Skip to main content
Jamf Mobile Forensics, India

Jamf Mobile Forensics: for the few people whose phone is genuinely a target.

The product Jamf used to call Executive Threat Protection. Commercial spyware of the Pegasus, Predator and Graphite variety asks nothing of its victim, no link to click and no attachment to open, and it leaves a handset looking and behaving completely normally afterwards. What this tool does is find that kind of intrusion and document it properly. Very few organisations genuinely need it, and we would rather tell you that than sell it to you. Delivered discreetly, remote-first from Gachibowli, Hyderabad.

Request a high-risk user assessmentSee whether it applies to you
Advanced mobile threat detection and forensics in India
  • iOS and AndroidBoth mobile platforms covered
  • Zero-clickDetects no-interaction compromise
  • Remote DFIRThe phone stays with its owner
  • Honest gateWe say no more often than yes
What the product does

Eight capabilities, all pointed at one hard problem.

Conventional mobile security is built around an attacker who needs the victim to slip up, and for the overwhelming majority of Indian organisations that is the correct threat model. If you are one of them we will say so directly. This product exists for the harder case, where a capable adversary leaves nothing an administrator or a user could ever notice. Finding that requires two things together: deep artefacts pulled from the handset, and a trained analyst able to interpret them.

Detection of zero-click compromise

No mistake is required from the victim here. The delivery arrives as a message or a call that is never opened or answered, which means every hour of phishing awareness training your staff have sat through counts for nothing against it. The only route to finding it runs through artefacts on the device, never through user vigilance.

Automated artefact collection and analysis

Phones retain a great deal of diagnostic and forensic material, and the tool harvests it and tests it against indicators tied to documented spyware families and techniques. Performed by hand this is days of specialist effort per handset. Automated, it becomes realistic to check a short list of named individuals on a regular schedule.

Remote DFIR, so the phone stays in use

The analysis runs without anyone taking the device away. That detail decides whether the control gets used at all, because the individuals who most need checking are precisely the ones who cannot surrender a phone for a week, and a security measure people quietly refuse is not a security measure.

AI-assisted analysis as triage

There is now an AI layer that ranks what an analyst should examine first. Understand it as a sorting mechanism, not a conclusion. It reduces an unmanageable pile of artefacts to the handful worth a specialist attention, and the judgement that follows is still entirely human.

Incident management for a real process

Findings land as tracked incidents driven by a rules engine, not as notifications somebody may or may not read. Take that design as a warning if you have no security operations capability: the tool presumes a person will act on what it surfaces, and paying for detection with nobody assigned to respond is a mistake we watch organisations make repeatedly.

Coverage across iOS, iPadOS and Android

Ask any group of at-risk executives what they carry and you will get both platforms, plus several people holding two handsets. Covering iOS and Android together means you are assessing a person rather than a single phone, which is the only assessment that means anything. Analysts work from either macOS or Windows.

Evidence you can act on and hand over

What comes out the other end is a written forensic finding, not an alert banner, and that distinction is what makes it usable by your general counsel, your board or an outside investigator. Suspecting a handset is compromised gets you nowhere. Being able to show the artefacts that prove it is a position you can defend.

A baseline, even when nothing is found

Finding nothing has value too. It turns an anxious open question into a dated, documented position, with the boundaries of what was examined written down. That record is what gives any future finding its meaning, and it is the actual answer to a board that has asked whether the company has been compromised.

Read this before enquiring

Most organisations do not need this, and the basics beat it every time.

A narrow tool for a narrow problem, and one that is very easy to sell dishonestly by making people afraid. We would sooner walk away from an enquiry than put mobile forensics in front of a company whose real exposure is an unpatched file server and a shared administrator password.

