trust access guides, with list prices and the India rules, as of September 2026." url: https://www.thetechbag.com/blog/device-browser-lockdown-enterprise-security format: Note desk: "Endpoints & devices" published: 2026-03-10 facts_checked: 2026-09-30 author: TechBag (The TechBag Journal) tags: ["device lockdown","browser lockdown","kiosk mode","UEM","enterprise browser","zero-trust access","BYOD","CERT-In","DPDP"] cover: https://www.thetechbag.com/blog/covers/device-browser-lockdown-enterprise-security.png --- # 9 of 12 UEMs lock a device to one app; 2 of 14 access tools control only the browser *Device lockdown against browser lockdown, counted across TechBag's UEM and zero-trust access guides, with list prices and the India rules, as of September 2026.* Note · Endpoints & devices · By TechBag · Published 2026-03-10 · Facts checked 2026-09-30 · Canonical: https://www.thetechbag.com/blog/device-browser-lockdown-enterprise-security The short version - Lock the device when you own it; lock the browser when you do not. The choice follows ownership, not preference. - Device lockdown is standard: 9 of the 12 UEM and MDM products we track can hold a device in kiosk mode. Browser-only control is rare: 2 of 14 zero-trust access products work purely through the browser.[1] [2] - A locked browser reaches web applications only. Desktop software, SSH and RDP stay outside it, and so does most of the device’s health.[2] The 2024 version of this piece described device lockdown and browser lockdown as two rival strategies and asked readers to weigh them. An Indian IT team does not weigh them in the abstract. It has a fleet of company laptops, a set of shared tablets, and a growing number of contractors on their own machines, and it needs to know which control fits which. ## The question is who owns the device Device lockdown means enrolling the device in a UEM and restricting what runs on it, down to a single app in kiosk or dedicated mode. It needs the device to be yours. Browser lockdown means policy inside the browsing session: allowed sites, blocked downloads, no copy and paste. It works on a device you do not control, because the browser is the only thing you install. **Figure: Device lockdown is in almost every UEM; browser-only control is a niche of two** *Share of products in two TechBag decision guides, %, as of September 2026* 75% UEM and MDM products that lock a device into kiosk or dedicated mode 9 of 12 14.3% Zero-trust access products delivered only through the browser 2 of 14 Source: TechBag UEM & MDM and zero-trust access guides; TechBag count · as of 30 September 2026 TechBag countTechBag count The three UEM products without kiosk mode are Jamf Pro, Jamf Now and Jamf School, all Apple-only. The two browser-only access products are Palo Alto’s Prisma Access Browser and InstaSafe’s Zero Trust Application Access, which is built and hosted in India. The two are not rivals on a managed device. A kiosk browser is browser lockdown delivered by the UEM: 42Gears bundles its SureLock kiosk and SureFox browser into SureMDM Standard at US$3.99 a device a month, and Hexnode’s kiosk tiers include a secure browser mode.[1] ## What each one cannot see A browser-only product reaches web applications. Desktop applications, SSH, RDP and server-initiated protocols are outside a browser’s reach, and device posture is limited to what the browser can observe.[2] Device lockdown sees the whole machine but costs the user flexibility, and every exception becomes a ticket. Our view Our view: company laptops and shared tablets get device lockdown through the UEM you already run. Contractors and personal devices that only need web applications get a managed browser. Anyone who needs a desktop application on a device you do not own gets a company laptop, not an exception. ReportedWhat we removed from the 2024 version The original quoted a CISO we cannot identify and claimed 60% and 40% falls in incidents at an unnamed bank and hospital; we found no source for any of them. It cited Verizon’s 2023 finding that 74% of breaches involved a human element; the 2026 report puts it at 62%.[3] [4] ## Cost and rules in India Hexnode Pro lists at US$2.20 a device a month, Microsoft Intune Plan 1 at US$8 a user a month and often at nothing inside Microsoft 365 E3 or Business Premium.[1] Chrome Enterprise Premium launched at US$6 a user a month.[5] All are USD lists, invoiced by TechBag in INR with 18% GST. Either control generates logs, and CERT-In’s Directions of 28 April 2022 require ICT logs to be kept for 180 days within Indian jurisdiction.[6] Locking a personal phone also touches personal data: the DPDP Rules, notified on 13 November 2025, bring their security-safeguard duties into force on 13 May 2027.[7] How we did this Figures as of 30 September 2026 Product counts are TechBag’s UEM & MDM guide (12 products) and zero-trust access guide (14 products) as they stood on 30 September 2026; “kiosk” means documented Android dedicated (COSU) or equivalent single-purpose mode. UEM prices were read from vendor pages on 22 August 2026. The Chrome price is the launch list; Google’s current list was not read. Breach shares are Verizon’s, the 2026 figure via a dated secondary account. Spotted an error? Write to us; corrections are published at the foot of the piece. Sources 1. [TechBag, UEM & MDM decision guide (12 products; kiosk support; Hexnode, 42Gears and Intune list prices)](https://www.thetechbag.com/browse/endpoint-management/uem-mdm) — prices read 22 August 2026 2. [TechBag, Zero-trust access guide (14 products; access mode, reach and posture per product)](https://www.thetechbag.com/browse/network-security-sase/zero-trust-access) — version of 30 September 2026 3. [Verizon, 2023 Data Breach Investigations Report (74% human element)](https://www.verizon.com/business/resources/reports/2023-data-breach-investigations-report-dbir.pdf) — June 2023 As quoted in the 2024 piece; not re-read. 4. [Help Net Security, Lessons for organizations from the Verizon 2026 DBIR (62% human element)](https://www.helpnetsecurity.com/2026/05/25/lessons-from-verizon-dbir-2026-findings/) — 25 May 2026 5. [Computerworld, Google adds a premium option for Chrome Enterprise (from US$6 per user per month)](https://www.computerworld.com/article/2088368/google-adds-a-premium-option-for-chrome-enterprise.html) — 10 April 2024 6. [CERT-In, Directions under section 70B(6) of the IT Act, 2000 (180 days of logs within Indian jurisdiction)](https://www.cert-in.org.in/PDF/CERT-In_Directions_70B_28.04.2022.pdf) — 28 April 2022 7. [Digital Personal Data Protection Rules, 2025: phased commencement](https://legismith.com/dpdp-rules-2025-timeline/) — notified 13 November 2025 Related on TechBag: the [UEM & MDM guide](https://www.thetechbag.com/browse/endpoint-management/uem-mdm) filters for kiosk and dedicated devices; the [zero-trust access guide](https://www.thetechbag.com/browse/network-security-sase/zero-trust-access) covers the browser-delivered options for contractors. **Disclosure.** TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view. Go deeper on TechBag - [UEM & MDM decision guide](https://www.thetechbag.com/browse/endpoint-management/uem-mdm) — filter for kiosk and dedicated devices - [Zero-trust access guide](https://www.thetechbag.com/browse/network-security-sase/zero-trust-access) — browser-delivered access for contractors and unmanaged devices