September 2026 Summaries

AI workstations such as NVIDIA DGX Spark are moving powerful model training, inference, datasets, vector stores, and AI agents from cloud infrastructure onto employee desks, making endpoint management central to protecting valuable data and access. NVIDIA provides tools for hardware inventory, diagnostics, and updates, but leaves enterprise functions such as device targeting, access control, scheduling, evidence retention, vulnerability detection, and remediation orchestration to customers. The text argues that managing these systems through SSH becomes difficult as deployments grow, while an agent-based platform such as Fleet can collect device state over outbound TLS, apply policies, automate responses, retain activity records, run vendor tools, and integrate AI workstations into existing Linux, macOS, and Windows management practices. It recommends treating DGX systems as standard workstations with shared baselines for patching, encryption, inventory, and change control, supplemented by hardware-specific policies managed through Git. It also notes limitations including Linux’s script-based configuration enforcement, lack of deadline-based OS updates, encryption requirements at initial provisioning, less precise vulnerability matching for NVIDIA components, no built-in rollback, and possible concerns about endpoint agents in regulated environments.

Windows provisioning packages can provide an alternative to Microsoft Autopilot for enrolling new Windows Pro, Enterprise, or Education devices in Fleet before end users reach the desktop. Built with Windows Configuration Designer and applied from a USB drive during initial setup, these packages install Fleet’s agent, allowing devices to enroll once online and later receive Windows MDM policies, disk encryption settings, and updates. The approach avoids Autopilot’s hardware-registration requirements and may eliminate the need for Microsoft Entra ID P1 licenses, which are required for Autopilot or Entra automatic enrollment unless already included in subscriptions such as Microsoft 365 E3 or E5. Resellers, OEMs, or internal IT staff can apply packages before shipping devices, although the process still requires someone to physically handle each device. Key limitations include no Entra ID device join, MDM configuration activation only after the user’s first sign-in, lack of identity verification during enrollment, the need to protect and rotate the package’s enrollment secret, and no MDM support for Windows Home editions.

SAP Privileges 2.6.0, the Mac Admins osquery extension, and Fleet’s agent added coordinated support for auditing macOS administrator-rights changes within roughly a week. Privileges enables temporary, self-service elevation for standard users and now uses Apple’s Endpoint Security framework to record every administrator grant or removal, including the responsible process, providing more detail than earlier generic change detection. Administrators can access this history locally through PrivilegesCLI, while the new privileges_events osquery table makes the same data available as SQL-queryable rows across an entire fleet, including changes made outside Privileges through System Settings or scripts. Deployment requires enabling the Privileges system extension and granting Full Disk Access, ideally through MDM configuration profiles, while existing osquery apps and system_extensions tables can report the app’s installation, version, and extension status.

Fleet Device Management announced on its sixth anniversary that it has joined Anthropic’s Project Glasswing controlled-access program for Claude Mythos Preview to evaluate frontier AI applications for device management, MDM protocols, and supporting infrastructure. The company plans to examine how AI could improve endpoint-state analysis, remediation prioritization, and the speed and safety of security operations as organizations face increasingly rapid AI-driven attacks. Fleet cited its research finding that 79% of organizations need more than a day to deploy critical patches, despite vulnerabilities sometimes being exploited within hours, underscoring the gap between threat emergence and remediation. Through early access to the technology, Fleet intends to test AI capabilities in real-world endpoint security workflows and share resulting lessons and best practices openly with customers and the broader security community.

Fleet CEO Mike McNeil will speak at Oktane 2026, held September 22–24 at Caesars Forum in Las Vegas, about extending consistent identity controls to Linux devices alongside macOS and Windows, with session details to be announced after the final schedule is released. Fleet will also exhibit at a booth, where it plans to discuss deeper Okta integrations for Linux, including device posture, FastPass, and passwordless sign-in, while demonstrating existing integrations such as managed Okta Verify deployment, Okta Device Access configuration for macOS and Windows, SAML-based single sign-on, and SCIM user and group synchronization. Booth visitors can receive a non-resale Fleet Premium license for up to 10 personal devices for two years, and those not attending can still try Fleet or contact the company.