Enforced passcodes
A device without a passcode does not get corporate email. Simple, and it removes the most common failure we see.
Mobile
Secure Mobile
A phone carries your email, your files, your Teams and often the authenticator app that approves sign-ins to everything else. Leave it on a train with no passcode and the finder holds a live route into the business, which turns a stolen handset into weeks of password resets and awkward calls to customers.
What this protects
A stolen phone that cannot get in
The loss is not the handset, it is the access it carries. A few controls turn a serious incident into an afternoon of admin.
Locked down before it leaves
A passcode and encryption are enforced at enrolment, so a device without them never gets corporate email in the first place.
Wipe tested, not hoped for
Work data sits in a container that can be wiped remotely, and we test the wipe at setup rather than during an incident.
Access that does not linger
Regular reviews of who can reach what from a mobile, so access ends when a role does, including on personal devices.
The stolen handset you cannot ignore
A modern business phone holds mail, file access, Teams, the calendar, and often an authenticator app that approves sign-ins to everything else. Lose it on a train with no passcode and the finder has, in practice, a great deal of your business.
We have seen this play out with email still syncing and no remote wipe available, which turns a lost handset into a weeks-long cleanup of password resets, notifications and awkward calls to customers.
The fix is not complicated. Enforce a passcode. Turn on device encryption. Keep work data in a managed container that can be wiped remotely without touching personal photos. Then test that the wipe actually works, before the day you need it.
What secure mobile looks like in practice
Encryption and containers
Work data sits in a managed container, encrypted and isolated from personal apps, and can be wiped without touching the rest of the phone.
Remote wipe
Lost or stolen devices wiped remotely, and tested in advance rather than found to be broken halfway through an incident.
Multi-factor sign-in
Access to email and files protected by a second factor tied to the device, not a code that can be forwarded on.
Safe connections
Business data kept off untrusted public Wi-Fi through managed profiles and, where it is warranted, a secure tunnel back to your network.
Access reviews
Regular checks on who can reach what from a mobile device, so access does not linger after someone changes role.
The BYOD gap, stated plainly
- A personal phone on a BYOD arrangement often has no enforced passcode and no encryption
- Work email is mixed in with personal apps, with no clean way to separate them
- Personal devices sit outside your patch cycle and your monitoring
- You usually cannot wipe business data without wiping the whole phone, so in practice nobody does
- When that person leaves, work email may keep arriving on their personal handset
What a lost phone should trigger
One process: report it, we wipe the work container remotely, revoke the active sessions, reset any credentials stored on the device, and confirm the wipe completed. The number is suspended or reassigned, and the incident is logged.
For a lone worker or field engineer, the same steps apply, with the added job of getting a replacement handset to them quickly so they are not offline for days.
What we set up
- Passcode and encryption enforced at enrolment
- A work profile with a clear line between business and personal data
- Remote wipe tested at setup rather than assumed to work
- Multi-factor authentication tied to the device
- One process for reporting a lost or stolen handset
Questions we get asked about Secure Mobile
Report it and we wipe the work container and revoke the sign-in sessions remotely. If the device is company-owned we can wipe the whole handset. The number is suspended or reassigned as you prefer.
Partly. A personal phone can hold work data in a managed container with a passcode requirement, and we can wipe just that container. What we cannot enforce is the rest of the device, which is why a managed handset is the safer default.
It is the single most effective control on a mobile device. A passcode plus encryption means a stolen phone is a locked object rather than a data breach.
Yes. With a work profile, personal apps and photos are untouched and invisible to us. Only the work side is managed.
They cover different jobs. Secure Mobile sets the security standard and the lost-device process. Managed Mobile runs the estate day to day: lines, devices, billing and joiners and leavers.
Not sure whether you need secure mobile?
Book a free 60-minute health check. We will tell you what you actually need, including when the answer is nothing.