Spearstone
A smartphone and laptop on a desk, both capable of storing corporate logins
All articles

The Unmanaged Phone Is Where Corporate Passwords Keep Showing Up

If a phone can open work mail and you cannot wipe it, the BYOD policy has already been written. You just did not write it.

Verizon's 2025 DBIR found that 46% of compromised systems in infostealer logs that contained corporate logins were non-managed, and that those systems held personal and business credentials together. Thirty percent of compromised systems in the logs could be identified as enterprise-licensed. The report's warning is that a BYOD policy you refused to write will be written by whatever device people actually use.

Phones are in that set. A personal phone with a work profile, a copied password, or an authenticator is a corporate credential store. Infostealer malware is more often discussed on laptops, but the policy failure is identical: you cannot wipe what you never enrolled, and you cannot tell a person to "just delete the app" after the phone is gone.

Choose on purpose

  • Managed phone, enrolled, remote wipe tested. Work mail is allowed.
  • Or no work mail, no SSO, no authenticator for corporate accounts on personal phones.
  • There is no stable third option called "we trust them."

DriveStrike covers phones and computers you enroll, with remote wipe and lock. It is not an excuse to skip the identity-provider settings that block unknown devices. Use both. The DBIR write-up is in the July 2025 article. CISA's permission advice for highly targeted phones is in the December 2024 note, and it is still a sound default for everyone else.

Start a DriveStrike trial on the phones you are willing to manage. Ask Spearstone if you need help deciding which roles never get a choice.

Keep reading

Questions worth answering directly

What is the DBIR figure for unmanaged devices?

In the 2025 report, 46% of compromised systems that had corporate logins in infostealer data were non-managed and held both personal and business credentials.

Can DriveStrike wipe a personal phone the company does not own?

Only if that phone is enrolled and the wipe is something the owner has agreed to in policy. Enroll it, or keep corporate access off it.

Sources