  • For almost every business in this country the genuine danger is nothing so exotic. It is a redirected invoice after somebody quietly read a mailbox for six weeks. It is ransomware through a remote access service left facing the internet. It is a password reused from a breach dump. Fix those first, and it is not a close comparison in terms of risk removed per rupee spent.
  • Lockdown Mode already sits inside iOS, costs nothing at all, and for someone genuinely in the crosshairs it removes more attack surface than any product on the market. It restricts exactly the messaging and browsing paths this class of attack relies on. Yes, it is irritating to live with, which is precisely why people switch it off, and accepting that irritation is the actual trade on the table.
  • Nothing here prevents anything. The tool identifies and evidences a compromise that has already occurred. If your goal is lowering the odds of being compromised in the first place, the work is hardening the handset, patching without exception, limiting who can message the individual at all, and stripping down what the device holds.
  • The failure we see most is buying the detection without deciding what happens when it fires. Who gets told. Who authorises isolating or replacing the handset. What you do about material that has probably already left. Whether counsel decides a notification is required. Working that out is harder than the procurement and considerably more valuable.
Ask us to review your actual exposure first
How we approach it

Four commitments on a subject that is easy to sell dishonestly.

No category in security is easier to sell through fear, or harder to sell straight. So we have written down the constraints we operate under whenever this subject comes up, and you are entitled to hold us to them.

We will tell you if you do not need it

Every engagement opens with one question: is there anybody here a state-grade or commercial spyware operator would realistically spend money on. For the large majority of Indian companies the answer is no. We say it plainly, redirect you to the work that would genuinely lower your risk, and accept the lost sale. That reputation is worth more to us than the invoice.

Built-in hardening before paid detection

Four things cost nothing except discipline: turning on Lockdown Mode, keeping the OS genuinely current, deleting messaging apps nobody uses, and narrowing who can contact the person directly. Together they cut the probability of compromise further than any detection product will. We do those first, then measure what risk is actually left over.

The response is planned before deployment

Nothing gets switched on until the answers exist on paper: notification chain, decision authority, replacement handset turnaround, the trigger for involving counsel, and what a DPDP Act or CERT-In notification would require. Detection with an undecided response does not prevent a crisis, it schedules one for the least convenient possible morning.

Discretion, and a named contact

This is work about people, not servers, and it is staffed accordingly: specific named individuals on our side, bound by the confidentiality that follows from that. Results reach only the person you designate. You never have to explain the background again to whoever answers. Managed clients hold a 30 minutes response SLA.

Who this is actually for

Six situations where the conversation is warranted.

Six profiles where we would call this a proportionate spend. Read them honestly against your own organisation, and if none of them describe you, take that as the answer: the same budget buys far more protection somewhere else, and we will point you there instead.

A family office or promoter group

A tiny team sitting on information worth a great deal, where knowing where the principal is going and what they intend to do has direct commercial value to a competitor. Your entire exposure is a few handsets carried by people who are permanently travelling and will not accept being told to use their phones differently.

A board of a listed or regulated entity

Knowing a result, a deal or a regulatory decision before the market does is worth real money to someone. And board members typically carry the least managed devices in the entire company, because nobody relishes enforcing policy on the people who approve the IT budget. This is one of very few controls you can apply to a named handful without starting that fight.

A law firm on contested matters

Privileged documents, well-funded opponents on the other side, and a professional obligation of confidence that a compromised phone breaches the moment it happens. Here the fallout from an undetected intrusion is not merely a commercial loss, it is a regulatory and professional exposure, which changes the arithmetic on what counts as proportionate.

Media and civil society organisations

Anyone publishing on contested ground is, on the global evidence, an established target for this tooling. In practice these individuals often have no IT function behind them whatsoever, so most of the useful work turns out to be basic hardening and sane daily habits rather than software, and we scope it that way rather than pretending a licence solves it.

Executives travelling to higher-risk jurisdictions

Risk here follows the individual and their itinerary rather than the office. Our usual recommendation is not permanent surveillance of somebody daily handset but a stripped-down travel device carrying only what the trip requires, examined before departure and again on return. It costs less, intrudes less, and concentrates the effort on the window where the risk actually sits.

