Trio MDM

25/09/2026

IT compliance has an ownership problem in most smaller companies. Nobody owns it, and all of it arrives on the IT desk anyway.

Legal owns the framework. Finance owns the budget for the audit. Somebody in operations owns the policy document that gets updated once a year. Then the assessor asks for evidence that every laptop is encrypted, and the only person who can produce that is you.

It isn't a department. It's a set of questions that all resolve to the device layer.

The full guide covers which controls carry the most weight and where the evidence for each one actually comes from.

Worth a full read:
https://hubs.li/Q04tYLWN0

Learn how TrioMDM helps SMBs achieve IT compliance across Windows 10 & 11, Android, and iOS. Automate security, audits, and reporting while reducing IT costs.

25/09/2026

IT asset reconciliation produces three numbers for one question. Finance says 340 laptops. The MDM says 318. The asset spreadsheet says 361.

All three are maintained by people doing their jobs properly, and all three describe the same company on the same day.

Finance counts what was purchased. The MDM counts what has checked in recently. The spreadsheet counts what somebody typed in, including the eleven laptops sent for repair in 2024 and never removed.

The gap that matters is 22 devices between purchased and managed.

Which of the three does your company actually report?

24/09/2026

School device management has a September mismatch that catches nearly everybody out. Every student moved up a year group, and not a single device policy went with them.

So a Year 9 student is carrying a device restricted for Year 7, and a Year 7 student has the freedoms signed off for somebody two years older. The first produces a complaint from a teacher, and the second produces a much worse conversation.

The devices didn't move because nothing told them to. The student record system knows the new year group, and the device groups were built in August.

Policies attach to the device rather than the group, which is deliberate. The trade is that a device carries its old set into its new group until somebody assigns the new one.

What's the actual process at your school for moving devices between year groups?

24/09/2026

BYOD device management fails on belief far more often than on technology. The work profile on a personal phone is a boundary the operating system enforces, not a promise your policy makes.

Almost nobody explains that to the people being asked to enroll, so they fill the gap themselves. Some decide you can read their messages and either refuse outright or carry a second phone, and others decide you can see nothing at all and start putting client files in personal storage.

On Android the work profile holds the line, and on iOS it's user enrollment. Either way the separation sits in the platform.

What do your BYOD users think you can see?

23/09/2026

Retail device management has a component that nobody ever actually decided on. Every barcode scanner in your stockroom has a camera nobody specified and nobody switched off.

It's there because rugged handhelds and POS tablets are built on consumer hardware, and consumer hardware comes with a camera. It arrived in the box, the device worked on day one, and nobody looked past that.

Then you notice where those devices sit all day. A stockroom, a back office with the safe in it, a POS terminal pointed at a card reader.

What hardware on your frontline devices is switched on purely because it shipped that way?

23/09/2026

Linux patch management just got a three-day deadline, which is not the usual three weeks. CISA added three kernel flaws to its Known Exploited Vulnerabilities catalog and told federal agencies to fix all three inside 72 hours.

One is rated 9.8 and sits in the kernel's TLS receive path. The other two affect socket handling and bridge firewall rules. Between them they allow crashes, memory disclosure, and memory being modified outside its intended buffer.

The part worth noticing is the numbering. Two of the three are 2025 CVEs, so the patches have existed for months. What changed this week is confirmation they're being used.

How would you find out today which kernel version your Linux hosts are running?

22/09/2026

IT audit questions have one that nobody can ever answer. A policy setting is different from how it was in March, and not one person remembers changing it.

Three people have admin access. All three are certain it wasn't them, and all three are probably right, because the change was made during a migration by somebody following a runbook that told them to.

The setting itself isn't the problem. Not being able to account for it is, and that's the version an auditor cares about.

When a setting changes at your company, is there a record of who and when?

22/09/2026

Apple MDM setup has four things that expire every single year, and three of them fail silently.

An APNs certificate, a DEP token and a VPP token. Let the first lapse and management stops entirely, no locks, no wipes, no app pushes, on every Apple device you own. The devices keep working perfectly, which is exactly why nobody notices.

The fourth is the one that causes the damage. All three are tied to a single Apple ID, and if that Apple ID belonged to somebody who left, renewing any of them becomes a much longer conversation.

Which of those four is documented at your company?

21/09/2026

Apple device management has one predictable September problem. A major OS release lands, and Apple asks your users about it rather than asking you.

Somebody in sales installs it the first evening. The line-of-business app finance depends on turns out to have an issue with the new release. You find out on Tuesday, from the person it happened to, at a point where 40 devices have already taken it.

Nobody did anything wrong. Users update because the phone tells them to.

How far behind the release do you hold your fleet, and who decides when it moves?

21/09/2026

Android device management has a question this malware turns into a real one. The user deleted the app, and the app came back.

RatHat arrives as a sideloaded APK, then abuses Accessibility to walk into Settings on its own. It switches on Developer Options and Wireless Debugging, reads its own pairing code off the screen, and pairs with the phone's own debug service. No cable, no computer.

That gets it shell-level access and a second agent living outside the app. Remove the app and the agent reinstalls it. Remove the agent and the app puts it back.

On a fully managed phone you can switch debugging off and none of it starts. On a personal phone you can't.

Which of your Android devices are fully managed?