Executive and VIP Device Protection Guide: Securing High-Value Targets

Executives, board members and other high-profile staff are targeted individually, often through their phones and personal accounts, by attackers with more patience and capability than the ones a standard endpoint baseline is designed for. National agencies now publish guidance specifically for highly targeted people: CISA's mobile communications best practice guidance of December 2024 and the NCSC's guidance for high-risk individuals both start from the assumption that these users will be singled out. This guide sets out how to run a protected tier for executives and VIPs: the threat model, the platform hardening modes (Apple Lockdown Mode, Android Advanced Protection and Google's Advanced Protection Program), account and communication protections, personal devices and delegates, travel, and how to respond to a spyware threat notification. It is written for endpoint, identity and security operations teams and for the executive assistants and security leads who support them.

Key takeaways

• Treat VIPs as a separate tier, not a stricter setting. Their devices, accounts, communications and support processes need their own baseline, owner and review cycle.
• Turn on the platform's hardening mode. Apple Lockdown Mode and Android Advanced Protection deliberately trade some features for a much smaller attack surface; both CISA and the NCSC point high-risk users to Lockdown Mode.
• Enrol in management before Lockdown Mode. A device in Lockdown Mode cannot install configuration profiles or enrol in MDM, but a device enrolled beforehand stays managed.
• Phishing-resistant authentication and a carrier PIN come first. FIDO security keys or passkeys for every executive account, no SMS codes, and a PIN on the mobile account to resist SIM swap.
• Personal accounts and devices are in scope. The NCSC warns that attackers target personal accounts because they look easier, so the protected tier must reach them through guidance, support and, where agreed, enrolment.

Why executives are different targets

An executive's device holds the organisation's most sensitive conversations, its approvals and a direct line to everyone else. CISA's guidance was written for people in senior government or political positions likely to hold information of interest to state-affiliated actors, after espionage against commercial telecommunications infrastructure, and its alert advises such users to assume that communications between mobile devices and internet services could be intercepted or manipulated. Corporate executives face the same categories of threat, with different actors.

For the wider threat background see the Commercial Spyware Guide and the Mobile Malware Guide.

Defining the protected tier

Write down who is in scope and why, because the controls cost convenience and need executive sponsorship.

• Who: the board, executive committee, their chiefs of staff and executive assistants (who hold calendars, mailboxes and travel plans), plus roles with unusual exposure such as heads of M&A, treasury, investor relations, government affairs and staff travelling to high-risk destinations.
• What: corporate phones, tablets and laptops; corporate and personal email, cloud and messaging accounts; mobile carrier accounts; home networks where agreed.
• Owner: a named security lead and a small, vetted support team who can provision, troubleshoot and investigate without routing VIP requests through the general help desk queue.
• Review: quarterly membership review and a re-assessment whenever someone takes on a high-profile role, a deal or a sensitive trip.

Small vs large organisations: a small company can protect five people with hardening modes, security keys and a carrier PIN, configured by hand and checked quarterly. A large enterprise should run the tier as a managed service: a dedicated MDM group or OU, a mobile threat defence agent where compatible, its own SOC use cases and a pre-arranged forensic partner.

Platform hardening modes

Both major mobile platforms now offer a single switch that turns on a set of protections designed for people at risk of sophisticated targeted attack.

Operating the modes

• Order of operations: enrol the device in MDM (supervised for iOS where your programme supports it), push configuration and apps, then turn on Lockdown Mode. Turning it on first blocks enrolment.
• Exclusions are risk decisions: Apple warns that excluding a website, app or contact reduces Lockdown Mode's protection. Keep a short list of business-critical exclusions, approved by the security lead, and review it with the tier membership.
• Expect friction: some web pages render badly, unknown FaceTime callers are blocked and shared albums disappear. Brief executives and assistants beforehand; most abandonments happen in the first week.
• All devices, not just the phone: Lockdown Mode is per device, so turn it on for the executive's iPad and Mac as well.

See the iOS and iPadOS Enterprise Security Guide and the Android Enterprise Security Guide.

Accounts and authentication

Most compromises of senior people still start with an account, not a device exploit. CISA recommends phishing-resistant FIDO authentication and moving away from SMS-based MFA, a password manager, and a PIN or passcode on the mobile carrier account.

