Transcript
Let's start with a quick gut check. If someone asks you right now, is your Mac fleet secure? What would you tell them? Answering that question is basically this whole session. This is advanced Mac management. Once you've created your baseline for enrollment, what comes next is all about securing what's running on your fleet, including AI. Today isn't about starting over, it's about the next stage. You've got your baseline covered and now you need to optimize running that fleet at scale securely in a world where AI tools showed up on your devices whether you invited them or not. Let's start with exactly what we hope you walk away with today. The first thing we'll do is make a case that management is security at this advanced stage, including governing the AI tools that are already running on your devices. Second, we're going to dive in on the capabilities and workflows behind that claim. Not a feature list, but more how these things work together on a device to achieve the outcome. Third, we'll borrow a NIST framework, identify, protect, detect, respond, and recover as a lens for how we scale our Mac management. Maybe we'll even use it live on our own fleet before we're done today. That way you can leave the webinar with a rough 2027 roadmap and not just an idea of one. Hopefully that resonates because the truth is management isn't different from security. At the advanced stage, it is security. How many folks on your team would agree with that? How do you think your security team would react to a statement like that? Because here's the truth. AI tools are now just part of the enterprise environment, the same way Chrome extensions or Slack became part of it a few years back. Which means securing your fleet stopped being only about blocking known threats. It's about governing what's actually running, whether you can see it or not. Let's go prove that thesis instead of just claiming it's true. We'll start with why management is the foundation for security, including AI governance. Here's the case I want to make. Configuration, identity, and endpoint security aren't adjacent to security, they are the security. Think back to the last postmortem you read or sat through for the last breach. Go far back into that timeline, and it almost never opens with a sophisticated zero-day attack. It opens with something that's usually a lot more boring. A setting nobody hardened, a local admin account that nobody cleaned up, or an app that quietly missed three patch cycles because nobody was tracking it. Now add in all the new things, AI tools, agents, and MCP servers running on managed devices exactly the way apps always have. The rules don't change just because the thing that's running is new. The same rule applies. If IT can't see it, IT can't govern it. That was true of rogue browser extensions back in 2019, and it's true for unsanctioned AI agents today. And here's what some organizations fall straight into. No, let's just block everything, which is a reasonable response to something that's moving so fast. Eventually, though, that's going to have to change, right? Employees aren't going to follow that. And it's going to stop scaling the moment someone finds a workaround, whether they do it themselves or use the AI to help them do it. Back in January, Gartner projected a 44% growth in worldwide AI spending in 2026 alone. And investment in AI is scaling far faster than most governance programs can keep pace with. That gap between how fast AI shows up and how fast anyone gets around to governing it, that's the gap that's the risk, not necessarily the AI itself. Most employees are already using AI tools their employer never approved. Could you right now name all the AI tools that are running across your fleet? Most organizations say that they can't. You can't govern what you can't see. So what does management and security actually look like in practice? Four things I'll take you through, and I want you to notice how they all kind of follow the same pattern. First is platform SSO and identity modernization, which can help you implement zero-trust strategies. Access becomes a security control instead of an IT convenience because the provisioning and deprovisioning tracks identity status automatically. It won't be a ticket that's sitting in someone's queue that creates an open window for risk. Next is reduced local admin account dependence. Fewer standing privileges that are sitting around waiting to be exploited the moment a device or an account gets compromised. Next up is fleet-level AI visibility. So you can actually see which AI tools and agents are running what they're doing, whether they're sanctioned or not. And of course, governing that AI tool behavior. Instead of a blanket block, let's pull shadow AI just like we did with shadow IT inside a governance boundary instead of pushing it further underground where we can't see what it's doing. So the same pattern across the four categories. Less blind trust and more zero-trust strategies. Increased visibility, less standing risk just sitting around. So let's go into more detail. Let's talk about the capabilities, workflows, and settings sitting behind all the things that I just described. This is where, just trust me, turns into here's exactly how you can do this. I want to walk you through all of these less like a feature list and more like what it actually means for a managed Mac because that's a lot closer to how IT and security teams actually experience it. So let's call this day one. A new hire's laptop ships straight from Apple to their front door. The same thing happened to me literally just a few weeks ago. I'm on a new laptop that got shipped directly to me. No IT hands-on device setup. You don't need a staging closet. You no longer