# CapaOne > CapaOne is a Danish-built, EU-hosted unified endpoint management platform. It consolidates patching, OS deployment, third-party application management, privilege control (PAM), mobile device management, and vulnerability insight into one cloud-native platform — used with or without Microsoft Intune. Built on 30+ years of endpoint management expertise from CapaSystems A/S, and hosted entirely in the EU for a GDPR-first, NIS2-aligned posture. Key facts for accurate citation: - Vendor: CapaSystems A/S (founded 1 March 1996, Taastrup, Denmark). Product: CapaOne. - Differentiators: European data sovereignty (EU-hosted, GDPR-first and NIS2-aligned, with no transfer of endpoint data to US jurisdiction), a complete endpoint management platform that works with or without Microsoft Intune, single platform instead of a patchwork of tools. - Capabilities: automated patching, third-party app deployment, OS provisioning (MDT replacement), endpoint privilege management, mobile device management (iOS/Android/Apple Business Manager), vulnerability and asset insight, reporting and monitoring. This file holds the full text of every public page on capaone.com, generated from the live site at build time. The curated map is at https://capaone.com/llms.txt. # Core pages --- URL: https://capaone.com/ Summary: CapaOne unifies patching, OS deployment, privilege control, mobile and vulnerability insight in one EU-hosted platform — with or without Intune. Endpoint management, unified ## One platform. Every endpoint. With or without Intune. CapaOne consolidates patching, bare-metal OS deployment, privilege control, mobile management and vulnerability insights into a single platform. Book a Demo Start Free Trial 30+ years of endpoint experience 150K+ managed endpoints in the Nordics 1,000+ missing updates eliminated daily "We manage 3,000 devices across 60 offices from one platform — without an army of admins." NIRAS · Global engineering consultancy Trusted by IT teams across the Nordics NIRAS Global engineering consultancy Lattec Agricultural technology Holbæk Kommune Municipal government Vordingborg Køkkenet Retail & manufacturing Ishøj Kommune Municipal government Folketidende Gruppen Media & communications ISC Consulting engineers Dignity Financial services Two ways to run it ### Standalone, or with Intune Start where you are. CapaOne adapts to your Microsoft setup — or stands entirely on its own. #### CapaOne Standalone Complete endpoint management with zero dependency on Intune. Everything you need to deploy, secure and monitor your fleet in one place. Explore standalone → Most Popular #### CapaOne + Intune Keep your existing Microsoft investment and add the third-party patching and capabilities Intune doesn’t cover. See the integration → See it in action ### Take the product tour See CapaOne in action — no signup, no install. It takes about a minute. Before vs After ### From scattered tooling to one calm platform ✕6 separate tools to manage → ✓1 unified platform ✕Manual app packaging & patching → ✓Automated deployment in minutes ✕Standing local admin rights → ✓Just-in-time privilege elevation ✕Blind spots on vulnerabilities → ✓Continuous drift & risk visibility ✕Weeks to provision a new device → ✓Cloud-native OS deployment in hours ✕Fragmented mobile & desktop estate → ✓One console for every endpoint 30+ years of endpoint experience 150K+ managed endpoints in the Nordics 1,000+ missing updates eliminated daily Built for every IT role ### One platform, every persona Whatever your seat, CapaOne meets you where the work actually happens. IT Administrator #### Less scripting, more automation “I need patches deployed and drivers updated — without writing scripts or juggling five tools.” Explore → IT Manager #### Visibility and fewer vendors “I want to consolidate our toolstack and show leadership what’s actually happening across endpoints.” Explore → IT Executive / CIO #### ROI, compliance, sovereignty “We need EU data sovereignty, NIS2 alignment, and a platform that grows with us — not against us.” Explore → IT Support Team #### Resolve faster, escalate less “With one console I can see what’s broken and fix it — before the user even notices.” Explore → The product lineup ### Six integrated products. One console. Turn on what you need today, add the rest when you’re ready — all in the same platform. #### Application Manager Packaging and deployment, automated. → #### Privilege Manager Just-in-time elevation. Zero standing admin. → #### Provision Manager Cloud-native OS deployment. No imaging. → #### Mobile Manager Every mobile endpoint, one console. → #### Experience Monitor See what your users actually experience. → #### Security Monitor Continuous vulnerability and drift visibility. → Simple Pricing From €1 / endpoint / month No hidden costs. Start with one product — add more as you grow. See pricing → Customer stories ### Measurable outcomes, real teams 3,000+ Devices. 60 offices. One platform. “Keeping more than 3,000 devices updated across 60 offices around the world looked like an impossible task — but CapaOne made it really simple. Security has improved noticeably, and our daily work is far easier.” IT Manager NIRAS 2× daily Automatic checks. Zero manual effort. “Managing IT for 60 team members alone could have been a major challenge — but not anymore. Drivers and applications are automatically checked and updated twice a day. I no longer worry about patching or updates — it all just works.” IT Administrator Lattec 1,000+ → 0 Missing updates. Every day. “The first time I opened the dashboard, it showed over 1,000 missing updates. Today, it shows zero. With CapaOne, we’ve also strengthened security by removing local admin rights. Now we have full control and the freedom to focus on what truly matters.” IT Manager Vordingborg Køkkenet Self-driving IT operations on autopilot. “Before we got CapaOne, keeping every system up to date demanded constant manual work. Now, it’s like having a self-driving car — you let go of the wheel, and it drives itself. CapaOne has become the backbone of our everyday operations.” IT Manager Folketidende Gruppen 2,300 Devices. Full control. Since 2009. “With CapaOne, they’ve created something truly special. What really stands out is how CapaSystems listens to its users — it’s clear that our feedback directly shapes the product. We’ve finally gained the control and automation we’ve been looking for.” IT Specialist Svendborg Kommune 2,500 Devices updated automatically. “We used to spend far too much time keeping 2,500 devices up to date — now it happens automatically. CapaOne has really freed up our time, improved stability, and strengthened security. It’s become an essential part of how we run IT.” IT Administrator Ishøj Kommune One view Operations and support. Same tool. “The Reliability dashboard provides a quick and clear starting point for troubleshooting, allowing us to focus. Having to look at the same dashboards is a real advantage for us.” IT Specialist Holbæk Kommune FAQ ### Questions, answered **What Exactly Is CapaOne?** CapaOne is a single platform for managing every endpoint in your organization — patching, OS deployment, privilege control, mobile management and vulnerability insights — replacing the 4–6 point tools most IT teams stitch together today. **Do I Need Intune to Use CapaOne?** No. CapaOne works fully standalone for complete endpoint management. If you already run Intune, CapaOne adds third-party patching and capabilities Intune lacks — that’s our most popular setup. **Which Tools Does It Replace?** Typically it consolidates separate patching, app deployment, privilege management, OS provisioning, mobile management and vulnerability tools into one console. **How Fast Can We Deploy?** Most customers are up and running in days, not months — there is no on-prem infrastructure to stand up. **Is It GDPR-First and NIS2-Aligned?** Yes. CapaOne is Danish-built and EU-hosted, designed with GDPR and NIS2 requirements in mind. **Who Is CapaOne For?** It’s a great fit for organizations with roughly 250–1,000 endpoints that want enterprise-grade control without enterprise complexity. Latest from the blog ### Fresh thinking on endpoint management Blog #### Endpoint Update Coverage: Turning Your Inventory Into a Work List Endpoint update coverage shows which endpoints your update process misses. Turn the inventory into a weekly work list with CapaOne. Read article → Blog #### Endpoint Management KPIs: The Few Numbers Leadership Can Use Five endpoint management KPIs leadership can act on, how to define them, and how CapaOne brings the data behind them into one console. Read article → View all articles → ### Ready to consolidate your endpoint stack? See CapaOne on your own estate — with or without Intune. Book a Demo Start Free Trial --- URL: https://capaone.com/company/ Summary: CapaOne exists to make the digital world simpler and safer. Built on 30+ years of endpoint management expertise, European by design. About Us ## Built for simplicity, driven by a unified Purpose. CapaOne exists to make the digital world simpler and safer. We believe IT teams shouldn't have to manage a patchwork of tools just to keep endpoints secure, compliant, and up to date. Danish-built EU-hosted 30+ years of expertise ### CapaSystems at a glance CapaSystems A/S is a Danish software company, founded on March 1, 1996, and headquartered in Taastrup, Denmark. It develops CapaOne, an EU-hosted endpoint management platform. The CEO is Martin Gudme Søndergaard. Company name CapaSystems A/S Product CapaOne Founded March 1, 1996 Headquarters Roskildevej 342 C, 2630 Taastrup, Denmark CEO Martin Gudme Søndergaard Phone +45 70 10 70 55 Email info@capasystems.com Websites capaone.com is the product site for CapaOne; capasystems.com and capasystems.dk are CapaSystems' corporate sites. Purpose To make the digital world simpler and safer. Vision To be the leading experts in smart and simple endpoint management solutions. The CapaOne Story ### 30+ years of endpoint management innovation CapaOne is the outcome of more than 30 years of endpoint management innovation — the