• Security keys or passkeys everywhere: enforce FIDO2 on the corporate identity provider and on personal email and cloud accounts. Issue two hardware keys per person, one kept at home as a backup. See the Phishing-Resistant MFA Guide and the Passwordless and Passkeys Guide.
• Google Advanced Protection Program: for personal or corporate Google accounts, it requires a passkey or FIDO security key to sign in, applies stricter download checks, allows app installs only from verified stores and limits account data access to Google and verified third-party apps.
• Apple and carrier accounts: protect the Apple Account with security keys and add a carrier account PIN, which is the main defence against number takeover. See the SIM Swap Fraud Guide.
• Recovery is the soft spot: remove SMS and security questions from recovery options, and route any VIP account recovery through the protected tier team with in-person or video verification. See the Account Recovery and Help Desk Security Guide.
• Delegates: assistants with mailbox and calendar delegation need the same authentication strength as the executive, because their access is the executive's access.

Where guidance differs: the NCSC's guidance for high-risk individuals recommends two-step verification with an authenticator app, which is a sound minimum for personal accounts. For corporate accounts and anywhere the person will accept it, use FIDO, as CISA recommends, because authenticator codes can be relayed by real-time phishing.

Communications

CISA's core message is to use end-to-end encryption consistently and assume that ordinary mobile traffic can be intercepted.

• Messaging: use end-to-end encrypted apps with disappearing messages for sensitive discussions, such as Signal, which CISA names. Agree which app is approved for which class of conversation and whether records retention rules apply to it.
• SMS fallback: on iPhone, turn off sending as SMS when iMessage is unavailable (CISA). On Android, use RCS only where end-to-end encryption is enabled.
• DNS and transport: use encrypted DNS; on iPhone CISA recommends iCloud Private Relay, and on Android configuring Chrome to always use secure connections, Enhanced Protection in Safe Browsing and keeping Google Play Protect on.
• Personal VPNs: CISA advises avoiding personal VPN services, which shift trust to a provider rather than removing risk. Corporate VPN or zero trust access remains appropriate for corporate resources.
• Permissions: review and restrict app access to camera, microphone and location (CISA).
• Verification of instructions: any request from an executive to move money, share data or change access must be confirmed through a separate pre-registered channel. See the Executive Deepfake and CEO Fraud Guide.

Devices: corporate, personal and travel

Corporate devices

• Current hardware: CISA recommends the latest hardware from the manufacturer, and on Android choosing manufacturers with a strong security track record. The NCSC advises replacing devices before support ends.
• Fast patching: VIP devices should be in the first update ring, with a 48 to 72 hour target for operating system security updates, enforced through MDM compliance rules.
• Minimal apps: a short, managed app list; no sideloading; no enterprise app certificates beyond what is required.
• Compliance gating: conditional access that blocks corporate data on devices that are out of date or non-compliant. See the Device Trust and Posture Guide.
• Physical: a strong alphanumeric passcode, a power-on PIN and Find My or Find My Device turned on (NCSC).

Personal devices and family

The NCSC advises using corporately managed accounts and devices for work wherever possible, and asks high-risk individuals to report incidents even when they happen on a personal device. In practice the protected tier offers a voluntary personal device service: hardening mode set up in person, security keys for personal accounts, a carrier PIN, a privacy settings review and a direct reporting contact. Family members' devices often share accounts and home networks; include them in the briefing where the executive agrees. See the Executive Protection and Digital Footprint Guide and the BYOD Policy Template.

Travel

• Risk-based devices: for destinations your travel risk assessment rates as high risk, issue a loaner phone and laptop with minimal data and only the accounts needed for the trip, and do not reconnect them to corporate networks on return until they are reimaged.
• Charging and accessories: use own chargers; Lockdown Mode and Advanced Protection both restrict data over USB while locked.
• Networks: prefer cellular or corporate access over hotel and conference Wi-Fi; Lockdown Mode will not auto-join non-secure networks.

Spyware threat notifications and response

Apple sends threat notifications when it detects activity consistent with a mercenary spyware attack against a user, and describes them as high-confidence alerts. They appear on the iPhone Lock Screen and in Settings, by email from [email protected], and as a banner at the top of the user's Apple Account page at account.apple.com. Apple states that these notifications never ask the user to click links, open files, install apps or profiles, or give an Apple Account password or verification code.

