Building a secure Android phone is one thing. Managing a hundred of them for a corporate customer is another. This case study shows how one vendor turned reselling MDM into a source of recurring revenue.
The vendor had already solved the hardware problem. Its phones ran a hardened Android build with unnecessary services removed. The real work started after delivery, when every device still had to be configured and checked against the customer’s security policy.
The company is a cybersecurity vendor based in Western Europe. It develops and supplies hardened Android phones to businesses whose employees deal with sensitive information, including senior executives.
Headwind MDM gave the company a way to manage those phones after they were delivered to the customer. The change cut the cost and time of onboarding new deployments by about half. It also gave the company a managed service it could offer alongside the hardware.
The Challenge: Strong Hardware, Manual Management
The phones were already secure when they left the factory. But customers kept asking for the same things:
- Centralized management. IT teams wanted to configure all company phones from one console instead of setting them up one by one.
- Fast onboarding. Customers wanted to enroll dozens of phones without repeating the same manual setup on every device.
- Compliance. Customers needed every phone to follow the same security policies, with a clear record showing that those policies had been applied.
Most cloud MDM products did not fit this type of deployment. For these customers, sending device management traffic through an outside cloud undermined part of the purpose of using a secure phone. Customers did not want device data leaving their own network. The phones themselves run GrapheneOS, a hardened Android build without Google Mobile Services, which rules out any MDM platform that depends on Google services for command delivery or enrollment.
The Solution: A Private MDM Server Inside the Customer’s Network
The vendor added Headwind MDM Premium to its secure phone offering:
- Each customer runs a private MDM server inside its own network. Management data stays inside the customer’s network. The server can also run in a fully isolated network with no internet access.
- IT teams manage all phones from one console. From the same console, IT teams can apply policies, install applications, and push updates.
- The vendor sells the phones and the management service as one package. Customers do not need to combine hardware and MDM from different suppliers.
Headwind MDM runs on AOSP devices from Android 9 onward, including GrapheneOS, and does not depend on Google Mobile Services. Command delivery works without Firebase, so devices stay manageable in air-gapped networks. IT teams enroll new phones with a QR code without connecting the fleet to Android Enterprise.
Source code access was another important requirement. Headwind MDM Community Edition is open source under the Apache License, and the Enterprise version follows an open-core model in which clients receive the source code of the mobile application. A security vendor cannot expect its clients to trust a black box. Clients can inspect and audit the code running on each managed phone.
The Results
The company saw several improvements soon after deployment:
- Onboarding new deployments took roughly half the time and cost. Instead of configuring every phone manually, the team could repeat the same enrollment process for every project.
- Security and compliance became easier to manage. The phones and their management now work together as one system, and administrators can verify that every device follows the customer’s security policies.
- An additional source of revenue. The vendor now includes Headwind MDM in projects for customers around the world. Instead of earning only from hardware sales, the company now also earns from ongoing management services.
The company estimates that Headwind MDM reduced onboarding costs by about 50%.
What This Means for Resellers and Solution Providers
We have seen the same pattern among other Headwind MDM partners. A company sells hardware or vertical software. Its clients need device management, but a third-party cloud subscription does not fit their technical or commercial requirements. The partner embeds Headwind MDM instead and sells a complete solution under its own brand.
The licensing model supports this approach. Headwind MDM Premium uses a one-time, per-server license instead of monthly, per-device billing. Full licensing details are available on the pricing page.
If you sell secure devices or deliver turnkey Android deployments, a self-hosted MDM can help you add managed services to your offering. Learn more on the reseller page.