next chapter in the legacy of CapaSystems, a trusted European pioneer in IT management. What started as powerful on-premise solutions has been transformed into a modern SaaS platform, rebuilt for cloud-first infrastructure and the way organizations work today. Organizations that adopt CapaOne streamline their endpoint operations, reduce costs, and empower their IT teams to work smarter. Developed in Denmark · Hosted in the EU Our Values ### What drives us every day #### Obsess Over Customers Everything starts and ends with creating real value for them. We listen closely, ship responsibly, and measure outcomes, not just outputs. #### Win Together True teamwork means owning outcomes, collaborating openly, and adapting fast. We share context, remove blockers, and make progress visible. #### Stay Curious Keep asking, keep learning, and keep pushing what's possible. Curiosity fuels better product decisions and smarter automation. #### Raise the Bar Strive for excellence in every detail, every time. From UX polish to platform reliability, we sweat the details so customers don't have to. Join Our Team → Values Leadership ### The team behind CapaOne Martin Gudme Søndergaard Chief Executive Officer Jan Rasmussen Chief Financial Officer Claus Holm Andresen Chief Commercial Officer Rikke Borup Chief Marketing Officer Dennis Busk Nyehuus Chief Services Officer Henrik Wendt Chief Technology Officer #### CapaOne Denmark HQ CapaSystems A/S Roskildevej 342 C 2630 Taastrup, Denmark +45 70 10 70 55 info@capasystems.com ### Consolidate your Endpoint Operations with CapaOne See how the platform brings all your endpoint tools under one roof. Book a Demo View Pricing --- URL: https://capaone.com/platform/ Summary: CapaOne unifies six endpoint management products in one EU-hosted console — patching, provisioning, privilege, mobile, monitoring and CVE. Works standalone Perfect with Intune ## A complete endpoint management platform. With Microsoft Intune, or entirely without it. CapaOne consolidates and streamlines endpoint operations across the organization — patching, OS deployment, privilege control, mobile management, experience monitoring, and vulnerability insight — eliminating the need for multiple point solutions. Book a Demo Start Free Trial CapaOne Platform - Application Manager 98% up to date - Privilege Manager 0 standing admins - Provision Manager <1h to ready - Mobile Manager 94% compliant - Experience Monitor 100% visibility - Security Monitor 0 critical exposed Trusted by IT teams across the Nordics NIRAS Global engineering consultancy Lattec Agricultural technology Holbæk Kommune Municipal government Vordingborg Køkkenet Retail & manufacturing Ishøj Kommune Municipal government Folketidende Gruppen Media & communications ISC Consulting engineers Dignity Financial services One platform, no tool overload ### How the platform is built Most IT teams stitch together four to five point tools to cover the endpoint estate. CapaOne replaces the patchwork with a single platform — a fit that matters most for mid-market organizations running lean IT teams. #### One lightweight agent A single agent on every endpoint feeds the whole platform — no stacking of separate agents from separate vendors. #### One console Patching, provisioning, privileges, mobile, monitoring, and vulnerability insight share one console, one inventory, and one set of groups. #### Six products, one platform Each product is a part of the platform. Turn on what you need today and add the rest when you are ready — nothing to re-install or re-architect. Parts of the platform ### Six integrated products Every product runs on the same agent, the same console, and the same inventory. Turn on what you need — they get stronger together. #### Application Manager Packaging and deployment, automated. Get applications out to every endpoint and keep them current — without scripting, manual packaging or chasing third-party updates. Explore Application Manager → #### Privilege Manager Just-in-time elevation. Zero standing admin. Remove local admin rights across the fleet without slowing anyone down — elevate specific actions only when they are needed. Explore Privilege Manager → #### Provision Manager Cloud-native OS deployment. No imaging. Take a device from bare metal to ready-to-work straight from the cloud — no on-prem imaging infrastructure to maintain. Explore Provision Manager → #### Mobile Manager Every mobile endpoint, one console. Bring iOS, iPadOS, and Android under unified management — company-owned and personal devices alike. Explore Mobile Manager → #### Experience Monitor See what your users actually experience. Real-time reliability analytics across the fleet, so you can fix problems before they reach the helpdesk. Explore Experience Monitor → #### Security Monitor Continuous vulnerability and drift visibility. Real-time visibility into endpoint vulnerabilities, risk-based prioritization, and push-button remediation — all in one EU-hosted platform. See what is exposed, act on it directly, and export the audit evidence your auditors require. Explore Security Monitor → See it in action ### See the platform in action A one-minute tour of the console — no signup, no install. Run CapaOne on its own — or alongside Intune ### Two ways to run the platform Start where you are. CapaOne stands entirely on its own — and if you already run Intune, the two divide the work cleanly. #### CapaOne Standalone - Complete endpoint management with zero Intune dependency - OS deployment, patching, privileges, and mobile in one place - No on-prem infrastructure to stand up or maintain Explore standalone → Most Popular #### CapaOne + Intune - CapaOne owns endpoint operations end to end; Intune keeps enrollment and compliance where you already run it - Third-party patching, drivers, and privilege control Intune lacks - Targets deployments with your existing Entra ID groups Why CapaOne + Intune → Built in Europe ### For sovereignty and compliance The platform processes sensitive operational data — patch status, vulnerabilities, privilege events. Where that data lives, and under which law, is a design decision. #### Danish-built, EU-hosted Built in Denmark on 30+ years of endpoint management heritage, and hosted entirely in the EU. #### GDPR-first, NIS2-aligned Privacy by design, documented DPA, and audit-ready evidence aligned with European regulation. #### No US jurisdiction exposure Endpoint data stays in the EU, with no transfer of endpoint data to US jurisdiction. #### 150,000+ endpoints Trusted across the Nordics — from municipalities to global engineering consultancies. Read about European sovereignty → Simple, per-endpoint pricing ### EUR 1 per endpoint, per month, per product Pick the products you need. Choose up to 5 Windows products and pay for a maximum of 3 — the estimator does the math for you. Estimate your price Request a Quote Questions, answered ### Frequently Asked Questions **How Does CapaOne Work with Microsoft Intune?** CapaOne works with Intune — using Entra ID groups, honoring group structure, and publishing updates and actions without interfering with existing Intune workflows. **Do I Need to Buy All Six CapaOne Products?** No. Each product is modular. But together, they create a single, unified endpoint management platform. **Does This Replace Existing Patching, Driver, or Vulnerability Tools?** Yes. CapaOne replaces many common point solutions, reducing cost and complexity. **How Fast Can We Get Value?** Typically same day: deploy the CapaOne agent, sync inventory, and start managing. **Is It Really Cloud Native?** Yes — no servers, no on-prem footprint, and instant global scale. **Where Is CapaOne Hosted?** Developed in Denmark, hosted in Europe, supporting EU digital sovereignty. **Where Can I Learn More About CapaOne Security and Compliance?** You can find more details on the Security & Compliance and European Sovereignty pages. **How Much Does the CapaOne Platform Cost?** CapaOne platform and its products are modular. You can get a price estimation using our Pricing Calculator, or contact us directly if you would like a binding price quotation. **Is CapaOne a Fit for Mid-Market Organizations?** Yes — CapaOne is built for mid-market IT teams running 200 to 1,000 endpoints. See our dedicated overview of endpoint management for mid-market organizations. ### See the platform on your own estate A personalized walkthrough — with Intune, or entirely without it. Book a Demo Start Free Trial --- URL: https://capaone.com/pricing/ Summary: Transparent, endpoint-based pricing for CapaOne. Pick your products, enter your endpoints, and get an instant estimate. Pricing ## Simple, endpoint-based pricing Pay per endpoint, per month. Pick exactly the products you need — or bundle all Windows modules at a discount. No hidden fees, no per-seat surprises. - 30+ years endpoint experience - 150,000+ endpoints managed - Danish-built, EU-hosted - GDPR-first & NIS2-aligned 🖥 ### Windows Manage, secure and monitor every Windows device. How many Windows endpoints? Choose your Windows products CapaOne Windows Bundle Best value All 5 Windows modules — pay for 3, get all 5. 3.00 EUR /endpoint or pick individual modules Privilege Manager Just-in-time elevation. Zero standing admin. 1.00 EUR /endpoint Application Manager Packaging and deployment, automated. 1.00 EUR /endpoint Provision Manager Cloud-native OS deployment. No imaging. 1.00 EUR /endpoint Security Monitor Continuous vulnerability and drift visibility. 1.00 EUR /endpoint Experience Monitor See what your users actually experience. 1.00 EUR /endpoint 📱 ### Mobile Bring every mobile endpoint into one console. How many mobile endpoints? Choose your Mobile product Mobile Manager Every mobile endpoint, one console. 