--- title: "Only 13 of 36 endpoint security tools cover phones in the same console" summary: "What 36 endpoint-security SKUs, 12 MDMs and Verizon’s 2025 mobile survey show about securing company and personal phones in India, as of September 2026." url: https://www.thetechbag.com/blog/taming-mobile-menagerie-mdm-endpoint-security format: Analysis desk: "Endpoints & devices" published: 2026-01-20 facts_checked: 2026-09-30 author: TechBag (The TechBag Journal) tags: ["MDM","mobile threat defence","endpoint security","BYOD","Android Enterprise","work profile","ESET","Hexnode","CERT-In","DPDP"] cover: https://www.thetechbag.com/blog/covers/taming-mobile-menagerie-mdm-endpoint-security.png --- # Only 13 of 36 endpoint security tools cover phones in the same console *What 36 endpoint-security SKUs, 12 MDMs and Verizon’s 2025 mobile survey show about securing company and personal phones in India, as of September 2026.* Analysis · Endpoints & devices · By TechBag · Published 2026-01-20 · Facts checked 2026-09-30 · Canonical: https://www.thetechbag.com/blog/taming-mobile-menagerie-mdm-endpoint-security The short version - An MDM configures, encrypts, locks and wipes a phone; it does not judge a link or an app. Of the 36 endpoint-security SKUs in TechBag’s guide, 13 cover phones in the same console, 10 sell phone cover as an add-on and 13 do not cover phones at all.[2] - Closing the gap is cheap at the bottom of the market: ESET’s tier with Mobile Threat Defense lists at US$55 a device a year against US$42.20 for the tier without. Hexnode’s own security layer, at US$5.50 a device a month, costs 2.5 times its MDM.[2] [3] - On a personal phone, enrol a work profile (Android) or User Enrolment (Apple). The employer can then wipe only the work side, and leaving needs no factory reset; two of Android’s four modes can only be left with one.[3] The 2024 version of this piece called MDM and endpoint security a duet and stopped there. The question an Indian IT team actually has is narrower. We already run an MDM, or we are about to buy one: what does it leave undone on a phone, which security product covers the phones we manage, what does that layer cost per device, and how much of an employee’s own phone are we allowed to touch? The answers below come from TechBag’s own guides as they stood on 30 September 2026, and from one vendor survey we label as such. ## Phones are attacked through people, and MDM does not read messages Verizon’s 2025 Mobile Security Index found that 85% of organisations reported more mobile attacks than a year earlier, 63% had major problems from downtime after a mobile incident and 50% suffered data loss. Of the 80% that ran text-message phishing tests on their own staff, 39% found that up to half of employees clicked the link.[1] Verizon sells mobile security, the release gives no sample size, and the survey is global; we treat it as a direction, not a measurement of Indian firms. **Figure: More mobile attacks, and half of organisations lost data to one** *Share of organisations surveyed, Verizon Mobile Security Index 2025, global* 85% Reported an increase in mobile attacks 63% Had major problems from downtime after an incident 50% Suffered data loss Source: Verizon, 2025 Mobile Security Index press release (GlobeNewswire) · as of 22 October 2025 · vendor survey; sample size not published in the release; the 39% smishing figure has a different base and stays in the text Set those numbers against what an MDM does. Its jobs are the five the 2024 post listed: enrol the device, push apps, enforce a passcode and encryption, lock or wipe it when lost, and report its state. None of them inspects a link in an SMS, a sideloaded app asking for accessibility permissions, or a café Wi-Fi network intercepting traffic. That is the job of mobile threat defence, a security agent on the phone that reports risk back to the MDM so the MDM can block email or apps until the phone is clean. The 2024 post’s best-practice list survives this test better than its metaphors. “Regularly update devices and apps” is an MDM job, and a real one: the MDM can hold a phone out of company mail until its operating system is current. “Educate your users” is the only item on that list aimed at the clicked link, and Verizon’s smishing numbers are the measure of how far training alone gets you. Everything else on the list, the BYOD policy, the choice of tool, the audit, is paperwork around the two controls that matter: an enrolled phone, and something on it that can tell a malicious app from a good one. Our view Our view: an MDM is a control plane, not a detector. Buying one closes the lost-phone problem and the unencrypted-phone problem. It does nothing for the clicked link, which is where Verizon’s numbers point. ## On a personal phone, the enrolment mode decides what you may wipe “Remotely wipe a lost device” was the 2024 post’s headline feature. On a company phone it is exactly that. On an employee’s own phone it should not be. Android Enterprise has four enrolment modes: fully managed, dedicated (kiosk), work profile and COPE, a work profile on a company-owned device. Fully managed and dedicated can only be set up from a factory-reset state, so leaving them means a wipe; the work profile and COPE can be released without one, and the personal side stays private.