1. Verify: confirm the notification by signing in at account.apple.com and checking for the banner; treat any notification that asks for a click or credential as phishing.
2. Escalate: the executive or assistant contacts the protected tier lead directly. Do not route through the general help desk.
3. Preserve: do not wipe or reset the device before a forensic decision is made; record the time, the notification content and the device details. See the Mobile Forensics Guide.
4. Contain: enable Lockdown Mode as Apple recommends, move the person to a clean replacement device, and rotate credentials and sessions from a known-clean device.
5. Get expert help: Apple points users to Access Now's Digital Security Helpline; organisations should also have a forensic partner and, where relevant, the national authority on call.
6. Review exposure: assume conversations, contacts and documents on the device were exposed and brief legal, communications and affected counterparts.

Detection and measurement

• Identity signals: new authenticator registrations, recovery attempts and sign-ins from new devices for any VIP account, alerted to the protected tier team, not just logged.
• Device signals: MDM compliance state, operating system version, hardening mode status where reportable, and mobile threat defence alerts. See the Mobile Threat Defense Buyer's Guide.
• Android intrusion logging: where Advanced Protection's optional intrusion logging is on, agree in advance how logs are accessed for an investigation.
• Carrier and impersonation signals: notifications of SIM changes or port-out requests, and reports of messages claiming to come from the executive.

Implementation roadmap

1. Sponsor and scope: agree the tier membership and the trade-offs with the chief executive or chair, so the controls are not quietly opted out of.
2. Accounts first: issue two security keys per person, enforce FIDO on corporate accounts, enrol willing members in Google's Advanced Protection Program, and set carrier PINs.
3. Pilot devices: enrol two or three volunteer executives' devices in MDM, then enable Lockdown Mode or Advanced Protection, and log every issue for two weeks. Rollback is turning the mode off on the device, which is immediate; record why.
4. Exclusion list and briefings: settle the approved exclusions and brief assistants on what changes.
5. Full tier rollout: devices, then personal accounts, then personal devices by agreement.
6. Response readiness: write the threat notification runbook, pre-stage replacement devices and contract a forensic partner.
7. Operate: quarterly membership and exclusion review, monthly metrics, and an exercise once a year.

Framework mapping

Common failure patterns

• Executive exemptions: the people most targeted get exceptions from MFA, compliance rules or update deadlines because the controls are inconvenient.
• Lockdown Mode before enrolment: the device then cannot be enrolled in MDM, so teams turn Lockdown Mode off to fix it and never turn it back on.
• Forgetting the assistant: the executive has security keys while the assistant with full mailbox delegation uses SMS codes.
• Personal accounts out of scope: the corporate account is locked down while the personal email and messaging accounts, where many lures arrive, use passwords and SMS.
• Wiping first: a suspected compromise is fixed by factory reset, destroying the evidence needed to understand what was exposed.
• Trusting the voice: staff act on a call or video that looks and sounds like the executive.

Lessons from incidents

In the Arup deepfake fraud, a finance employee made 15 transfers totalling HK$200 million after a video call in which, according to Hong Kong police, the CFO and other colleagues were deepfakes built from publicly available footage. No device or system was compromised. Protecting an executive therefore includes protecting staff from the executive's likeness: out-of-band verification for unusual requests, second approvers for payments and a culture where checking with head office is expected. See the Deepfake CEO Fraud Response Playbook.

Practitioner checklist

• Define the protected tier, its owner and its review cycle, with executive sponsorship.
• Enforce FIDO security keys or passkeys on all corporate accounts of members and their delegates; issue two keys each.
• Set a carrier account PIN and remove SMS and security questions from account recovery.
• Enrol devices in MDM first, then enable Lockdown Mode or Android Advanced Protection on every device the person uses.
• Keep hardening mode exclusions short, approved and reviewed quarterly.
• Put VIP devices in the first update ring and block corporate access from out-of-date devices.
• Agree approved end-to-end encrypted messaging and turn off SMS fallback.
• Offer a personal device and account service, and a direct reporting route for anything suspicious.
• Write and exercise a threat notification runbook that preserves evidence and provides a clean replacement device the same day.
• Require out-of-band verification for any executive instruction to move money or data.

Standards and references

• CISA: Mobile Communications Best Practice Guidance
• NCSC: Cyber security for high-risk individuals
• Apple: About Lockdown Mode
• Apple: About Apple threat notifications and protecting against mercenary spyware
• Google: Android Advanced Protection
• Google: Advanced Protection Program
• CISA: CISA Releases Best Practice Guidance for Mobile Communications
• SecurityWeek: CISA Releases Mobile Security Guidance After Chinese Telecom Hacking

Related NHI Mgmt Group resources: Mobile Device Security Guide · Endpoint Security Guide · Deepfake and AI Impersonation Guide · Vishing and Smishing Guide