1.00 EUR /endpoint Estimated monthly price – Billed annually – Minimum annual contract of 1,500 EUR applies Get a quote Prices in EUR excl. VAT. Minimum contract: 1,500 EUR/year. Volume discounts Endpoints | Discount | 1 – 100 | 0% | 101 – 200 | 10% | 201 – 400 | 20% | 401 – 800 | 30% | 801 – 1,600 | 40% | 1,601 – 3,200 | 50% | 3,201+ | 60% | Discounts are calculated separately for Windows and Mobile endpoints. ### Common questions #### What Counts as an Endpoint? Any managed device — physical or virtual. Windows endpoints and Mobile endpoints are counted separately for pricing and discount purposes. #### Can I Mix Individual Modules and the Bundle? The Windows Bundle includes all five Windows modules at the price of three. As soon as you'd pick a third module, we switch you to the Bundle automatically — same price, but you get all five. #### Is There a Minimum Commitment? Yes. The minimum annual contract value is 1,500 EUR regardless of the number of endpoints or modules selected. #### How Are Volume Discounts Applied? Discounts are tier-based and applied to the total unit price after reaching the threshold. Discounts are calculated independently for Windows and Mobile — they don't combine. #### What Currency Do You Invoice In? CapaOne is priced in EUR. Invoicing may be arranged in DKK or USD — contact us for details. #### Do You Offer Free Endpoints or a Trial? We offer a free proof-of-concept environment. Contact our team to get started — no credit card needed. ### Ready to consolidate your endpoint stack? Talk to a CapaOne specialist — we'll scope a configuration that fits your environment. Book a Demo Explore products # Products --- URL: https://capaone.com/products/application-manager/ Summary: CapaOne Application Manager automates third-party patching, no-code packaging and staged deployments — standalone or with Microsoft Intune. Works standalone Perfect with Intune ## Application Manager Application Manager automates third-party application patching across a curated enterprise catalog, handles no-code packaging for business applications, and delivers staged deployments that target existing Entra ID groups. Use it standalone. Or run it with your existing Microsoft setup. Book a Demo Start Free Trial Application Manager 98% fleet up to date 0 scripts needed Google Chrome → 126.0 · silent · all rings Adobe Reader patched · 0 reboots 7-Zip 24.0 scheduled · deploys 02:00 Zoom packaged no-code · deployed Trusted by IT teams across the Nordics NIRAS Global engineering consultancy Lattec Agricultural technology Holbæk Kommune Municipal government Vordingborg Køkkenet Retail & manufacturing Ishøj Kommune Municipal government Folketidende Gruppen Media & communications ISC Consulting engineers Dignity Financial services What You Can Do ### Your single place to keep software current at scale Automate third-party updates, package business applications with no code, and orchestrate safe staged deployments — all from one platform, standalone — or with Intune. - Automate third-party patching across a curated catalog with staged deployment - Detect missing or outdated apps automatically with an endpoint agent — no manual checks needed - Package and deploy business applications using no-code recipes - Gain real-time visibility with interactive dashboards showing update posture, version status, and endpoint health - Prove compliance with exportable audit evidence at a glance - Target Entra ID groups and honor your existing group structure — standalone or with Intune See it in action ### Watch the Application Manager demo See Application Manager in action in about a minute — no signup, no install. Key Capabilities ### Built to do the heavy lifting #### Catalog & Auto-Updates Subscribe endpoints or groups to silent updates for common enterprise apps — browsers, runtimes, productivity tools, and utilities — from a curated, actively maintained catalog. #### No-Code Packaging Drag-and-drop installers with detection rules and prerequisite checks. Package any business application without writing a single script. #### Intelligent Workflows Schedule and automate deployments with conditions, ordering, and dependencies — predictable timing, zero manual effort. #### Prebuilt PowerBricks Essential actions ready to use — stop services, set registry values, copy files, create shortcuts. Add your own PowerShell for advanced scenarios. #### Pre & Post Actions Automate the steps around each install — close apps, clean up temp files, configure settings — before and after every deployment. #### Readiness Checks OS version, disk space, and battery checks confirm endpoints are ready before deployment starts — preventing failed or unstable installs. #### Edge Delivery Network Globally distributed content delivery accelerates software updates for remote and branch-office devices — minimizing latency and maximizing reliability. #### Auditing & Evidence Endpoint-level deployment trails, who/what/when dashboards, version-status posture metrics, and CSV exports for auditors. How It Fits with Intune ### Two ways to deploy — your choice Run Application Manager as a complete standalone platform, or with Intune. Either way, Application Manager handles the third-party packaging and patching that Intune does not cover. See It Live #### Standalone Application Manager runs as a complete platform on its own — no Intune required. Automate third-party patching, package business applications with no code, and target Entra ID groups directly. - No Microsoft dependency - Full control over packaging and patching from day one - Curated catalog + no-code packaging in one platform #### With Intune Add the third-party packaging and patching Intune doesn't cover, without disruption. - Target Entra ID groups — keep your existing scoping and RBAC intact - Package once and distribute with your existing Intune workflows - No rip-and-replace — CapaOne runs with what you already have Security & Compliance ### Close the gap attackers target most Third-party applications are one of the most exploited attack vectors on managed endpoints. Application Manager closes that gap automatically. - Reduce the attack surface by closing third-party application vulnerabilities quickly and consistently. - Protect endpoints from ransomware and exploits by automating third-party patch management. - Automatically detect outdated or vulnerable software before it becomes a security risk. - Demonstrate control with standardized software baselines and audit-ready reporting. - Developed and supported in the EU — GDPR-first, with a NIS2-aligned posture and European digital sovereignty. Operational Benefits ### Outcomes your team will notice #### Fewer tickets Consistent versions mean fewer "works on my machine" escalations reaching the helpdesk. #### Lower TCO Automate packaging and eliminate duplicate tools — same outcome, less spend. #### Faster to value Deploy apps and updates in minutes, not hours. Same-day setup, no steep learning curve. #### Better employee experience Predictable, quiet updates on a schedule users can see — no unexpected interruptions. #### Non-specialist friendly Any admin can take control quickly — no scripting knowledge or external consultants needed. NIRAS · Global engineering consultancy “We manage 3,000 devices across 60 offices from one platform — without an army of admins.” Goals You Can Achieve ### What "done" looks like - 01 Close critical third-party application vulnerabilities within hours of release across the fleet. - 02 Maintain near-universal compliance on core applications week to week. - 03 Reduce manual packaging work dramatically through reusable, no-code steps. - 04 Cut app-related support volume with standardized versions across the estate. - 05 Empower non-specialist IT staff to handle packaging and updates without external consultants or scripting knowledge. Typical Rollout Pattern ### Live in five steps Most teams are fully deployed the same day they start. 01 #### Connect & Discover Install the lightweight agent, sync device inventory, and surface your current application landscape. 02 #### Define Standards Set the approved apps, versions, and baselines per department or site. 03 #### Test Stage Roll out to a pilot ring and confirm installs complete cleanly with real-time outcomes and guardrails. 04 #### Promote to Production Stage the rollout to the rest of the estate with throttling and deployment windows by location. 05 #### Report & Prove Export posture and compliance evidence on demand — scheduled or on-the-fly for auditors. Further reading ### Related resources - Patch Management and Outdated Software - The Intune Third-Party Patch Gap - Endpoint Patch Compliance and Audit Automation - NIS2 Audit Documentation One Platform ### Explore the rest of the lineup #### Privilege Manager Just-in-time elevation. Zero standing admin. #### Provision Manager Cloud-native OS deployment. No imaging. #### Mobile Manager Every mobile endpoint, one console. #### Experience Monitor See what your users actually experience. #### Security Monitor Continuous vulnerability and drift visibility. FAQ ### Questions, answered Have more? Talk to our team → **Which Applications Are Supported for Automatic Updates?** A broad, actively maintained enterprise catalog (browsers, runtimes, productivity, security, utilities). Business apps can be onboarded with no-code packaging. **Can I Control Rollout Speed and Target by Group or Site?** Yes — use test/production stages, Entra ID groups, and scheduled workflows, plus a globally distributed edge architecture for fast, reliable content delivery. **How Do You Detect Whether an Endpoint Needs an Install?** Automatic and flexible detection. Compliant endpoints are skipped; non-compliant endpoints are remediated. **What Happens if an Install Fails?** Automatic retries with backoff, detailed logs in dashboards, and the option to uninstall versions if needed. **Can I Package Apps Without Scripting?** Yes — use essential PowerBricks for common tasks. If needed, add your own PowerShell snippets for advanced scenarios. **How Does This Work with Intune Day-to-Day?** Run Application Manager with Intune: target Entra ID groups, reuse your existing group structure, and publish alongside your existing applications — while Intune continues to handle enrollment, security, and policy. **What Compliance Reporting Is Available?** Real-time posture by app/endpoint, and exportable CSV evidence for audits. **How Quickly Can We Start?