The State of MDM in 2026

As AI value moves to the endpoint, risk follows. AI-enabled endpoints can store or process sensitive data, proprietary prompts, model outputs, inference data, credentials, customer information, operational data, or intellectual property. If a user is putting sensitive information into shadow AI tools, applications, models, or services outside the visibility and governance of IT or security teams, and that data is exposed, the possible repercussions are enormous. 

According to IBM's 2025 Cost of a Data Breach Report, one in five surveyed organizations experienced breaches linked to shadow AI, and those incidents added an average of $670,000 to breach costs. Among them, 97% lacked proper AI access controls. 

In our survey, when asked how concerned they are about AI-related risks at the endpoint level, 60% of respondents said they are very or somewhat concerned.  While 10% indicated they were not at all concerned, that aligns with the respondents who are not currently deploying AI at the edge.

Why do organizations choose to run AI workloads on endpoints?  Data privacy was the number one reason, followed in a distant second by latency and performance, and then regulatory compliance, cost optimization, operational resilience, and, interestingly, the least concerning was end-user productivity.   It should be noted that in some industries regulatory compliance does rate higher than latency and performance, but never data 

What is keeping IT leaders up at night with respect to AI at the edge?  The number one reason is data leakage at 27% of respondents, followed closely by regulatory non-compliance and IP/model theft. Malicious manipulation of AI outputs and lack of visibility/control were less concerning for our respondents. 

Sixty-three % of our survey respondents indicated their organization has experienced a data compromise linked to shadow AI, a significantly larger number than those reporting an ‘issue with data leakage’ in the 2025 IBM report (20%).  Differences in methodology will create different results; however, it can be surmised that this risk is likely quickly trending upward. 

This is where MDM and UEM become strategically important. If organizations cannot see which devices are accessing AI tools, which applications are installed, where data is being processed, or whether corporate information is moving into unmanaged environments, they cannot effectively govern AI risk. 

The move toward edge AI is being driven by business value as much as by technical capability. Organizations want to make workflows faster, smarter, more resilient, and more responsive to local conditions.

Why do organizations choose to run AI workloads on endpoints? Data privacy was the number one reason, followed in a distant second by latency and performance, and then regulatory compliance, cost optimization, operational resilience, and, interestingly, the least concerning was end-user productivity. It should be noted that in some industries, regulatory compliance rates higher than latency and performance, but never data privacy.

These findings highlight the practical appeal of edge AI. In environments where seconds matter—retail checkout, emergency response, warehouse fulfillment, transportation, manufacturing, or clinical workflows—sending data to the cloud and waiting for a response may not be ideal. Edge AI allows decisions to happen closer to work. 

The device mix also shows that AI is not limited to traditional computing endpoints. Smartphones are the most common device type currently running or planned to run AI workloads by 45% of respondents. When combined with tablets, that number jumps to an astounding 77%. Laptops/desktops were also high at 34%, with rugged handhelds, wearables, kiosks, shared devices, and IoT devices also represented.  A total of 8.5% of respondents currently have no AI edge devices deployed.  

Modern endpoint management must evolve from device administration to data protection, identity-aware enforcement, AI governance, and security orchestration. 

Our research suggests that many organizations already recognize this shift. When asked whether endpoint management is a core component of their security architecture, 37% said it is critical, and another 36% said it is important. Only 8% do not think of endpoint management as part of their security architecture strategy. 

That is a crucial finding. MDM has historically been viewed by some organizations as an IT operations function: enroll the device, configure settings, push apps, enforce password requirements, and support users. In an AI-enabled environment, that view is too narrow. 

Endpoint management now plays a frontline role in answering questions such as:

• Is this device trusted?
• Is this application approved?
• Is corporate data separated from personal activity?
• Can AI-enabled apps access sensitive information?
• Are policies consistent across device types?
• Can compromised or non-compliant endpoints be isolated quickly?
• Are users interacting with AI tools in approved ways?
• Can the organization enforce controls without disrupting productivity?>

The data shows that many organizations are already using controls that support this approach. Among respondents, 70% said they use containerization, and 65% said they use application-level controls.  

The container acts like a walled-off environment. Apps and data inside it can't interact with apps and data outside it, unless specifically permitted. It's essentially running a secure "sandbox" alongside the normal, everyday use of the mobile device. This is critical when employees use personal devices, personal profiles, or personal AI tools. It also helps support policy-driven controls around where AI-enabled apps can run. 

Containerization and application-level controls are especially important in AI environments because they allow organizations to separate corporate data and workflows from personal use.  

Where are AI-enabled applications allowed to run? 52% of respondents are using fully managed corporate containers, 40% personal profiles with restrictions, and only 8% said AI applications are unrestricted.  

The fact that just 8% allow unrestricted AI-enabled applications is encouraging. But the sheer number allowing use in personal profiles with restrictions also highlights the complexity of "control" of modern endpoint environments. Organizations are trying to balance worker flexibility with corporate control—and AI makes that harder. 