need to image to build that device out. It powers on and it already knows who it belongs to and what role it's configuring for. That is zero-touch role-based provision. And in Jamf, that's through automated device enrollment and pre-stage enrollments that you can scope by role through smart groups. The security payoff here is simple. It gives you a consistent baseline from first boot. There's no unmanaged window where that device just sits there exposed before IT lays eyes on it. Now let's fast forward a few months into that device's lifecycle. The employee is off to work and those settings are probably going to drift a little bit. They somehow always do. Somebody might change a preference or there's an update that quietly resets a policy. Whatever flavor of the week you would like for today. Configuration profiles and policies delivered via Blueprints and Jamf are what catches that automatically. Declarative management applies the setting and keeps reapplying it so drift gets corrected when it happens instead of accumulating over time. All enforced through the compliance baseline editor in Jamf so you can map to common compliance baselines like CIS or NIST. And the security outcome here is you get that automatic carding that's going to survive a user's attempt to change it. Whether it's intentional or not because sometimes it's a mistake. And the last one here automated vulnerability and patch management. Patching, software update enforcement and deadlines these are all tied directly to the device and the app inventory so the better inventory you have the more reliable the patching. And the goal is that this runs on its own schedule without anyone having to babysit it. In Jamf that's patch policies and automation including app installers plus software update enforcement and deadlines. What that buys you is the ability to be proactive instead of being reactive. Any known vulnerabilities can close on a predictable cadence and your admins get back time instead of having to chase patch policies and compliance by hand. Now moving on to these next capabilities that are less about the device itself and more about everything that's connected to it. That same employee eventually changes teams or leaves the company altogether. Identity monetization and platform SSO means access provisions and deprovisions as well. All happening automatically and tied to that identity status. Nobody has to remember to revoke anything on their way out the door. This all happens through platform SSO for macOS paired with your identity, your cloud identity provider integration. The security payoff here is no orphaned accounts are quietly sitting around after somebody's role changes or after they're long gone from the company. Meanwhile, IT isn't refixing the same 10 problems by hand every single week. This is where automation and scripting that are all version controlled give you that recurring remediation that runs on a schedule. It gets tested and it can be rolled back and you can treat it like real code, not like a script that somebody wrote in a panic and never opened again. In practice, this means Jamf Pro policies that are running scripted actions with API and infrastructure as code support for that version controlled piece. The one here that manual inconsistent fixes turn into something observable and repeatable. And the piece that ties directly back to everything we opened this webinar with that AI tool and agent discovery with governed behavior. The fleet wide inventory of what's running with vendor correct controls over model access, file access, and network boundaries all governed at the device layer where network level controls can't reach. The settings here are all around AI application discovery for shadow AI visibility and then AI tool access policy controls, which we'll be reviewing a little bit later. These six capabilities are used across a single managed device's entire life from the moment it's unboxed to its steady state operation years later. And none of these outcomes required a human to remember to do something manually. They're all framed around automation, right? That's the whole point of advanced. Now let's borrow a framework a lot of you probably already know, but it'll help us visualize how we optimize that security workflow end to end. This is NIST Cybersecurity Framework's five core functions. And we're borrowing it because it's already the shared language that most security teams use to talk about maturity. And you can use it as a scorecard for your own organization. The first is identify. Do you actually know what devices and apps and AI tools or agents are running on your fleet right now? Not last quarter's inventory export, but right now. The next is protect. This is all the things we just walked through, right? Hardening baselines, automated patching, governed AI behavior, identity based access. Those same six capabilities from just a minute ago, but we've relabeled them through a security lens instead of an operations one. The third one here is detect. That continuous compliance monitoring that will catch drift and any emerging threats before your next schedule audit finds them. These last two functions are really about closing that loop. Number four is respond. When something does happen, can you contain it and start investigating it within minutes with all of the evidence preserved automatically, right? Instead of having to reconstruct what happened afterward from memory or have complete log files. The last one is recover. Can you get a device or an entire workflow back to a known good state without a multi-day manual rebuild eating away at your whole week? How quickly can you get back to that known good state? Identify, protect, detect, respond, and recover. NIST's framework