** Typically same day: install the lightweight agent, sync inventory, set baselines, run a test, and then promote. ### Ready to get started? Consolidate your endpoint application operations with CapaOne — standalone or with Intune. Book a Demo Start Free Trial --- URL: https://capaone.com/products/experience-monitor/ Summary: CapaOne Experience Monitor scores the reliability of every Windows endpoint from its critical events, errors and warnings. Works standalone Perfect with Intune ## Experience Monitor Experience Monitor gives IT teams real-time visibility into the reliability of Windows endpoints — scoring every device from 1 to 10 based on the critical events, errors, and warnings in its system and application logs, so problems surface before they become support tickets. See where problems cluster and when they started, drill into the events behind them, and confirm that fixes worked. Run it standalone — or with Microsoft Intune. Book a Demo Start Free Trial Experience Monitor 1–10 Reliability Score 3 months reliability history Average score 8.9 · Good · all endpoints Critical events up · last hour · 14 endpoints 412 endpoints in Good range · latest hour Most Errors · LAPTOP-0412 · 37 events Trusted by IT teams across the Nordics NIRAS Global engineering consultancy Lattec Agricultural technology Holbæk Kommune Municipal government Vordingborg Køkkenet Retail & manufacturing Ishøj Kommune Municipal government Folketidende Gruppen Media & communications ISC Consulting engineers Dignity Financial services What You Can Do ### Fix problems before they reach the helpdesk Experience Monitor turns the Windows event logs on every endpoint into one reliability picture — so you can find the devices in trouble, see when problems started, and verify improvement without waiting for users to complain. - See the reliability of the whole fleet at a glance, from the average score to the latest hour - Spot the endpoints with the most critical events, errors, and warnings before their users call - Check the event timeline against recent app, driver, or OS changes to see when a problem began - Drill into any device's event log and filter by description, log type, source, or event ID - Check each device's battery status and capacity in the CapaOne hardware inventory — part of the platform, no extra product needed - Run it from the cloud with no on-prem servers to maintain — a lightweight agent on each endpoint collects the data See it in action ### Watch the Experience Monitor demo See Experience Monitor in action in about a minute — no signup, no install. Key Capabilities ### Every signal you need to stay ahead of issues #### Reliability Score Every Windows endpoint gets a score from 1 to 10, placed in one of four ranges — Good, Fair, Poor, or Unacceptable — so the devices that need attention stand out first. #### Critical, Error & Warning Events System and application events from the Windows logs, classified by severity — so you see what actually failed, not what users remember. #### Fleet View or Single Device Analyze reliability across the whole organization, then open one endpoint to see the same insights for that device alone. #### Average Score Over Time One chart shows the average Reliability Score and the spread from lowest to highest — with up to three months of history in the console. #### Event Timeline Critical events, errors, and warnings counted per interval — so you can see whether a problem began after a recent change or has been building for weeks. #### Most Affected Endpoints Most Criticals, Most Errors, and Most Warnings rank the endpoints with the highest event counts, so you know where to start. #### Searchable Event Log Filter the event log behind every score by description, log type, source, and event ID — and see which event sources generate the most events. Intune & Conditional Access ### Standalone, or with Intune — your choice Experience Monitor runs on its own. If you already run Intune, the two divide the work cleanly — Experience Monitor shows how reliably your Windows endpoints actually run, while Intune handles configuration and compliance baselines. The split is a choice, not a requirement. See the Integration #### Experience Monitor - Reliability Score for every Windows endpoint - Critical, error & warning event analysis - Event timeline & searchable event log - Up to three months of reliability history #### Microsoft Intune - Configuration & compliance baselines - App, driver & OS deployment workflows - Entra ID group targeting - Conditional Access policies Security & Compliance ### Observability is no longer optional NIS2, cyber insurance, and enterprise governance increasingly require documented evidence of endpoint health and change discipline. Experience Monitor keeps a running record of how stable your endpoints are. - Reduce operational risk by catching instability that can mask patching gaps. - Strengthen governance with one Reliability Score and one event classification across the fleet. - Keep up to three months of reliability history in the console to show how stability has moved. - Back up what you tell leadership, auditors, and cyber insurers with the score and the event record behind it. Operational Benefits ### Outcomes your team will notice #### Fewer tickets Fix recurring endpoint problems before they cascade into a wave of helpdesk calls. #### Faster MTTR Go from a low score to the exact events behind it — by severity, source, and event ID — in a few clicks. #### Higher uptime Find the least stable devices first and bring them back into the Good range. #### Happier employees Fewer crashes and fewer errors interrupting the workday. Goals You Can Achieve ### What "done" looks like - 01 Steady, measurable reduction in critical events and errors across the managed endpoint estate. - 02 A rising average Reliability Score, with more endpoints in the Good range and none left in Unacceptable. - 03 Faster root-cause analysis: from an unstable device to the event source behind it in minutes. - 04 Lower helpdesk ticket volume by addressing recurring endpoint issues proactively. - 05 A reliability record you can bring to leadership reviews and change advisory board meetings. Typical Rollout Pattern ### Live in five steps Most teams see their first reliability signals the same day they start. 01 #### Connect & Enroll Deploy the lightweight agent and start collecting reliability signals. Most environments see data the same day. 02 #### Review Baselines See where the fleet stands today: the average Reliability Score, how many endpoints sit in each range, and the events behind them. 03 #### Identify Patterns Use the event timeline and the Most Criticals, Errors, and Warnings lists to find the devices and event sources that keep coming back. 04 #### Target & Remediate Match issues against recent changes and route remediations to the affected devices — through your existing Entra ID groups or Intune workflows when you run them. 05 #### Track & Prove Watch the average score in the weeks after a fix to confirm improvement, and show leadership the trend on demand. Further reading ### Related resources - Reduce Tool Sprawl in Endpoint Management - NIS2 Requirements for Endpoint Management - Endpoint Management Consolidation One Platform ### Explore the rest of the lineup #### Application Manager Packaging and deployment, automated. #### Privilege Manager Just-in-time elevation. Zero standing admin. #### Provision Manager Cloud-native OS deployment. No imaging. #### Mobile Manager Every mobile endpoint, one console. #### Security Monitor Continuous vulnerability and drift visibility. FAQ ### Questions, answered Have more? Talk to our team → **What Data Does Experience Monitor Collect?** System and application events from the Windows event logs on each endpoint, classified as Critical, Error, or Warning. Experience Monitor turns them into a Reliability Score from 1 to 10 for every device. It covers Windows endpoints. **What Do the Reliability Score Ranges Mean?** A score of 8.5 or higher is Good, 7 up to 8.5 is Fair, 5 up to 7 is Poor, and below 5 is Unacceptable. A chart of the latest hour shows how many endpoints sit in each range, and selecting a range lists the devices in it. **Will This Impact Device Performance?** No. A lightweight agent reads the events each endpoint already writes to its Windows logs. **Does It Help After Big Changes Such as OS Updates?** Yes. The event timeline and the average-score chart show whether critical events and errors rose or fell after a change, so you can confirm an improvement or catch a regression early. **What Reporting Is Available for Leadership and CAB?** In the console: the average Reliability Score over time, the number of endpoints in each score range, the event timeline, and the endpoints with the most critical events, errors, and warnings. Up to three months of reliability history is visible. **How Quickly Can We Get Value?