Organisations that already suspect something

Often the call comes after the fact. Something leaked with no plausible route. The counterparty in a negotiation clearly knew things they should not have. A phone has been behaving strangely for weeks. This is investigative work, usually urgent, and it has to be done in a way that keeps evidence intact. One request above all: do not wipe the device before you have spoken to somebody, because that destroys the only record of what happened.

Three positions organisations take

What high-risk mobile exposure looks like in practice.

The middle column is where most organisations that have thought about this at all end up: risk identified, nothing structural done, reliance on the individual noticing something. That reliance is misplaced, because this class of compromise is specifically designed to be unnoticeable.
Feature
Assessed and monitored
Aware but unaddressed
Not considered
High-risk individuals formally identified
Informally
Lockdown Mode enabled where warranted
Rarely
Devices patched without exception
MostlyUnknown
Device artefacts ever examined
RoutinelyNeverNever
Compromise would be detected
LikelyOnly by chance
Evidence available if it were
Response plan agreed in advance
Legal counsel briefed
Replacement device available same day
Sometimes
Typical position in the Indian market
UncommonCommonThe default
Where each control fits

Mobile management, mobile security and mobile forensics do different jobs.

Mixing these three up is how companies end up believing they are protected against something they have no visibility of whatsoever. One controls configuration. One defends against everyday attacks. One investigates the exceptional. Buying any of them gives you nothing that the other two provide.
Mobile device managementMobile threat defenceMobile forensics
Enforces passcode, encryption, updatesYesNoNo
Blocks phishing and malicious sitesLimitedYesNo
Detects ordinary mobile malwareNoYesNot its purpose
Detects zero-click and mercenary spywareNoRarelyYes, this is the point
Collects deep on-device artefactsNoNoYes
Produces documented forensic evidenceNoNoYes
Needed by most organisationsYesUsually yesRarely
Applies to the whole workforceYesYesA named few
Requires somebody to respond to findingsSomeYesAbsolutely
Where to spend firstFirstSecondOnly when justified
How an engagement runs

Five stages, and the first two involve no product at all.

Deployment is not where this begins. It begins with establishing whether a credible target exists inside your organisation at all, since every later stage depends entirely on that answer being yes.
  1. 1

    Establish whether a genuine target exists

    One structured session covering who does what, where they travel, how public they are, what they know that has value and who would benefit from knowing it. You get a written view on whether anybody credibly sits in this risk bracket. For most organisations the engagement stops right here, and that is the outcome working as intended.

  2. 2

    Harden what is built in

    Applied to whoever step one identified: Lockdown Mode wherever the individual will tolerate it, no exceptions on OS currency, unused messaging apps deleted, inbound contact narrowed, and a hard look at how much sensitive material is sitting on the handset in the first place. Measurable risk reduction for the price of attention alone.

  3. 3

    Agree the response before the detection

    Notification chain, decision rights, replacement turnaround, the point at which counsel joins, the DPDP Act and CERT-In obligations that might follow, and how findings get recorded. Crucially this is agreed by the executives who would actually be in the room during an incident, not drafted by the IT team and filed where nobody reads it.

  4. 4

    Deploy and baseline

    Only now does software appear. It goes to the named individuals, artefacts are gathered and examined, and each device gets a documented starting position. Coming back clean is a genuine result rather than a disappointment, because it converts an unanswerable worry into a dated finding, and that is what allows anything detected later to actually mean something.

  5. 5

    Run it, review it, stop it when no longer warranted

    Collection and analysis on a schedule, reported only to the contact you nominated. Once a year we revisit whether the risk still warrants the spend, because people change roles and threat profiles fade, and telling a client to stop paying for something is part of what you are hiring us to do.

Direct answers

The questions people actually ask about this.

