- Zen IT Technologies
- Endpoint Management & MDM
Every laptop accounted for, from purchase to retirement.
A device estate is rarely designed. It accumulates: a laptop bought in a hurry, a management platform chosen for one operating system and stretched to cover two more, an encryption policy everyone believes is enforced. The result is a security posture nobody chose and nobody can evidence.
We build the estate deliberately and then run it. New devices reach a managed and secured state from first login, the baseline holds as the fleet grows, and every device has an owner, a state, and an end.
The problem
A fleet nobody designed is a fleet nobody can answer for.
The questions arrive from outside. An auditor asks which devices are encrypted and how quickly they are patched. A customer questionnaire asks how quickly a lost laptop can be locked. A new hire asks why their machine took three days. All three have the same root cause: the estate grew faster than the process around it.
These are the failures we are called in for, and they are consistent:
-
Provisioning by hand.
Days of someone's time for every new hire, and a device that ends up subtly different from every other device.
-
Endpoints running last quarter's software.
Operating systems and applications left on whatever version was originally installed, on machines nobody is managing. Given the speed at which flaws are now found and exploited, an unpatched device is not a risk waiting to happen; it is an exposure that already exists.
-
Encryption assumed, not proven.
Widely believed to be on, with no report that says so and nothing to hand an auditor.
-
A browser nobody manages.
Extensions installed at will, no control over what can be uploaded or synced out of it, and the one application everybody actually works in left outside the managed estate entirely.
-
Alert volume nobody triages.
An endpoint detection platform producing more than a human can read, or blocking legitimate software after an operating system update.
-
Devices that left with people.
Offboarded machines never wiped, never recovered, and still holding credentials and company data.
-
An inventory that stopped being true.
A spreadsheet accurate on the day it was made, and diverging from the fleet every day since.
What we do
- Joiner
- Zero-touch enrollment
- Managed device
- Patching and baseline
- Certified erasure
Lifecycle and migration
-
Zero-touch deployment
Automated enrollment across macOS, Windows and Linux, so a device out of its box reaches a managed and secured state at first login with almost no involvement from anyone. Encryption, security controls and identity are applied by policy rather than by a checklist someone follows, and the applications the person actually needs are delivered as part of enrollment, so the machine arrives ready to work rather than ready to be set up.
-
Patch and software management
Operating systems and applications kept current across all three platforms, on a schedule rather than on a reminder. Updates staged and monitored so a bad release does not reach the whole fleet at once, and software deployed, updated and removed centrally instead of installed by whoever needed it first. When an auditor or customer questionnaire asks which versions are running, there is a report to answer it.
-
Browser management
Most work now happens in the browser and so does most of the exposure, which makes it infrastructure rather than a personal preference. We enroll and manage it like any other platform: extensions permitted by policy rather than by whoever installed them first, safe browsing and download controls enforced centrally, and data-loss controls over what can be copied, uploaded or synced out through it.
-
Security baseline and data protection
Encryption, policy enforcement and configuration baselines, with the reporting that turns each of those from a belief into evidence, written to answer the device questions in a SOC 2 assessment or a customer security questionnaire before they are asked. A lock or wipe command can be issued immediately and enforced when the device checks in; a device caught up in an incident is isolated through the same management layer. Company data on hardware you no longer physically control becomes a managed process rather than an open question.
-
EDR done properly
EDR/XDR deployment, and then the part that usually goes wrong: exclusion policy engineered fleet-wide from analysis, rather than accreted one alert at a time until nobody trusts the console. Where the platform itself is at fault we escalate it to the vendor and track it to a fix.
-
Lifecycle and migration
Device provisioning, reassignment and retirement tied to joiner, mover and leaver events from the identity platform, hardware tracked from purchase to disposal, and migrations between management platforms carried out with enrollment preserved rather than by re-provisioning the fleet.
-
Asset inventory and device reconciliation
Asset inventory and device reconciliation across Jamf, Iru, Mosyle, JumpCloud, and Intune, keeping the recorded fleet aligned with the devices actually under management. The result is a current operational record rather than a spreadsheet that drifts away from the fleet over time.
Technical notes
What zero-touch actually requires
Registration, managed enrollment, identity, and security state all have to line up before the device is ready.
How it runs
-
Discovery.
What the fleet actually contains, how each device is enrolled, and which parts of the baseline are real rather than assumed.
-
Design.
The enrollment model, the security baseline, and the lifecycle flows, written down before anything is deployed.
-
Rollout.
Enrollment rolled out in waves, existing devices migrated without re-provisioning, and the baseline enforced across all three operating systems.
-
Managed.
The estate stays in the state it was designed in. New devices arrive under policy, the baseline moves as the platforms and the threats do, and the inventory is current because it is a product of the system rather than a document.
Proof
-
A cross-platform endpoint estate moved to zero-touch deployment.
Technology company
Device provisioning redesigned across macOS, Windows, and Linux around automated enrollment, encryption, security controls, and identity. A new device now reaches a managed and secured state from first login with almost no IT involvement.
-
Manual laptop builds removed from onboarding.
Technology company
New devices previously required hands-on IT setup before they could reach users. Enrollment, identity, security tooling, applications and baseline policies were moved into the device-management platform so a new or factory-reset device could be shipped directly to an employee and configure itself after sign-in.
-
A management platform migrated with enrollment preserved.
Technology company
Devices moved between management platforms without re-provisioning: enrollment sequenced in waves, the security baseline reproduced and verified on the new platform, and users kept working through the cutover.
Client examples are anonymized by design. References are provided privately, on request, and with the client's consent.
Who this is for
Companies where the fleet has outgrown hands-on administration. Usually there is a point where this becomes obvious: the thirtieth laptop, a second operating system, or the first time someone asks which devices are encrypted and there is no report that can answer the question.
It is also the point where onboarding stops scaling. If preparing a laptop for every new employee takes somebody most of a day, that time adds up quickly as the company grows.
SOC 2 or a customer security questionnaire may set the deadline, but these controls make sense regardless. For a small fleet that rarely changes, a one-off deployment project may be all that is needed, and we will say so.
Frequently asked questions
-
Do we need MDM if we already run EDR?
Yes, they answer different questions. EDR watches for malicious behavior on a device. MDM decides what the device is allowed to be in the first place: enrolled, encrypted, patched, configured, and removable. EDR without MDM detects trouble on machines nobody controls.
-
Can you manage Linux alongside macOS and Windows?
Yes, and it is usually the reason we are called. Linux is where most estates stop being managed, because the platform that covers the other two does not cover it well. We build around that rather than pretending one tool does everything.
-
What happens to a device when someone leaves?
It is locked or wiped from the same process that removes their accounts, rather than as a separate task somebody remembers. Where the device is returned it is erased and re-staged; where it is not, the remote-wipe command is issued and its status tracked in the inventory.
-
How disruptive is enrolling a fleet that is already deployed?
Less than people expect. Existing devices are migrated with enrollment preserved rather than re-provisioned, in waves, so nobody loses a working machine for a day. Where a platform migration genuinely cannot preserve enrollment we say so before it starts.
-
What about personal devices?
They are handled by policy rather than by management: conditional access, application boundaries, and what company data is allowed to reach them. We do not put management profiles on hardware the company does not own.
-
Do you offer White Glove services in the USA?
Yes, through White Glove Services (USA).
Full endpoint lifecycle: procurement, provisioning, storage, distribution, end-of-life data erasure, and environmentally responsible disposal.
Find out what your fleet is actually running.
A 30-minute call with Jonny. We reply within one business day.