Only 13 of 36 endpoint security tools cover phones in the same console

01Phones are attacked through people, and MDM does not read messages

Verizon’s 2025 Mobile Security Index found that 85% of organisations reported more mobile attacks than a year earlier, 63% had major problems from downtime after a mobile incident and 50% suffered data loss. Of the 80% that ran text-message phishing tests on their own staff, 39% found that up to half of employees clicked the link.¹ Verizon sells mobile security, the release gives no sample size, and the survey is global; we treat it as a direction, not a measurement of Indian firms.

Set those numbers against what an MDM does. Its jobs are the five the 2024 post listed: enrol the device, push apps, enforce a passcode and encryption, lock or wipe it when lost, and report its state. None of them inspects a link in an SMS, a sideloaded app asking for accessibility permissions, or a café Wi-Fi network intercepting traffic. That is the job of mobile threat defence, a security agent on the phone that reports risk back to the MDM so the MDM can block email or apps until the phone is clean.

The 2024 post’s best-practice list survives this test better than its metaphors. “Regularly update devices and apps” is an MDM job, and a real one: the MDM can hold a phone out of company mail until its operating system is current. “Educate your users” is the only item on that list aimed at the clicked link, and Verizon’s smishing numbers are the measure of how far training alone gets you. Everything else on the list, the BYOD policy, the choice of tool, the audit, is paperwork around the two controls that matter: an enrolled phone, and something on it that can tell a malicious app from a good one.

02On a personal phone, the enrolment mode decides what you may wipe

“Remotely wipe a lost device” was the 2024 post’s headline feature. On a company phone it is exactly that. On an employee’s own phone it should not be. Android Enterprise has four enrolment modes: fully managed, dedicated (kiosk), work profile and COPE, a work profile on a company-owned device. Fully managed and dedicated can only be set up from a factory-reset state, so leaving them means a wipe; the work profile and COPE can be released without one, and the personal side stays private.³ Apple’s equivalent split is between supervised devices, enrolled through Automated Device Enrolment, and User Enrolment for personal iPhones.

TechBag’s guide found that every Android-capable MDM in it supports the work profile, so BYOD support rules nothing out. The trap sits elsewhere: a phone bought at retail never appears in the zero-touch or Apple Business account, so it cannot be enrolled hands-free without a wipe.³ If you plan to issue phones, buy them through a channel that registers them to your account at the time of sale.

Apple draws the same line differently. A supervised iPhone, which in practice means one enrolled through Automated Device Enrolment, unlocks the serious controls: single-app mode, web-content filtering, disabling AirDrop, blocking the user from wiping it, and enforcing operating-system updates. An unsupervised or User-Enrolled phone gets a baseline only. Since 14 April 2026 Apple has also shipped a free built-in MDM inside Apple Business, enough for a small all-Apple fleet but short of compliance reporting, complex policy and anything that is not Apple.³

0313 of 36 endpoint tools put the phone in the same console

So the phone needs a security layer. The obvious place to look is the endpoint product already protecting your laptops. In TechBag’s Endpoint Protection guide, as it stood on 30 September 2026, that works for about a third of the field.²

The add-on column is the expensive surprise. CrowdStrike, SentinelOne and Sophos protect phones, but as a separate line on the quote, so the laptop price you compared is not the price of the fleet. CrowdStrike’s Falcon Go and Pro list at US$59.99 to US$99.99 a device a year for the laptop; the phone line is quoted separately.² Ask for the phone add-on on the first quote, priced for the number of phones you will actually enrol, not for the headcount. The no-coverage column holds one Indian surprise: Seqrite’s endpoint, EDR and XDR SKUs cover no phones. Seqrite manages phones through mSuite, a separate, mobile-only MDM with no macOS and no Windows.^{2 3}

04What the security layer costs on top of the MDM

Two vendors print both halves of the price. ESET PROTECT Entry, US$42.20 a device a year, covers no phones; Advanced, US$55, adds Mobile Threat Defense, a cloud sandbox and full-disk encryption. Hexnode sells its UEM Pro tier at US$2.20 a device a month and its security product, Hexnode XDR, at US$5.50 a device a month on top.^{2 3}

Microsoft estates should check before buying anything. Defender for Endpoint lists at US$3 a user a month for P1 and US$5.20 for P2, covers phones in the same console, and is already inside Microsoft 365 E3 (P1), E5 (P2) and Business Premium (Defender for Business).² Intune, the MDM half, is in the same bundles.³ A company on Business Premium that is shopping for a separate MDM and a separate phone-security product is about to pay twice for both.

The two charted prices tell different stories. ESET’s step is small because Mobile Threat Defense rides inside a suite tier that also adds encryption and a sandbox; the phone is a feature. Hexnode’s step is large because XDR is a second product with its own per-device price, and TechBag’s guide notes its detection depth, Linux coverage and rollback are not documented. Scalefusion’s Veltar, reported at about US$3 to US$4 a device a month, sits in between but is not an anti-malware engine at all.² Compare what each layer detects before comparing what it costs.