Interestingly, confidence in data protection is relatively strong, but not universal. When asked how confident respondents were that proprietary data used by AI is protected on endpoints, 33% are extremely confident, 37% are very confident, 20% are somewhat confident, 5% are not so confident, and 5% are not at all confident.  

That means nearly 70% are very or extremely confident, but roughly 30% still have some level of uncertainty or concern. In a world where AI tools can process proprietary data quickly and at scale, that confidence gap matters.

Device ownership strategy has always affected security, support, user experience, and cost. AI raises the stakes. 

Bring your own device (BYOD), corporately owned, personally enabled (COPE), corporately owned, business-only (COBO), and shared device models each carry different risk profiles. In a traditional environment, the primary concern may have been whether corporate email, apps, or files could be accessed securely. In an AI-enabled environment, the concern expands to include where AI tools are running, what data they can access, whether prompts and outputs are protected, and how personal and corporate use are separated. 

The survey asked respondents to estimate the models their workforce is using BYOD, COPE, COBO, and shared/multi-user devices. The majority of organizations are mostly equally distributed in their model choice vs. a ‘dedicated’ strategy.  We found the typical organization has a mix of use cases and uses BYOD for knowledge workers, COPE or COBO for front-line field workers, and shared devices in retail and distribution.   Notable standouts were the 6% that reported being 100% BYOD (healthcare and pharmaceuticals), and another 6% were 100% shared devices (food and beverage). 

This suggests that many organizations are managing mixed ownership models rather than relying on a single device strategy. That creates complexity for MDM and UEM teams. 

BYOD can support flexibility, and many organizations offer employees stipends for BYOD devices, believing it's cheaper than providing hardware while also enabling employees to choose what they want. At Stratix, we've found that the typical stipend program is typically three times more expensive. 

BYOD also creates governance challenges when AI enters the picture. Personal devices may access corporate applications, but they may also contain personal AI tools, consumer cloud accounts, browser extensions, and unmanaged data pathways. COPE devices create a more controlled corporate foundation while still allowing personal use. COBO devices provide tighter business-only control, which may be preferable for sensitive workflows. Shared devices create a different challenge: ensuring user-specific access, clean session handling, app controls, and consistent policy enforcement across multiple workers. 

The right model depends on the workflow, risk level, regulatory environment, user population, and operational requirements. The key is that device ownership decisions can no longer be made primarily around cost or user preference. They must also be evaluated through a security AI governance lens. 

Many organizations have—or have prioritized—moving to a “single pane of glass” approach to endpoint management, with the goal of consolidating devices, operating systems, users, applications, and policies into a unified endpoint management platform. 

That strategy still has value. Consolidation can improve security, reduce administrative overhead, simplify reporting, standardize policy enforcement, and lower licensing complexity. But in practice, many organizations have found that one platform does not always meet every need equally well across every device type, operating system, use case, or frontline environment. 

Our research reflects this tension. 

We asked what drives their decision to use one versus many endpoint management platforms. Of those on the one-platform side, 42% said it’s because it's cost-effective and works well for their organization. However, 58% take a multi-platform approach based on varied use cases:

• 37%  because they deployed MDM solutions as they added technology or use cases.
• 12% said they rely on one primary endpoint solution but complement it with niche platforms for specific use cases.
• 9% said a single UEM would not work because they get better management or security by pairing MDM platforms with specific device types or use cases.

Overall, our respondents averaged three or more endpoint management platforms in their organizations. This is consistent with our previous State of MDM paper in 2023.  Consistent with our adoption question, only 16% of respondents used a single platform, and 59% used fewer than four platforms.  

This indicates that while many still prefer simplicity, a significant portion operates in more fragmented environments.  

Respondents reported using a wide range of endpoint management providers, including IBM MaaS360, Microsoft Intune, 42Gears, Esper, Ivanti, Jamf, MobileIron, Omnissa Workspace ONE, Samsung Knox, SOTI, and others.  

At Stratix, we understand there can be value in having multiple platforms for specific use cases, but we counsel organizations that may have simply added MDMs as they deployed new mobile solutions to consider more holistic UEM strategies because of the potential ROI. 

The most obvious cost of fractured environments is financial: overlapping licenses, vendor contracts, support costs, and integration expenses. But the larger impact may be operational and security-related. Multiple platforms can create inconsistent policies, reporting gaps, duplicated effort, fragmented expertise, and slower response when something goes wrong. 

We asked survey respondents to rank the impacts of using multiple MDM/UEM platforms. Increased security risk/gaps was first, followed closely by higher licensing costs, and IT expertise spread too thin, IT staff time, and then slower innovation coming in last.

The ranking is telling. While licensing costs matter, respondents identified security risk and gaps as the greatest concern. 

Clear indicators are that when endpoints are running AI workloads, accessing sensitive data, and connecting to critical systems, inconsistent policy enforcement becomes more dangerous. If one platform has strong controls and another has limited visibility, the organization’s risk is defined by the weakest link. 

IT expertise is another major challenge. Managing one MDM platform well requires specialized knowledge. Managing several requires broader skills, more training, more documentation, and more operational discipline. When AI-enabled endpoints are added to the mix, the skill ceiling rises again. Teams must understand not only device management but also data governance, AI application behavior, privacy requirements, threat detection, and automated response. 

