The smartphone, security’s blind spot: protecting a mobile fleet in 2026

Up to date as of November 14, 2026. This article draws on the threat assessment published by ANSSI (the French national cybersecurity agency) in November 2025 and on the security updates released by Google and Apple in November 2026.

Email, calendar, business apps, authentication codes, VPN access: today the smartphone holds a large share of an employee’s access. Yet it is often less well managed than the laptop, and rarely visible from the SOC. Attackers have understood this well.

What ANSSI observes

In November 2025, ANSSI published a threat assessment on mobile phones since 2015. Several findings directly concern businesses:

over the last three years, ANSSI has handled multiple compromises of phones by spyware targeting people in high-level government positions or on the executive committees of companies in strategic sectors. In most cases, it was the victims’ personal phones that were targeted;
cybercriminals, for their part, target everyone, regardless of sector: unsophisticated malware and social engineering are enough for them to steal personal or business data, which is then reused to break into information systems;
the entry points are many: wireless interfaces (Wi-Fi, Bluetooth, NFC, cellular network), the operating system and the apps;
the most sophisticated attacks exploit “zero-click” vulnerability chains, with no action from the victim, often through messaging apps. Their implants usually stay in memory and leave few traces, which makes investigations much harder;
accessibility features are misused to read the screen and keyboard input. The Crocodilus malware, uncovered in 2025, uses them for example to steal banking data and cryptocurrency.

November’s news: flaws that were already fixed

On November 4, 2026, the security company Sekoia described a large “watering hole” campaign, which it attributes with moderate to high confidence to the APT29 group. Compromised legitimate websites in the United States, Ukraine, the Czech Republic and Bulgaria, domains imitating well-known sites and a web analytics service that was booby-trapped for a week were used to identify each visitor’s phone, then send it the matching exploit chain. The result: theft of cookies, WhatsApp and Telegram databases, credentials, location data and photos.

The key point lies elsewhere: every vulnerability exploited had already been fixed. The exploit chains targeted iPhones still running iOS 16.7 or 18.5, and outdated versions of Chrome for Android. An up-to-date phone was not exposed.

Security updates keep coming at a steady pace:

the Android security bulletin of November 2026, published on November 2, fixes among others a critical remote code execution flaw that requires no user interaction. The November 5, 2026 security patch level addresses all the issues;
on November 9, 2026, Apple released iOS 27.2.1, along with fixes for devices still running iOS 26 and iOS 18.

A fleet whose updates depend on each user’s goodwill remains exposed to attacks that are known, documented and avoidable.

Managing the fleet: MDM, mobile threat defense and the SOC

Fleet management

ANSSI recommends that companies manage their corporate devices with a mobile device management (MDM) solution, which makes it possible in particular to:

enforce updates of the system and apps;
restrict the apps that can be installed to the official stores and an approved list;
define a list of authorized Wi-Fi networks;
in the event of loss or theft, wipe the phone remotely, and revoke then renew the secrets configured on it (VPN certificates, email accounts), so that they cannot be used as a foothold on the network.

In practice, organizations add a minimum system and patch level, below which access to company apps is blocked.

Mobile threat defense

Fleet management controls the configuration; it does not detect an attack in progress. Mobile threat defense (MTD) solutions analyze, on the device, malicious apps, phishing links, suspicious networks and signs of system compromise. The two approaches complement each other.

The smartphone in the SOC

A compromised phone should trigger the same response as a compromised workstation. Alerts from fleet management and mobile threat defense therefore belong in the SIEM, correlated with sign-ins and identities. A dedicated playbook provides for isolating the device, revoking its access and tokens, then wiping it (see our analysis Logs, the foundation of the SOC).

A special case: if an employee receives a notification from Apple or Google saying they may be targeted by spyware, ANSSI advises not to handle the phone and to contact CERT-FR, the French government CERT.

Personal or corporate phone?

ANSSI’s position is clear: do not use a personal phone for work purposes, and plan for a dedicated phone for sensitive trips. A compromise of the personal phone then gives access to no company information.

If the organization nevertheless allows personal devices (BYOD), the CNIL (the French data protection authority) asks for the risks to be assessed beforehand and for the data and apps accessible to be limited according to their criticality. It recommends fleet management for these devices too, but without hindering their private use or accessing the personal space. The conditions of any remote wipe must be set out in the IT acceptable use policy. Android and iOS offer enrollment modes that separate the company’s apps and data from the employee’s, such as Android’s work profile.

Hardening the most exposed devices

For people likely to be targeted (executives, sensitive roles, travel abroad), ANSSI recommends enabling the operating systems’ hardening modes:

Lockdown Mode on iOS, available since iOS 16. ANSSI reports having observed first-hand its effectiveness in blocking compromise attempts;
Advanced Protection on Android, available since Android 16.

These modes restrict certain features (attachments, links, web technologies, installing apps from outside the store); their use can therefore be limited to specific periods, such as a business trip.

ANSSI adds simple measures that apply to everyone:

turn off Wi-Fi and Bluetooth when they are not in use, as well as automatic connection to known networks;
avoid public Wi-Fi, or go through a VPN you control;
lock the SIM card with a PIN code and prefer an authenticator app to codes received by text message;
regularly switch the phone off and on again, which removes spyware without persistence;
protect the device with a strong passcode;
be wary of QR codes, which hide the destination of the link;
do not install apps from outside the official stores, check their permissions and refuse access to accessibility features without a legitimate reason.

What the texts say

NIS2: the risk-management measures of Article 21 cover, among others, asset management, access control, multi-factor authentication, encryption, cyber hygiene and incident handling. Smartphones that access the information system are part of it (see our analysis NIS2 in France).
GDPR: the loss or theft of a phone containing personal data is a data breach, to be notified to the supervisory authority within 72 hours unless it is unlikely to result in a risk to individuals, for example because the data is encrypted (see One incident, several clocks). The CNIL recommends automatic locking, encryption, remote wipe and naming a contact person in case of loss or theft.

Where to start

Inventory the fleet: devices, system versions, patch levels, and the use of personal phones.
Choose a clear policy between corporate devices and the use of personal devices, and write it into the IT acceptable use policy.
Enroll every device in fleet management: enforced updates, controlled apps, encryption, locking, remote wipe.
Set a minimum patch level and block access to company apps below it.
Add mobile threat defense and feed its alerts into the SIEM.
Protect exposed profiles: dedicated phones, hardening modes, a procedure for trips.
Prepare the playbook for loss, theft or compromise: wipe, revocation of secrets, notification where required, contacting CERT-FR.

AI assistants are arriving on phones too, with new risks: see our analysis When AI acts on the phone.

Sources

← All insights