How Do You Secure Company Phones in the Indian Workforce?
Key takeaways
- An Ernakulam hospital lost over 800GB of patient data in March 2026, and a Kochi hospital was listed by the same ransomware group that month.
- A Kochi pharmaceutical firm lost Rs 99 lakh in October 2026 after the accounts department's phone was compromised and the CEO was impersonated on WhatsApp.
- Mobile device management with encryption, screen lock, work profile and an app allow-list is the baseline for any company phone in India.
- Blocking unknown executables and DLL sideloading from user profile directories is a specific CERT-In recommended control.
- Linked-device hygiene on WhatsApp Web and desktop clients is a routine control, because linked sessions survive password changes.
As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.
Why are company phones the softest target in an Indian business?
Because they hold everything and are governed by nothing. A company phone in a typical Indian SME carries the business email account, the bank app, the WhatsApp account used for customer queries, the payment approvals, and the contact list of the founders. It also travels, it is shared for personal calls, it updates itself outside the patch window, and it rarely has a management profile at all. That combination is exactly what the Kochi pharmaceutical case exploited: the accounts department's phone was compromised, a number was saved under the CEO's name with the CEO's display picture, and a genuine employee moved Rs 99 lakh on the strength of a WhatsApp conversation. The device was the perimeter, and nobody was watching it.
What should mobile device management actually enforce?
Six controls, in priority order. Encryption and a strong screen lock, because a lost phone is a data breach with a name on it. A work profile or container, so company mail, files and the banking app are separated from personal installs and can be wiped independently without wiping the person's phone. An app allow-list for managed apps, with sideloading disabled, because the delivery mechanism in India's 2026 self-propagating malware was a .zip containing an .exe and a .dll. Restrictions on clipboard and screenshots for finance and health data where the device supports it. Certificate pinning or per-app VPN for high-value internal applications, so a proxy certificate installed by a user cannot silently intercept them. And a defined patch policy, because an unmanaged device that self-updates is a device whose software state you have never reviewed.
What are linked devices, and why do they matter on WhatsApp?
When you link a second device to a messaging account, the account is used there without the primary phone's prompts. The linked device persists independently of your password, and it is the mechanism behind the GhostPairing campaign that CERT-In rates as High severity, in which attackers take over WhatsApp accounts through device-linking pairing codes with no password and no SIM swap. The control is unglamorous and effective: check the linked devices list on a schedule, remove anything you do not recognise, enable the app's two-step verification, set a device-locking PIN, and require that any request to link a device is verified out of band. Indian users report the pairing code to attackers over a call, and a callback to a known number is what prevents that.
What should a mobile security assessment cover?
Nine areas: device enrolment and profile enforcement, encryption state, screen-lock and biometric configuration, app allow-list and sideloading posture, linked-device hygiene on messaging apps, mobile OS and browser version exposure, data in the clipboard and the notification preview, the certificate trust store, and the mobile-specific application flows including deep links and session handling. AAVETech delivers this as a fixed-price mobile device and application security assessment at roughly Rs 12,000 to Rs 30,000 per tester-day plus 18% GST, in 5 to 10 working days with a retest after remediation included, and a written set of MDM policies your team can implement directly.
| Control | Setting | Risk it removes |
|---|---|---|
| Encryption | Hardware-backed, enforced by MDM | Data loss from a stolen device |
| Screen lock | Strong PIN plus biometric | Shoulder surfing and quick access |
| Work profile | Container for company data | Personal app exposure and lateral movement |
| App allow-list | No unknown sideloading | Malware delivered as a .zip with an .exe and .dll |
| Linked devices | Reviewed monthly, 2-step PIN set | Account takeover via pairing codes |
| Patch policy | OS and browser within 30 days | Known exploited mobile vulnerabilities |
What are the common questions about M?
Get a straight answer on this
Send us your handset list and messaging app usage and we will return a fixed-price mobile device security assessment with MDM policy settings.
Send us the details See pricing