[3] Apple’s equivalent split is between supervised devices, enrolled through Automated Device Enrolment, and User Enrolment for personal iPhones. **Figure: Two of Android's four enrolment modes can only be left with a factory reset; the personal-phone modes never touch personal data** *What IT controls in each enrolment model, Android Enterprise and Apple, as documented by the platforms, August 2026* Company phone: fully managed or supervised - IT controls the whole device, apps, updates and restrictions - A remote wipe erases everything on the phone - Leaving Android fully managed or dedicated needs a factory reset - Zero-touch and Apple ADE work only for devices bought through an approved channel Personal phone: work profile or User Enrolment - IT manages a separate, encrypted work container only - A wipe removes work apps and data; photos and chats stay - Leaving needs no reset: remove the work profile, enrol elsewhere - Device compliance still needs the employee's consent to enrol Source: TechBag UEM & MDM guide, enrolment section, verified against Google, Apple and Microsoft documentation · as of 20 August 2026 TechBag’s guide found that every Android-capable MDM in it supports the work profile, so BYOD support rules nothing out. The trap sits elsewhere: a phone bought at retail never appears in the zero-touch or Apple Business account, so it cannot be enrolled hands-free without a wipe.[3] If you plan to issue phones, buy them through a channel that registers them to your account at the time of sale. Apple draws the same line differently. A supervised iPhone, which in practice means one enrolled through Automated Device Enrolment, unlocks the serious controls: single-app mode, web-content filtering, disabling AirDrop, blocking the user from wiping it, and enforcing operating-system updates. An unsupervised or User-Enrolled phone gets a baseline only. Since 14 April 2026 Apple has also shipped a free built-in MDM inside Apple Business, enough for a small all-Apple fleet but short of compliance reporting, complex policy and anything that is not Apple.[3] Our view Our view: write the BYOD policy around the enrolment mode, not around a list of forbidden behaviours. “We manage a work profile; we can see and erase only what is in it” is a sentence an employee will accept, and it is also the sentence that keeps the company out of the employee’s personal data. ## 13 of 36 endpoint tools put the phone in the same console So the phone needs a security layer. The obvious place to look is the endpoint product already protecting your laptops. In TechBag’s Endpoint Protection guide, as it stood on 30 September 2026, that works for about a third of the field.[2] **Figure: Only 13 of 36 endpoint-security SKUs cover phones in the same console; 13 do not cover phones at all** *Endpoint protection SKUs by phone coverage, count, TechBag guide reviewed August 2026* Phones in the same console Defender for Endpoint, ESET Advanced and up, Kaspersky, Hexnode XDR 13 SKUs Phones as a paid add-on CrowdStrike, SentinelOne, Sophos, Bitdefender, Trend Micro, Check Point 10 SKUs No phone coverage Seqrite endpoint line, Cisco, Acronis, Fortinet, ESET Entry 13 SKUs | | Value (SKUs) | | --- | --- | | Phones in the same console | 13 | | Phones as a paid add-on | 10 | | No phone coverage | 13 | Source: TechBag Endpoint Protection guide, capability tags verified against vendor documentation · as of 30 September 2026 TechBag countHow TechBag counted Each of the 36 SKUs carries one tag for phones and tablets: covered in the same console, covered by a paid add-on, or not covered. Tags were set against vendor documentation on 22 August 2026. Scalefusion Veltar is counted as covered, but it is web filtering, DLP and zero-trust access rather than an anti-malware engine; Hexnode XDR is counted as covered, with its detection depth undocumented.[2] The add-on column is the expensive surprise. CrowdStrike, SentinelOne and Sophos protect phones, but as a separate line on the quote, so the laptop price you compared is not the price of the fleet. CrowdStrike’s Falcon Go and Pro list at US$59.99 to US$99.99 a device a year for the laptop; the phone line is quoted separately.[2] Ask for the phone add-on on the first quote, priced for the number of phones you will actually enrol, not for the headcount. The no-coverage column holds one Indian surprise: Seqrite’s endpoint, EDR and XDR SKUs cover no phones. Seqrite manages phones through mSuite, a separate, mobile-only MDM with no macOS and no Windows.[2] [3] ## What the security layer costs on top of the MDM Two vendors print both halves of the price. ESET PROTECT Entry, US$42.20 a device a year, covers no phones; Advanced, US$55, adds Mobile Threat Defense, a cloud sandbox and full-disk encryption. Hexnode sells its UEM Pro tier at US$2.20 a device a month and its security product, Hexnode XDR, at US$5.50 a device a month on top.[2] [3] **Figure: Adding phone security costs US$12.80 a device a year at ESET and US$66 at Hexnode** *Published list price per device per year, US$, with and without the security layer, August 2026* | | Without phone security | With phone security | Change | | --- | --- | --- | --- | | ESET: Entry → Advanced | 42.2 | 55 | 30% | | Hexnode: UEM Pro → + XDR | 26.4 | 92.4 | 250% | Source: ESET and Hexnode list prices as recorded in TechBag's Endpoint Protection and UEM & MDM guides · as of 22 August 2026 · Hexnode monthly lists × 12; ESET is one suite tier, Hexnode two products, so not like for like Microsoft estates should check before buying anything. Defender for Endpoint lists at US$3 a user a month for P1 and US$5.20 for P2, covers phones in the same console, and is already inside Microsoft 365 E3 (P1), E5 (P2) and Business Premium (Defender for Business).