** Typically the same day: enroll endpoints and start monitoring. ### Ready to get started? Consolidate your endpoint operations with CapaOne — standalone — or with Intune. Request a Demo Start Free Trial --- URL: https://capaone.com/products/mobile-manager/ Summary: CapaOne Mobile Manager delivers centralized MDM for iOS, iPadOS and Android — zero-touch enrollment, DLP and OS updates, with or without Intune. Works standalone Perfect with Intune ## Mobile Manager Centralize how you enroll, configure, secure, and update mobile endpoints. Support corporate and BYOD programs with zero-touch onboarding, strong data protection, and full app lifecycle control. A complete mobile management platform — run it standalone — or with Microsoft Intune. Book a Demo Start Free Trial Mobile Manager iOS 94% Android 91% Compliance · all enrolled devices 847 enrolled · zero-touch active 3 devices pending OS update BYOD work profiles enforced Trusted by IT teams across the Nordics NIRAS Global engineering consultancy Lattec Agricultural technology Holbæk Kommune Municipal government Vordingborg Køkkenet Retail & manufacturing Ishøj Kommune Municipal government Folketidende Gruppen Media & communications ISC Consulting engineers Dignity Financial services iOS iPadOS · Android supported 0 physical device handling required BYOD privacy-safe BYOD work profiles EU-hosted · Danish-built · GDPR-first What You Can Do ### Mobile endpoints — under full control Mobile Manager centralizes how you enroll, configure, secure, and update mobile endpoints. Support corporate and BYOD programs with zero-touch onboarding, strong data protection, and app lifecycle control — running as your standalone mobile platform, or with your existing Microsoft setup. - Enroll at scale with Apple Device Enrollment Program, Android Enterprise, and Samsung Knox - Standardize configurations (Wi-Fi, VPN, certificates, restrictions) by group or device type - Distribute and update apps via Apple App Store, Google Play, and Managed Google Play - Protect data with DLP, per-app VPN, managed open-in, and copy/paste controls - Enforce compliance with automated app updates and policies - Respond fast with remote lock, selective wipe, and Lost Mode iOS & iPadOS - Apple Business Manager - Device Enrollment Program - Supervised & Unsupervised - App Store deployment Android - Android Enterprise - Samsung Knox - Zero-Touch Enrollment - Managed Google Play See it in action ### Watch the Mobile Manager demo See Mobile Manager in action in about a minute — no signup, no install. Key Capabilities ### Eight capabilities in one platform Everything you need to manage the full lifecycle of every mobile device — iOS, iPadOS, and Android. #### Multi-platform MDM Centralized device management for iOS, iPadOS, and Android across the entire organization — from a single console, over Legacy MDM or Apple Declarative Device Management (DDM). #### Zero-touch Enrollment Apple Device Enrollment Program, Android Enterprise Zero-Touch, and Samsung Knox — devices configure themselves on first boot, no IT hands required. #### Policy & Profile Engine Payloads for Wi-Fi, VPN, certificates (SCEP), restrictions, email, and web clips — applied automatically by group or device type. #### OS & Update Control Defer major OS releases, stage updates by groups, and enforce minimum versions — across Legacy MDM and DDM, so update control follows your fleet onto iOS 27. #### Compliance Signals Version inventory, encryption status, passcode posture, and applied policy overview — so you can prove compliance without a manual audit. #### DLP & Network Controls Managed open-in, copy/paste governance, per-app VPN, and screen-capture controls — corporate data stays inside managed contexts. #### Device Actions Remote lock, restart, selective wipe, full wipe, Lost Mode, OS update push, and password control — with a full audit log for every action. #### Inventory & Telemetry Hardware and software inventory, certificate health, app presence, and policy drift — continuous visibility across every enrolled device. Intune & Conditional Access ### Standalone, or with Intune — your choice Mobile Manager runs as a complete mobile management platform on its own. If you already run Intune, the two divide the work cleanly — Mobile Manager handles MDM, compliance posture, OS update control, and app lifecycle, while Intune stays in charge of identity and access. Update control runs over Legacy MDM or DDM, and through DDM on iOS 27. The split is a choice, not a requirement. See the Integration Mobile Manager - Multi-platform MDM (iOS, iPadOS, Android) - Zero-touch enrollment at scale - OS update control over Legacy MDM & DDM - DLP, per-app VPN & device actions + Microsoft Intune - Azure AD identity & access - Conditional Access policies - MFA & sign-in risk - M365 app policies Security & Compliance ### Governance that moves as fast as the threat From rapid patching to immutable audit logs — Mobile Manager keeps your mobile fleet defensible and demonstrably compliant. - Reduce mobile risk with rapid OS and app updates across the full fleet - Strengthen governance via standardized configurations and immutable action logs - Demonstrate compliance with audit-ready exports aligned to NIS2 requirements - Support EU sovereignty and data-minimization practices for regulated environments Outcomes ### Goals you achieve on day one 01 #### Day-one productivity New hires get a fully configured device before they sit down — zero-touch provisioning, automatic app sets, and baseline configurations applied on first boot. 02 #### Consistent mobile compliance Standardized policies across every business unit — iOS and Android — with compliance signals visible in a single dashboard. 03 #### Rapid vulnerability closure Coordinated OS and app rollouts close critical mobile vulnerabilities across the fleet within hours — not weeks. 04 #### Lower support demand Standardized configurations and selective self-service reduce helpdesk tickets. Fewer calls, faster resolution, happier employees. Victor Bjørke · IT Systems Administrator, Ishøj Municipality “Today, CapaOne is an essential part of our IT preparedness. It ensures that our devices are always updated and ready for use. We've left much manual work behind. Everything operates automatically — especially Mobile Manager, which has made a huge difference for us. CapaOne takes care of updates without us lifting a finger. Especially with frequent browser updates, we wouldn't have been able to keep up without automation.” Typical Rollout Pattern ### From decision to production in five steps Most organizations complete a pilot and validate zero-touch enrollment the same day they connect their Apple and Google accounts. 01 #### Connect & Map Integrate Apple Business Manager, Google Play, and Samsung Knox. Map your device sources and ownership models (COBO, COPE, BYOD). 02 #### Define Baselines Set policies, app sets, and DLP settings separately for corporate-owned and BYOD endpoints. Everything applied automatically at enrollment. 03 #### Scale Enrollment Roll out zero-touch enrollment. Validate with a pilot group, then open to full fleet — phased OS and app updates keep disruption minimal. 04 #### Promote to Production Apply update windows and location-based throttling. Dashboards confirm rollout progress and flag any out-of-compliance devices. 05 #### Operationalize Monitor compliance posture continuously. Export audit evidence aligned to NIS2 on demand — no manual report assembly required. Further reading ### Related resources - BYOD Security and Compliance - The Sovereignty Gap Starts at Your Endpoints - Cyber Insurance Requirements 2026 - NIS2 Requirements for Endpoint Management One Platform ### Explore the rest of the lineup #### Application Manager Packaging and deployment, automated. #### Privilege Manager Just-in-time elevation. Zero standing admin. #### Provision Manager Cloud-native OS deployment. No imaging. #### Experience Monitor See what your users actually experience. #### Security Monitor Continuous vulnerability and drift visibility. FAQ ### Questions, answered Have more? Talk to our team → **Which Platforms and Ownership Models Are Supported?** iOS, iPadOS, and Android — including COBO, COPE, and BYOD — with policies tailored per model. **Do You Support Zero-Touch Enrollment?** Yes — Apple Device Enrollment Program, Android Enterprise Zero-Touch, and Samsung Knox. **How Are Apps Deployed and Updated?** Integrations with Apple Business Manager, Apple App Store, Google Play Store, and Managed Google Play enable mandatory installs and silent updates. **Can We Control OS Updates?** Yes — defer major releases, stage updates by group, and enforce minimum versions. Mobile Manager does this through Legacy MDM or DDM on iOS 26 and earlier, and through DDM on iOS 27, where devices move to the declarative model on their own. **Does Mobile Manager Support Apple Declarative Device Management?** Yes. Mobile Manager supports DDM on Apple devices running iOS 17 or later, Supervised and Unsupervised alike, though which declarations apply depends on the device’s iOS version as well as the declaration itself. The two protocols run side by side, so you migrate at your own pace — each device runs under one of them at a time, and the configurations Apple hasn’t deprecated keep working. On iOS 27, Mobile Manager manages devices through DDM. **What Data-Loss Prevention Options Exist?** Managed open-in, copy/paste governance, per-app VPN, and account-scoped profiles keep corporate data in managed contexts. **How Is BYOD Privacy Handled?** Use work profiles and managed contexts for corporate data; personal apps and data remain outside IT visibility. Selective wipe removes only corporate content. **How Does Mobile Manager Work with Intune and Conditional Access?** Mobile Manager tracks compliance posture and aligns device state with your access policies, while Intune handles identity and access decisions — a clean division of work when you run both. **What Device Actions Are Available for Incidents or Lost Devices?** Remote lock, selective wipe, full wipe, Lost Mode, OS update push, and password control — with audit logs for each action. **How Quickly Can We Onboard at Scale?