that we're borrowing for today. Let's use it right now just for a second. I want you to score your organization one to five on each of those five functions, right? You can start with identify and be honest with yourself. If answering that means you might have to partner with others in your org, then take a guess right now and see how close you were after talking to those coworkers. But whatever function scored lowest, try to make that your Q1 priority for 2027. You can use this framework as a roadmap. You can sequence everything else across the rest of the year behind that first priority. And it could be the start to building a more secure foundation for your organization. So take a moment, score yourself, and if you want in the chat, go ahead and share which of the five functions you think that your organization should prioritize for Q1. Great. Now let's get to the part that I know some of us have been waiting for. Let's stop talking about it and actually see what it looks like in action. Our first demo is going to be all about AI tool and agent visibility. So we'll show you a little bit about Jamf's AI governance capabilities that really align to the identify pillar of the NIST framework. So you can find AI governance within your Jamf account menu in the sidebar. This AI visibility dashboard is powered by Jamf telemetry. And it gives you a high-level overview on which AI tools are being used in the organization. You can see things like the number of unique devices that have been observed using AI tools along with a daily breakdown of which tools were identified. You can then take a look at each individual AI tool usage, things like the most common apps and processes that launched the tool, the most common commands. You also get a list of risky commands flagged for you to review for unapproved usage or higher risk actions like initiating an SSH connection to access another system. Now, it may be okay for a human to do those things. We probably don't want AI doing those things, especially not autonomously. And that level of control could be accomplished using AI policies, which we'll get into in a second. But to dive deeper into any specific app, you can click details to view a report of just cloud code usage. And you can customize your viewing preferences. Toggling to all is going to show you every recorded launcher and command so you can get a full picture of how cloud code is actually being used in the organization, which could be insightful data. Now, let's say your organization only allows cloud code, which means nothing else should be on those devices, right? But all these other tools that you see here are the ones that you haven't approved. Somehow ended up on the device though, and users will manage to get them on the device. And at least now you have the visibility, right? You can use that information to determine which AI tools you want to allow and then make decisions on deployment, control, and configuration of those tools. So now let's turn to AI policies to see how we can accomplish that. Here's where we can create policies that configure AI tools to posture to your organization's needs. You can customize a policy to department needs because your engineers are probably going to use cloud in a different way than your finance department will. And you should create separate policies for each. Okay, so let's actually create one. First, you're going to select the AI tool. Today we offer support for cloud code and cloud desktop with others coming soon. These are separate, right? Because they're managed differently. They do different things. So we'll choose code. And the value in these AI policies is that you don't have to understand every aspect of cloud code. You don't have to be an expert. Jamf built the policy builder with simplicity in mind. So after you set up your method of authentication through Okta, Intra, or your IDP, you'll see the configurations by category. And these are made available in plain language so you don't have to do any deep dives into technical documentation. As an example, we want to enable our teams with cloud code, but I need to control costs. We can do that by limiting the model or the complexity of the model's reasoning. I'm going to choose SONNET or HYCU which are two of the lower price per usage models. For context, HYCU is half the cost of SONNET, but OPUS, the next model up, is double the cost of SONNET. So it could be an effective way to enable teams with tools and set limits on cost. You can also choose which model is the default as well as the level of reasoning and extended thinking which will both increase the number of tokens spent. Once you've configured what you want, you'll hit next, give it a name, review it, and then hit create. And you'll see it show up in your policies list. A blueprint component with these settings will be created in Jamf Pro for you for deployment. We're going to head over to Jamf Pro and go ahead and create a blueprint so that we can apply this AI policy. We'll search Claude to find the component that was created and go ahead and add it to the blueprint. We're going to select that HYCU and SONNET one that we just created. We'll add it, name it, and then we'll be able to scope it. Since this is Jamf Blueprints, this will deploy using DDM and enforce on the device, keeping them compliant even without an internet connection. So Jamf's AI governance gives you the visibility and configuration control, which not only help the identify and protect pillars of the NIST framework, with Jamf AI governance, you can also download an AI governance report that is audit ready and also useful in the respond pillar of the NIST framework. Since it's tracking changes over time, it will serve as proof for how your organization