The question is no longer simply “Can we manage our devices?” It is becoming: “Can we manage intelligence at the edge?” 

As endpoint environments become more complex, organizations must decide whether to rely primarily on internal expertise or partner with external specialists. In the research, 62% of respondents said they are more likely to use internal expertise, while the other 38% said they are more likely to use an external MSP.  

That split is important. Most organizations still expect internal teams to play the lead role, but more than one-third recognize a need for external support. 

For many enterprises, the answer may not be either/or. Internal teams understand the business, users, workflows, compliance obligations, and risk tolerance. External managed mobility or endpoint management partners can bring specialized platform expertise, deployment experience, lifecycle support, security best practices, and operational scale. 

This is especially valuable when organizations are managing diverse device fleets, multiple MDM platforms, frontline technology, rugged devices, shared-use environments, app ecosystems, and AI-enabled workflows. A consultative partner can help assess the current environment, identify risk, rationalize platforms, optimize policies, support migrations, manage lifecycle operations, and help ensure that endpoint strategy aligns with broader business and security goals. 

In 2026, organizations should not view managed services only as a way to offload tasks. They should view them as a way to increase maturity, reduce operational burden, close skills gaps, and move faster with greater confidence. 

AI is not only changing the endpoints being managed. It is also changing endpoint management itself. 

AI-driven features within MDM and UEM platforms can help organizations move beyond static policy enforcement. Instead of relying only on predefined rules, AI can support anomaly detection, automated remediation, predictive risk scoring, behavioral analysis, and smarter prioritization of threats or compliance issues. 

The research shows that adoption is already underway. When asked whether they currently use AI-driven features within their endpoint management platforms, 62% of respondents said yes, while 38% said no. 

Respondents also ranked the value of several AI-driven endpoint management features. Automated remediation received the highest score, followed closely by threat detection, predictive analytics, and user behavior analysis. 

This suggests organizations are placing the greatest value on AI capabilities that help them act quickly. Detection is important, but remediation is where security and operations come together. In large endpoint environments, speed matters. If AI can help identify a compromised device, enforce a corrective policy, isolate risk, or trigger a workflow before human teams manually intervene, the organization becomes more resilient. 

Predictive analytics and user behavior analysis may grow in importance as endpoint systems mature. These capabilities can help identify patterns that static rules miss, such as unusual app behavior, risky access patterns, unexpected data movement, or signs of compromised credentials. 

The long-term direction is clear: endpoint management is becoming more intelligent, automated, and risk-aware. 

Organizations are not the only ones using AI. Attackers are using it too. 

AI can help threat actors create more convincing phishing messages, automate reconnaissance, generate malicious code, identify vulnerabilities faster, personalize social engineering attempts, and adapt attacks based on target behavior. For endpoint teams, this means threats may become faster, more scalable, and harder to detect using traditional methods alone. 

The survey asked respondents what increases they have seen in AI-driven or more sophisticated endpoint attacks across sophistication, volume, and number of attack endpoints.  The most frequent response in the survey was 50% increase in all categories, with a few interesting data points:

• 11% of respondents have seen a 100% increase in attack endpoints
• Attack volume was the largest increase with 26% of respondents saying volume had grown 75-100%
• Only 14% o respondents did not see any increase in attacks

While the survey structure uses reported percentage increase categories rather than precise incident counts, the results suggest respondents are seeing increases across multiple dimensions. Attacks are not only becoming more frequent. They are also becoming more sophisticated and expanding across more endpoint types. 

MDM ownership is evolving. Security/CISO organizations were the most common owners of endpoint management at 42%, followed by IT operations at 30% and shared ownership at 25%.

This distribution reflects a broader shift: endpoint management is becoming a shared responsibility between IT operations and security. IT still plays a crucial role in device lifecycle, user support, configuration, and deployment. But security teams increasingly need endpoint management to enforce controls, reduce risk, and respond to modern threats. 

One of the central questions for 2026 is whether AI-driven endpoint security has become essential. 

The research suggests that many organizations believe it has. When asked whether they agree with the statement, “AI-driven endpoint security is now essential to defend against modern threats,” 74% said yes. 

That is one of the clearest signals in the data. 

Manual, rules-based endpoint management is not going away. Organizations will still need policies, configuration baselines, compliance rules, app controls, encryption requirements, access controls, and lifecycle processes. But static management alone may not be enough in an environment where endpoints are more intelligent, threats are more automated, and data movement is more dynamic. 

AI-driven endpoint security can help organizations detect patterns faster, prioritize risk, automate response, and adapt as conditions change. It can also help reduce the burden on IT and security teams that are already stretched thin. 

At the same time, confidence in current tools is relatively high but not absolute. When asked how well equipped their current tools are to combat AI-powered attacks, 73% said extremely or very confident, but 27% are not, and that's a significant number.  

This creates a strategic imperative. Organizations should not wait until AI-driven threats exceed their current capabilities. They should proactively assess whether their endpoint management platforms, policies, integrations, and operating models are prepared for AI-enabled risk.