** Typically the same day: connect Apple and Google, set baseline configurations, and enroll with zero-touch enrollment. ### Ready to get started? Centralize mobile management across iOS, iPadOS, and Android — standalone — or with Intune. Book a Demo Start Free Trial --- URL: https://capaone.com/products/privilege-manager/ Summary: Remove standing local admin rights and replace them with time-bound, policy-driven elevation. Every event logged and exportable for audits. Works standalone Perfect with Intune ## Privilege Manager Privilege Manager removes standing local admin rights and replaces them with time-bound, policy-driven elevation. Users get access only for the exact task they need, for a defined window — with every event logged and exportable for audits. Use it standalone. Or run it with your existing Microsoft setup. Book a Demo Start Free Trial Privilege Manager 0 standing admins 100% elevation logged Chrome installer elevated · 5 min · auto-revoked cmd.exe elevation blocked by policy VPN client elevated · 2 min · auto-revoked Printer driver elevated · 3 min · auto-revoked Trusted by IT teams across the Nordics NIRAS Global engineering consultancy Lattec Agricultural technology Holbæk Kommune Municipal government Vordingborg Køkkenet Retail & manufacturing Ishøj Kommune Municipal government Folketidende Gruppen Media & communications ISC Consulting engineers Dignity Financial services What You Can Do ### Least privilege — without stopping work Privilege Manager removes standing local admin rights and replaces them with time-bound, auditable elevation. Users request (or receive) privileges only when needed, for the exact task or application, and only for a defined window of time — so work keeps moving while risk stays low. - Eliminate permanent local admin privileges while keeping users productive - Grant just-in-time elevation to users, apps, scripts, or commands — on a timer - Pre-approve apps based on executable name or app path - Enforce guardrails with allow/deny rules and evidence capture - Audit everything with immutable logs and exportable reports for change boards and audits See it in action ### Watch the Privilege Manager demo See Privilege Manager in action in about a minute — no signup, no install. Key Capabilities ### Built to eliminate excess privilege #### Time-Bound Elevation Grant admin privileges for minutes, not days — auto-revoke on expiry with no manual cleanup needed. #### Scope-by-Design Elevate a specific executable, installer, command, or task — never the entire session. #### Session Elevation Quiet, in-context prompts with configurable notifications and minimal disruption to the user's workflow. #### Policy Engine Define who can elevate what, where, and under which constraints — per user, group, device, or application. #### Guardrails Fully customizable controls for high-risk tools and sensitive actions — allow/deny rules with evidence capture. #### Break-Glass Controls Tightly scoped emergency elevation for critical, time-sensitive situations — without handing out standing admin. #### Logs & Evidence Who/what/when, endpoint, binary details, time, duration, and outcome — all exportable to CSV for audits and change boards. #### User Experience Controls Pre-approve apps by name or path, configure self-service prompts, and keep users moving without IT bottlenecks. How It Fits with Intune ### Two ways to deploy — your choice Run Privilege Manager as a complete standalone platform, or with Intune. Either way, Privilege Manager handles the granular privilege controls Intune alone does not provide. See It Live #### Standalone Privilege Manager runs as a complete platform on its own — no Intune required. Remove standing local admin, define elevation policies, and target Entra ID groups directly. - No Microsoft dependency - Full privilege control from day one - Policy engine + break-glass controls in one platform #### With Intune Add the granular privilege controls Intune alone does not provide, without disruption. - Target Entra ID groups — respect your existing group structure and RBAC - Adds least-privilege enforcement on top of your enrollment, compliance, and configuration baselines — no rip-and-replace - Works alongside Defender and compliance signals to enforce elevation policies Security & Compliance ### Least privilege is the new baseline Local admin rights on every device is one of the biggest privilege misconfigurations in most Windows environments. Privilege Manager closes it — for good. - Reduce the attack surface: remove persistent admin rights and stop lateral movement via local admin. - Prove control: show auditors standardized elevation workflows, logs, and short-lived access patterns. - Support the principle of least privilege and separation of duties across IT and support functions. - Align with NIS2 and CIS practices: strong access governance, traceability, and rapid revocation. Operational Benefits ### Outcomes your team will notice #### Fewer tickets Users complete routine tasks with self-service, within policy — no helpdesk call needed. #### Faster fixes Support can grant scoped elevation quickly without handing out full admin credentials. #### Lower risk, less rework Strong guardrails reduce misconfiguration and malware exposure from excess privilege. #### Happier users No more waiting hours for simple installs — done safely in minutes, within policy. Holbæk Kommune · Municipal IT “Standing local admin was our biggest unresolved risk. CapaOne removed it fleet-wide in a single afternoon.” Goals You Can Achieve ### What "done" looks like - 01 Zero standing local admin privileges across all managed devices. - 02 Minutes-not-days elevation cycles with auto-approvals for known-good applications. - 03 Consistent, auditable elevation workflows that satisfy internal and external audits. - 04 Reduced malware and misconfiguration incidents tied to excess privilege. Typical Rollout Pattern ### Live in four steps Most teams remove standing local admin the same day they start. 01 #### Baseline & Remove Remove standing local admin from target groups and establish a clean privilege baseline across the fleet. 02 #### Define Policies Set elevation policies for standard tasks — approved installers, printers, VPN clients, developer tools. 03 #### Pilot & Tune Roll out with short durations and strict guardrails. Review logs, tweak policies, confirm user experience. 04 #### Operationalize Scale to departments with scheduled policy reviews, periodic access recertification, and exportable evidence. Further reading ### Related resources - Ransomware Preparedness - NTLM Zero-Day Endpoint Patch Status - NIS2 Requirements for Endpoint Management - NIS2 Audit Documentation One Platform ### Explore the rest of the lineup #### Application Manager Packaging and deployment, automated. #### Provision Manager Cloud-native OS deployment. No imaging. #### Mobile Manager Every mobile endpoint, one console. #### Experience Monitor See what your users actually experience. #### Security Monitor Continuous vulnerability and drift visibility. FAQ ### Questions, answered Have more? Talk to our team → **How Does Elevation Work in Practice?** Users trigger elevation for a specific executable. Policies decide whether to auto-approve or deny. Admin privileges apply only to that scope and auto-expire. **Can We Block Risky Tools by Default?** Yes. Create deny rules for shells or unsigned installers and require explicit policy exceptions for controlled use. **Do We Need to Keep Some Users as Local Admins?** Best practice is no standing admin. Use policies for routine tasks and break-glass elevation for rare exceptions. **What's Captured for Audits?** User, endpoint, binary details (executable name, app path), time, duration, and outcome — all exportable. **How Do We Prevent Elevation from Lasting Too Long?** Set a short duration with auto-revoke. **Does This Work with Intune and Entra ID Groups?** Yes. Target policies via Entra ID groups, respect existing group structure, and run with your Intune compliance and configuration. **What Happens Offline?** Policies can allow cached decisions for low-risk tasks with strict durations, and queue logs for sync when the endpoint is back online. **Can Support Staff Grant Elevation Without Sharing Admin Creds?** Yes. Supporters can authorize a scoped, time-bound elevation without exposing local admin accounts. **How Quickly Can We Roll This Out?** Typically within minutes — it's a very simple configuration, executed in a phased approach: remove standing local admin privileges, apply standard policies to test endpoints, then scale to departments with measured guardrails and reporting. ### Ready to get started? Consolidate your endpoint privilege operations with CapaOne — standalone or with Intune. Book a Demo Start Free Trial --- URL: https://capaone.com/products/provision-manager/ Summary: CapaOne Provision Manager delivers cloud-native bare-metal OS deployment, remote recovery and driver orchestration — standalone or with Intune. Works standalone Perfect with Intune ## Provision Manager A cloud-native platform for bare-metal OS deployment, device recovery, and automated driver orchestration — with no servers, no images to maintain, and no manual packaging. Works standalone. Or as the foundation your Autopilot and Intune strategy requires. Book a Demo Start Free Trial Provision Manager < 1h from bare metal to ready device 0 deployment servers needed 🖥 Bare metal No OS → ☁ Provision Manager OS + drivers → ✓ Ready < 1 hour Trusted by IT teams across the Nordics NIRAS Global engineering consultancy Lattec Agricultural technology Holbæk Kommune Municipal government Vordingborg Køkkenet Retail & manufacturing Ishøj Kommune Municipal government Folketidende Gruppen Media & communications ISC Consulting engineers Dignity Financial services What You Can Do ### From bare metal to ready device — over the cloud Provision Manager deploys a full OS to bare-metal devices over the cloud — no local server, no physical media, and one universal image across every hardware model. - Set up a new bare-metal device in under an hour — straight from the cloud, with no deployment server to run or maintain. - Roll out to any hardware model from one universal image — so there's no per-model image library to build or keep updated. - Match every device to its vendor-certified Dell, HP, Lenovo, or Microsoft driver pack automatically — skipping the hours of manual research and packaging. - Bring a failed or bricked device back to work the same day — recovered remotely from the cloud, with no shipping and no days of downtime. - Give Autopilot the working OS it needs to start — so the handoff to Intune just works, with the bare-metal gap already closed. - Log every deployment with OS version, driver state, timestamp, and device — ready to hand auditors on demand. Where It Steps In ### The gap Autopilot cannot close Autopilot needs a working OS. Intune manages devices already running Windows. Provision Manager covers everything before that. 