enforced a policy on AI tools as you create more AI policies and eliminate those non-compliant tools and usage. It comes as a PDF and it can be shared with whoever might need it without needing to give them access to the Jamf account. So that's Jamf AI governance giving you AI visibility and configuration control to help keep costs down while still enabling end users with the AI tools that will help them be more successful in their daily roles. Now let's move on to our second demo, which will work across the detect and protect pillars of the NIST framework. This is more around compliance drift and remediation. And we can accomplish that through compliance benchmarks. This capability helps IT maintain security controls that align with your compliance needs. There are templates that align to standards like CIS or NIST. So you'll be presented with the available templates when you open up the blueprints menu. We'll go ahead and select compliance to get there. If you're selecting it for the first time, you may be greeted with SSO setup is required. I'll post a link to the documentation on how to configure SSO in Jamf account. And if you're greeted with a login error that you see here, try logging out and logging back in using SSO. First, we're going to select the template by clicking get started for the template that you want to use. And when you get there, it's going to already be named for you. So the next thing we need to do is select an enforcement type. Monitor will monitor and document compliance status without actively enforcing it, which is great for a first time deployment, right? In the spirit of visibility, we want to seek to understand and establish that baseline before we enforce stricter controls. But monitor and enforce will do both for you using configuration profiles and automated workflows to get you there. You'll hit next so we can add a scope and you're going to need to select from an existing smart group. So make sure you've created it before you start. Now we're going to customize the rules for this benchmark and you'll see that the rules shown here all align to the template that you selected. Each rule will display the operating system that it applies to so you know where it'll go. And all the rules are selected by default so you can go in and customize as you need to. Some rules like the software update deferral rule can be customized with an organization defined value. So once you've got it in a good place, you'll click save and then we'll go ahead and deploy it. It can take up to 15 minutes to update based on how many rules or settings were selected, but once it is fully updated, you'll see it change from in progress to deployed when it's complete. And then you can head to the available tab to either create another benchmark or we can go back to that enable tab to view all of your deployed benchmarks. For any given benchmark you can click the view details by clicking on open. And then you can review all of the objects that were created to satisfy this benchmark and its rules. You can also change any of the rules by clicking open to make your changes. And then of course there's going to be one last step to give you time to review. You'll see that banner there. It'll give you an opportunity to revert back if you want to discard those changes or you can go ahead and click deploy. Again, it might take a few minutes but once it's there, you can check things like compliance score and pass fail rates in the rule report tab. You can also export a CSV file of that rule report similar to what we saw with AI policies. If you need full auditing documentation you'll find that under configuration and you'll be able to get those auditing documents. You'll just select the format and download to share with auditors or anyone else in your organization. Then when you're ready to enforce, you can go to that compliance benchmark, go to edit and click monitor and enforce. You'll hit save draft and then you'll see that banner one more time to remind you to click deploy and you'll see things change under management settings. That's the signal to you that new policies and configuration profiles were generated to actively enforce those rules, not just monitor them. So compliance benchmarks offers you an excellent way to create compliance baselines for your organization. Automatically enforcing them, Jamf Pro will take care of creating all those settings for you so that you can actually enforce them and report back. All of this is available to you in auditing documentation as well, so hopefully helping you and your team save a ton of time when it comes to those audits or that compliance enforcement. Alright, and that brings us to the end of our webinar. So let's do a quick recap of everything that we went over. One, management is the foundation of security. And that includes AI governance today. Two, the capabilities that make that real are not theoretical, right? Provisioning, patching, identity, automation, and AI visibility all available through the Jamf platform to help you reach those goals. Three, identify, protect, detect, respond, and recover. Not just the framework that we borrowed from NIST, but hopefully it's a scorecard to help you build out that 2027 roadmap for your Mac management strategy so you can scale it to a more advanced and secure environment. I appreciate you all taking time to join us today. I hope you found this webinar useful. Before we go into the Q&A, just a reminder that the recording of this presentation will be shared with you via email within a few days. Please, if you've got the time, take a moment to take our survey at the end of the webinar. We'd love your feedback and hope to learn more about what topics you want to hear about next. Thanks for tuning in.