Same product, new label. What Jamf now markets as Mobile Forensics was Executive Threat Protection until recently, JETP in most people shorthand, and Jamf own documentation acknowledges the previous name directly. The change of name arrived together with a broader forensic capability, notably the AI-assisted analysis and the incident management layer aimed at security operations teams. So a proposal on your desk quoting JETP is quoting this. We keep referencing the old name because that is still what people type into a search box and what the majority of existing write-ups call it.

An intrusion where the victim does nothing whatsoever. Ordinary attacks depend on a human action, tapping a link, opening an attachment, typing a password into a convincing imitation, and that dependency is what makes awareness training worthwhile. This class works differently: it abuses a defect in code that handles incoming data on its own, the routine that renders a message, generates an image preview, or negotiates an incoming call. The handset is taken over simply by receiving something. Nobody clicked anything, which is why training offers no protection at all and why the only viable detection sits at the level of device artefacts.

No, and that is the part people find hardest to accept. Spyware at this tier is built specifically to be unobservable during normal use: the phone does not feel slower, nothing new appears among the installed apps, and across many documented cases there was no visible sign whatsoever. People often cite battery drain or a warm handset as tells. Both are close to worthless as evidence, because a hundred entirely innocent things produce them. The belief that you would somehow sense it is comfortably the most widespread misconception we encounter on this subject.

Only finds. Be clear-eyed about that before any money changes hands: this is detection and forensics, with no preventive function at all. Lowering the likelihood of being compromised is a hardening exercise instead, meaning Lockdown Mode, patching the same day rather than the same month, cutting the number of apps able to receive anything from outside, and controlling who can reach the person directly. That said, detection earns its place, because an intrusion nobody finds simply carries on indefinitely. It is the second purchase, not the first.

It is a switch Apple already ships, and it aggressively narrows exactly the paths this class of attack travels down: several message attachment formats, a set of web technologies, invitations arriving from people not in your contacts, and wired accessory connections. Enabling it takes under a minute. For a person genuinely on somebody target list it removes a large slice of the available attack surface at zero cost. The price is friction, since some sites break and some attachments will not open, and that friction is the entire reason it stays switched off in most organisations. Where the individual really is a target, accepting that friction is plainly the right trade, and we would rather have an awkward argument with you about it than quietly sell you software instead.

Very few, and claiming otherwise would be dishonest. Most Indian organisations, including plenty of large and highly profitable ones, are exposed to completely unglamorous risks: someone quietly reading a mailbox and redirecting an invoice, ransomware arriving through a remote access service nobody remembered was published, passwords reused from a breach years ago. Those are the things that actually happen, and closing them returns dramatically more security per rupee than mobile forensics ever will. We use this assessment as a filter rather than a sales funnel, and the majority of these conversations end with us recommending you spend the budget somewhere else entirely.

We can, and what matters most happens before you even call us. Three things to avoid: do not wipe it, do not restore it from a backup, and do not try to clean it with any consumer tool. Every one of those erases precisely the evidence needed to work out what occurred. If it is safe to do so leave the handset powered on, limit what anybody does with it, and contact us; enquiries get a response within 4 business hours. Speed genuinely matters here because certain artefacts roll off the device as it keeps running, so the earlier collection happens, the more complete an answer you will get.

Where the handset belongs to the company, was issued for work, and sits under a written policy the employee has seen and agreed to, this is routine security practice and that is how we set it up. A personally owned phone is an entirely different proposition, requiring consent that is explicit, informed, genuinely optional and properly recorded. Either way the DPDP Act 2023 governs what gets collected and how it is subsequently handled, and since the collection itself is unavoidably personal data, both the consent basis and the stated purpose have to be watertight. We settle all of that before deployment. And to be unambiguous: we will not install this covertly because an employer asked us to.

A written forensic report setting out which artefacts were observed, what they point to, how much confidence sits behind that reading, and what should be done immediately. We write it for non-specialists deliberately, because the people who end up reading it are usually a general counsel, a managing director or a board rather than a security team. A clean result is stated with the same clarity as an adverse one, and always alongside the scope of what was and was not examined, since a reassuring conclusion with undisclosed boundaries is worse than no conclusion at all.