[2] Intune, the MDM half, is in the same bundles.[3] A company on Business Premium that is shopping for a separate MDM and a separate phone-security product is about to pay twice for both. The two charted prices tell different stories. ESET’s step is small because Mobile Threat Defense rides inside a suite tier that also adds encryption and a sandbox; the phone is a feature. Hexnode’s step is large because XDR is a second product with its own per-device price, and TechBag’s guide notes its detection depth, Linux coverage and rollback are not documented. Scalefusion’s Veltar, reported at about US$3 to US$4 a device a month, sits in between but is not an anti-malware engine at all.[2] Compare what each layer detects before comparing what it costs. Our viewThe order we would buy in First, enrol every phone that touches company email, in the right mode: fully managed for issued phones, work profile or User Enrolment for personal ones. Second, turn on the phone cover your endpoint suite already includes, and price the add-on where it does not. Third, wire the security agent’s risk score into the MDM’s compliance rule, so a phone with a malicious app loses mail access automatically. A separate mobile-threat product earns its place only where the endpoint vendor has no phone cover at all. If you are buying this in India Every price above is a US dollar list; the rupee figure is a reseller quote on that list plus 18% GST, so ask for the tier, the device minimum and the hosting region in one written quote. Three of the MDMs in TechBag’s guide document Indian hosting or on-premises deployment, Scalefusion, 42Gears SureMDM and ManageEngine Endpoint Central; Seqrite mSuite is India-hosted and quoted in rupees.[3] The rules that bite are dated. CERT-In’s Directions of 28 April 2022 require reportable incidents to reach CERT-In within six hours and ICT logs to be kept for 180 days.[4] The DPDP Rules, notified on 13 November 2025, bring the security-safeguard and breach-notice duties into force on 13 May 2027; an employee’s own phone is full of personal data, which is one more reason to manage only the work profile.[5] Banks also run under the RBI’s Cybersecurity, Technology Risk and Resilience Framework Directions of 31 July 2026.[6] How we did this Figures as of 30 September 2026 Counts and prices come from the versions of TechBag’s Endpoint Protection guide (36 SKUs) and UEM & MDM guide (12 products) committed on 30 September 2026; capability tags and prices in both were verified against vendor documentation on 20 to 22 August 2026. Phone coverage is counted per SKU, not per vendor. Hexnode annual figures multiply the monthly list by 12. The threat figures are Verizon’s published survey results, global and vendor-run, and are not presented as Indian data. No vendor was asked for a quote. Spotted an error? Write to us; corrections are published at the foot of the piece. Sources 1. [Verizon, 2025 Mobile Security Index press release, via GlobeNewswire](https://www.stocktitan.net/news/VZ/mobile-danger-zone-ai-powered-attacks-and-human-error-create-perfect-y9v5wa5927fq.html) — 22 October 2025 2. [TechBag, Endpoint Protection decision guide: 36 SKUs, phone coverage and list prices](https://www.thetechbag.com/browse/security/endpoint-protection) — capability tags verified 22 August 2026 3. [TechBag, UEM & MDM decision guide: enrolment modes, per-device prices, India hosting](https://www.thetechbag.com/browse/endpoint-management/uem-mdm) — verified 20 to 22 August 2026 4. [CERT-In, Directions under section 70B(6) of the IT Act (six-hour reporting, 180-day logs)](https://www.cert-in.org.in/Directions70B.jsp) — 28 April 2022 5. [MeitY, Digital Personal Data Protection Rules, 2025 (phased commencement)](https://www.meity.gov.in/data-protection-framework) — notified 13 November 2025 6. [RBI, Cybersecurity, Technology Risk and Resilience Framework Directions, 2026, via practitioner summary](https://taxguru.in/rbi/rbi-issues-commercial-banks-cybersecurity-technology-risk-resilience-framework-directions-2026.html) — 31 July 2026 RBI PDF not fetched. Related on TechBag: the [UEM & MDM decision guide](https://www.thetechbag.com/browse/endpoint-management/uem-mdm) narrows the MDMs by operating system, ownership model and hosting; the [Endpoint Protection guide](https://www.thetechbag.com/browse/security/endpoint-protection) carries the phone-coverage tag for every SKU counted here. **Disclosure.** TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view. Go deeper on TechBag - [UEM & MDM decision guide](https://www.thetechbag.com/browse/endpoint-management/uem-mdm) — enrolment modes, India hosting and per-device prices for 12 MDMs - [Endpoint Protection guide](https://www.thetechbag.com/browse/security/endpoint-protection) — the phone-coverage tag for every endpoint SKU counted here - [ESET PROTECT Advanced](https://www.thetechbag.com/eset/eset-protect-advanced) — the published tier that adds Mobile Threat Defense