Microsoft Intune, devices that arrive ready and stay compliant.

Staff were running personal apps on company phones and copying sensitive client email across into personal accounts. Nobody could reliably detect it happening and nobody could prove it afterwards.

We put application protection policies in place that govern the corporate data and nothing else. People keep their own apps, but work email can no longer be copied or forwarded into a personal account, and the corporate side can be wiped on its own whenever it needs to be.

Getting a new starter working took three days, because somebody in IT had to sit and configure every laptop by hand with applications, VPN and security settings. Both HR and IT were buried in setup tickets.

We deployed Windows Autopilot. A new hire now opens the box, signs in with their work credentials, and Office, the VPN, the line of business applications and the security policies all install on their own. Nobody in IT ever handles the machine.

A sales-team iPad containing client records was stolen from a car at an airport parking lot during a business trip. The brokerage faced potential SOX reporting and reputational damage if the data leaked.

The remote wipe went out two minutes after the theft was reported, and the device was erased before whoever took it had even powered it on. Conditional access then stopped that device re-enrolling at all without somebody in IT approving it.

Staff were installing whatever they liked from the App Store and the Play Store. One of those apps carried malware that came close to reaching the electronic health record system, which triggered an incident review under HIPAA.

We moved to an approved application list backed by a managed catalog. On a managed device only pre-approved business apps can be installed and personal ones are blocked outright. On personally owned devices we use application management policies alone, so people keep their own apps while the corporate data stays protected.