Your pre-agreed plan executes, which is precisely why we refuse to deploy without one. In practice that usually means reaching the individual through a direct channel rather than a group mailbox that may itself be compromised, taking the handset out of service and replacing it instead of attempting a clean, working out what could have been exposed across the relevant window, bringing in counsel, and examining whether DPDP Act breach reporting or CERT-In incident reporting is triggered by whatever was exposed. Note how little of that is technical. The genuinely hard decisions are about who gets told what, and making those under time pressure without a plan reliably goes badly.

It does. Coverage spans iOS, iPadOS and Android, while the analysis itself is performed from either a Mac or a Windows machine. The practical importance is this: at-risk people in India are split across both platforms, and a great many of them carry two phones, one personal and one issued by the company, frequently running different operating systems. Examining just one of those produces a comfortable but meaningless answer, because an attacker will simply target whichever device is easier to reach, not the one you happened to choose for monitoring.

They occupy different layers and none replaces another. Your MDM enforces configuration, encryption, passcode policy and update compliance across the whole workforce. Endpoint security such as Defender or Jamf Protect defends against ordinary threats. Mobile forensics investigates advanced compromise for a named few. An organisation should generally have the first, usually wants the second, and rarely needs the third. Commercially we quote per engagement based on how many individuals are in scope and whether the need is an investigation now or ongoing monitoring; the first conversation, which establishes whether you need it at all, carries no obligation.
Is anyone here actually high risk

Twelve questions that decide whether this conversation is worth having.

Group one asks whether anyone in your organisation is genuinely a target. Group two covers free hardening that ought to be finished already and almost never is. Group three is the response capability that has to exist before spending on detection makes any sense.

Is there a real target

  • Does anyone hold a government, diplomatic or public office role?
    The clearest indicator, and the one this product was built around.
  • Does anyone negotiate transactions where advance knowledge is worth a great deal?
    Deal teams, boards, promoters and family offices are commercially attractive targets.
  • Does anyone work in or travel regularly to a higher-risk jurisdiction?
    Exposure follows the person, not the office.
  • Does anyone publish, report or campaign publicly on contested subjects?
    Journalists and civil society are a documented target group for this class of tooling globally.

Has the built-in hardening been done

  • Is Lockdown Mode enabled on the devices of the people identified above?
    Built in, and the largest single reduction available.
  • Are those devices on the current OS version, without exception?
    This class of attack chases unpatched flaws. Patch latency is the exposure.
  • Have unused messaging apps been removed from those devices?
    Every message-receiving app is an inbound surface.
  • Can strangers reach those individuals directly by message or call?
    Restricting who can reach someone is an underrated control.

Could you act on a finding

  • Is there a named person who would be told first?
    Findings of this kind cannot go through a general helpdesk queue.
  • Is legal counsel briefed in advance?
    The response is a legal question as much as a technical one.
  • Could you replace a compromised device the same day?
    A finding you cannot act on for a week is a finding of limited value.
  • Do you know which notification obligations would apply?
    DPDP Act breach reporting and CERT-In timelines may follow depending on what was exposed.
Related reading

The layers underneath this one.

Jamf Protect

Everyday endpoint security for Macs, and an honest comparison against what Microsoft Defender already covers if you are licensed for it.

Learn more

Apple device management India

The layer every organisation should have first: enrolment, encryption, passcode policy, update compliance and lost-device handling.

Learn more

macOS security hardening

The hardening discipline that reduces the chance of compromise, which comes before any detection product.

Learn more
References

Official documentation

Next step

Start with whether anyone here is actually a target.

That question decides everything after it, and answering it carries no obligation. If the answer is no, we will tell you plainly and point you at the work that would genuinely reduce your risk. If it is yes, we start with the hardening that is already built into the platform before recommending anything you have to buy. Enquiries answered within 4 business hours.

Request a high-risk user assessmentExplore Apple device management