🖥 #### Bare-metal device - New device without OS - Corrupted system - Malware recovery - Refurbished hardware Autopilot cannot start ☁ #### Provision Manager - Cloud OS deployment - Vendor-certified drivers - Secure baseline - Remote recovery Handles it all 🔷 #### Autopilot + Intune - Azure AD join - Configuration policies - App deployment - Ongoing management Takes over from here See it in action ### Watch the Provision Manager demo See Provision Manager in action in about a minute — no signup, no install. Key Capabilities ### Built to provision from the cloud A 100% cloud-native solution for bare-metal OS deployment, device recovery, and driver orchestration — no servers, no images to maintain. #### Cloud OS Deployment True bare-metal OS deployment over the cloud — no local server, no physical media, no image to maintain. #### Vendor-Certified Drivers Automatically identifies the hardware model and applies the correct Dell, HP, Lenovo, or Microsoft driver pack — official packages only. #### Remote Device Recovery Failed device in Frankfurt? IT triggers a cloud re-image. The user is back at work the same day — no shipping, no days of downtime. #### Zero-Infrastructure Model Retire your legacy deployment servers. No on-prem infrastructure to maintain, patch, or secure — 100% cloud. #### One Image, All Models A single universal image works across every device model. No per-model image maintenance, ever again. #### Autopilot Foundation Autopilot needs a working OS. Provision Manager provides it — closing the gap Autopilot cannot bridge on bare metal or bricked devices. #### Driver Lifecycle Management Automated driver orchestration across production devices — keeping manufacturer-approved driver versions current after deployment. #### Audit-Ready Logging Full logging of every deployment — OS version, driver state, timestamp, device — available for audit and change management at any time. MDT vs Cloud-Native ### What you leave behind Moving from MDT to Provision Manager isn't an upgrade — it's a different category entirely. Legacy (MDT / On-premise) Local deployment servers — constant maintenance Manual OS image per hardware model Hours researching and packaging drivers Failed devices physically returned to IT 3–5 days downtime for remote device failures Provision Manager (Cloud-native) No servers — 100% cloud, zero infrastructure One universal image for all device models Automatic vendor-certified driver matching Remote recovery triggered from the cloud — no shipping Device back in action within hours See the full MDT replacement breakdown → Remote Recovery ### Device fails in Frankfurt. Back online within hours. No shipping. No days of downtime. IT triggers a cloud re-image — the user is back at work the same day. Legacy 3–5 days downtime Ship device + full reinstall Provision Manager < 2 hours Cloud re-image, no shipping Device fails Frankfurt · Remote worker IT triggers cloud re-image Provision Manager · EU-hosted User back online Same day · No shipping Lars Olsen · Senior Desktop Manager, LEMAN “The flexibility is what stood out immediately. I reinstalled a machine from a remote office — no local server, no USB key, no company network. And knowing I can recover a completely bricked device from the cloud changes how I think about device failures entirely.” Security & Compliance ### A clean, verifiable foundation for every device Every endpoint starts from a known-good state — with official drivers and a clean OS image you can prove in an audit. - Reduce the attack surface by ensuring every endpoint runs the latest manufacturer-approved driver versions - Eliminate risks from unknown configurations by deploying a clean, standardized, updated OS image - Demonstrate compliance for audits and change management with full visibility into OS and driver states - Restore any Windows device to a known, trusted state after a malware attack — using secure cloud re-imaging Autopilot & Intune ### Two ways to deploy — your choice Use Provision Manager as a complete standalone platform, or as the bare-metal foundation your Microsoft stack requires. See It in Action #### Standalone Provision Manager and Application Manager deliver a fully managed endpoint — no Intune required. Deploy the OS, install certified drivers, and push applications from one cloud platform. - No Microsoft dependency - Full endpoint control from day one - Deploy OS + apps from one platform #### With Intune + Autopilot Provides the bare-metal OS foundation Autopilot requires. Add continuous driver management for improved fleet stability and security — standalone, or with Intune. - Bare-metal → Autopilot enrollment - Continuous driver lifecycle management - True zero-touch from boot to daily use Typical Rollout Pattern ### From decision to production in four steps Most teams configure their first template and run their first deployment the same day. 01 #### Configure Templates Set up OS settings, regional preferences, and driver policies directly in the platform. Most teams finish this on day one. 02 #### Connect Your Layer Integrate with Intune for a direct handoff — or run Provision Manager standalone without Intune. 03 #### Pilot on Selected Devices Validate the workflow on a limited number of endpoints before rolling out broadly. 04 #### Operationalize Use Provision Manager for all new deployments, remote onboarding, and cloud-based device recovery going forward. Further reading ### Related resources - Replacing the Microsoft Deployment Toolkit - Endpoint Provisioning with Provision Manager - Cloud-Native Endpoint Management - Endpoint Management Consolidation One Platform ### Explore the rest of the lineup #### Application Manager Packaging and deployment, automated. #### Privilege Manager Just-in-time elevation. Zero standing admin. #### Mobile Manager Every mobile endpoint, one console. #### Experience Monitor See what your users actually experience. #### Security Monitor Continuous vulnerability and drift visibility. FAQ ### Questions, answered Have more? Talk to our team → **What About Managing OS Images?** You don't need to. We provide the latest images directly in the platform, saving you the significant time and effort of building and maintaining them yourself. **How Does the Driver Matching Work?** The platform automatically identifies the hardware model and applies the correct, vendor-certified driver pack, eliminating manual driver management and guesswork. **Does This Require Microsoft Intune?** No. Provision Manager is a complete standalone platform. Combined with Application Manager, you can deploy an OS, install certified drivers, and push all applications without Intune. For organizations already running Intune, Provision Manager adds the bare-metal deployment layer Intune cannot provide. **Why Do I Need This with Autopilot and Intune?** Microsoft Autopilot configures devices that are already running. Provision Manager provides the essential bare-metal operating system foundation for new or broken devices. It also works with Intune, adding ongoing, automated driver management to improve fleet stability. **Does Provision Manager Replace Microsoft Deployment Toolkit (MDT)?** Yes. Provision Manager closes the gap MDT leaves behind — bare-metal OS deployment, device recovery, and driver orchestration — without the on-premise infrastructure that made MDT complex to maintain and ultimately hard to secure. **How Quickly Can We Be Up and Running?** It takes less than one hour to configure the first deployment template and boot the first endpoint from bare-metal. **How Secure Is the Platform?** Security is foundational. We ensure a secure baseline by using clean OS images and only provide official, vendor-certified driver packages to prevent tampering. The platform is built on a secure, modern cloud architecture hosted in Europe. ### Ready to get started? Consolidate your endpoint provisioning operations with CapaOne — standalone or with Intune and Autopilot. Book a Demo Start Free Trial --- URL: https://capaone.com/products/security-monitor/ Summary: See every endpoint vulnerability in real time, prioritize by risk, and remediate in one click — with audit evidence on demand, all EU-hosted. Works standalone Perfect with Intune ## Security Monitor Real-time visibility into endpoint vulnerabilities, risk-based prioritization, and push-button remediation — all in one EU-hosted platform. See what is exposed, act on it directly, and export the audit evidence your auditors require. A complete vulnerability management platform — run it standalone — or with Microsoft Intune. Book a Demo Start Free Trial Security Monitor 0 critical exposed 100% endpoints scanned Chrome · CVE-2026-7896 · critical · remediation queued 7-Zip updated · CVE resolved · auto-remediated Windows DNS client patched · CVE-2026-41096 Firmware driver patched · 4 endpoints Trusted by IT teams across the Nordics NIRAS Global engineering consultancy Lattec Agricultural technology Holbæk Kommune Municipal government Vordingborg Køkkenet Retail & manufacturing Ishøj Kommune Municipal government Folketidende Gruppen Media & communications ISC Consulting engineers Dignity Financial services What You Can Do ### See it. Prioritize it. Fix it. - See your risk posture in near-real time across apps, drivers, and configurations. - Prioritize by impact, not noise — focus on what is exploitable and critical. - Trigger fixes directly via integrated update actions and change workflows. - Prove compliance with exportable, audit-ready evidence and reports. See it in action ### Watch the Security Monitor demo See Security Monitor in action in about a minute — no signup, no install. Key Capabilities ### Built to do the heavy lifting #### Unified vulnerability inventory Endpoint-level CVEs with version context and scope across every managed device. #### Risk scoring & context CVSS scores, vendor advisories, and impact prioritization to cut through the noise. #### Prioritized remediation queues Smart lists ranked by severity, exploitability, and blast radius so teams fix what matters first. #### Remediation orchestration Trigger update actions directly from Security Monitor through integrated deployment workflows. #### Security dashboards Summaries highlighting your security posture in near-real time across apps, drivers, and configurations. #### Evidence & reporting CSV exports, change logs, and auditor-friendly summaries ready for NIS2 and cyber-insurance reviews. #### Signals & enrichment Ingest security signals and enrich findings with authoritative vendor feeds for accurate context. #### Policy-driven compliance Enforced security baselines with continuous compliance tracking. Intune & Conditional Access ### Standalone, or with Intune — your choice Security Monitor runs as a complete vulnerability management platform on its own. If you already run Intune, the two divide the work cleanly — Security Monitor surfaces vulnerability posture, risk prioritization, and drift across your endpoints, while Intune handles configuration and compliance baselines. The split is a choice, not a requirement. See the Integration #### Security Monitor - Endpoint vulnerability posture & CVE inventory - Risk-based prioritization by severity & exploitability - Remediation orchestration from one console - Audit-ready evidence & exportable reports #### Microsoft Intune - Configuration & compliance baselines - App, driver & OS deployment workflows - Entra ID group targeting - Conditional Access policies Security & Compliance ### Reduce exposure, prove control - Reduce exposure windows by quickly identifying and addressing exploitable vulnerabilities. - Strengthen governance via standardized remediation workflows. - Demonstrate control with audit-ready reports. Why teams choose it ### The outcomes that matter - Triage critical findings within hours, not days. - Prove compliance with exportable, audit-ready evidence. - Prioritize what matters — stop chasing low-impact alerts. - Maintain near-zero known-exploited exposure across core applications. Further reading ### Related resources - NTLM Zero-Day Endpoint Patch Status - Endpoint Patch Compliance and Audit Automation - NIS2 Requirements for Endpoint Management - Ransomware Preparedness One Platform ### Explore the rest of the lineup #### Application Manager Packaging and deployment, automated. #### Privilege Manager Just-in-time elevation. Zero standing admin. #### Provision Manager Cloud-native OS deployment. No imaging. #### Mobile Manager Every mobile endpoint, one console. #### Experience Monitor See what your users actually experience. FAQ ### Questions, answered Have more? Talk to our team → **Where Does the Vulnerability Data Come From, and How Often Is It Refreshed?** Security Monitor aggregates authoritative feeds (e.g., vendor advisories and NIST/NVD) and refreshes regularly to keep risk context current. **Does It Detect Vulnerabilities in Third-Party Apps and Drivers?** Yes — posture spans common enterprise applications and relevant driver components, with version context at the endpoint level. **How Are Issues Prioritized?** By severity, exploitability, and blast radius (affected endpoint count), producing ranked remediation queues. **How Do We Remediate from Here?** Trigger update actions directly from Security Monitor through integrated deployment workflows. **How Does This Work with Intune?** Security Monitor surfaces vulnerability posture and drift across your endpoints on its own. If you run Intune, the two divide the work — Security Monitor handles vulnerability visibility and remediation, while Intune handles configuration and compliance baselines. Dashboards highlight any areas that need action. **Can We Cover Line-of-Business Software?** Yes — all software is automatically scanned, so both business apps and catalog titles can be tracked. **What Reports Are Available for Audits and Leadership?** Posture snapshots and change evidence — exportable to CSV and schedulable. **What Happens with Offline or Rarely Connected Devices?** Findings are retained; remediation tasks queue and resume on reconnect. ### See Security Monitor on your own estate Book a demo — standalone — or with Intune. Book a Demo Watch the product tour # Solutions --- URL: https://capaone.com/solutions/ Summary: CapaOne by use case and by role — find the path that fits how your team works. Solutions ## Find the path that fits your team Whether you start from a problem to solve or a role to support, CapaOne meets you there. By Use Case ### Solve a specific problem #### Vulnerability Management Find, prioritize and close vulnerabilities across your fleet before they are exploited — and prove it when auditors or insurers ask. Explore → #### Asset Management A live, accurate inventory of every device and the software running on it — the foundation every other decision depends on. Explore → #### Endpoint Privilege Management Enforce least privilege across the fleet with just-in-time elevation and zero standing admin rights — without slowing users down. Explore → #### Mobile Device Management Manage iOS, iPadOS, Android and Windows from one console — company-owned and personal devices alike. Explore → #### Unified Endpoint Automation Automate the full endpoint lifecycle — provisioning, applications, patching, privileges and monitoring — from a single platform. Explore → #### Reporting and Monitoring Real-time visibility into endpoint health, compliance and performance — and the reports to share it with leadership. Explore → #### Endpoint Application Management Deploy, update and retire applications across the fleet automatically — and keep third-party software patched. Explore → #### Endpoint Provisioning Take a device from bare metal to ready-to-work straight from the cloud — no on-prem imaging to maintain. Explore → #### MDT Replacement Retire the Microsoft Deployment Toolkit and its task-sequence servers for a cloud-native provisioning workflow. Explore → By Role ### Built for your seat #### For IT Administrators Less scripting, more automation. Get patches deployed and drivers updated without writing scripts or juggling five tools. Explore → #### For IT Managers Visibility and fewer vendors. Consolidate your toolstack and show leadership what is actually happening across endpoints. Explore → #### For IT Support Teams Resolve faster, escalate less. With one console you can see what is broken and fix it — before the user even notices. Explore → #### For IT Executives ROI, compliance, sovereignty. You need EU data sovereignty, NIS2 alignment, and a platform that grows with you — not against you. Explore → By Platform ### Fit CapaOne to your stack #### Why CapaOne + Intune Keep your Microsoft investment and add the capabilities Intune cannot cover. The most popular way our customers run CapaOne. Explore → #### Intune Patch Management Close the third-party patch gap Intune leaves behind — without replacing your Microsoft investment. Explore → #### Windows Endpoint Management Provision, secure and maintain Windows endpoints end to end — from one platform. Explore → #### Security & Compliance Built-in controls and on-demand evidence for the requirements that matter — NIS2, GDPR and cyber-insurance audits. Explore → #### European Sovereignty Danish-built and EU-hosted endpoint management — your data stays in Europe, under European rules. Explore → #### Endpoint Management for Mid-Market Organizations One platform for lean IT teams running 200 to 1,000 endpoints — patching, provisioning, privilege and monitoring in one console. Explore → ### Ready to see it? Book a Demo — with or without Intune. Book a Demo Watch the product tour --- URL: https://capaone.com/solutions/asset-management/ Summary: CapaOne asset management: a real-time, unified view of every endpoint — hardware, OS, apps, drivers, and posture. Turn inventory into action. ← All solutions Asset Management ## Know your estate. Fix what's off. CapaOne gives IT teams a real-time, unified view of every endpoint — hardware, operating system, applications, drivers, and configuration posture. Turn inventory into insight you can act on directly. Works standalone — or with Microsoft Intune. Book a Demo Start Free Trial The Basics ### What Is Endpoint Asset Management? Endpoint asset management is the discipline of keeping an accurate, current record of every device an organization runs — its hardware, installed software, drivers, and configuration — and acting on what that record reveals. It answers two questions at once: what do we have, and what is wrong with it? Most IT teams can produce an inventory. Fewer can trust one. Records drift the moment someone rebuilds a device, installs software outside the catalog, or retires hardware without telling anyone. CapaOne builds the record from the endpoints themselves and connects it to the actions that fix what it finds, so the inventory becomes an operational tool rather than a spreadsheet someone assembles the week before an audit. We looked at what a live application inventory actually shows you. Why It's Hard ### The gaps your current toolset leaves open Most IT teams piece together 4–6 tools. CapaOne collapses them into one. #### Fragmented Data Inventory scattered across multiple systems with no real-time reconciliation — making it impossible to trust what you see. #### Shadow & Stale Assets Offline endpoints, duplicates, and unclear assignments compromise audits and security posture across the fleet. #### Lifecycle Drift Inconsistent management of application catalogs, drivers, and configurations across the fleet leads to unpredictable results. #### TCO Blind Spots Difficulty quantifying software usage and identifying unused applications means multiple tools increase spending without clarity. #### Limited Health Visibility Teams cannot reliably link reliability issues to specific assets and users — so root cause analysis takes far too long. #### Compliance Pressure Proving software licensing rights and meeting GDPR/NIS2 data-handling requirements is tedious without a unified record. How It Works ### A clear path from problem to result 01 Inventory #### Discover & Normalize Real-time visibility across hardware, drivers, OS, and applications, with clean, normalized data ready for audits and reporting. 02 Catalog #### Govern & Standardize Application catalog governance with metadata and version management across the entire fleet — no spreadsheets required. 03 Automation #### Automate Lifecycle Deploy applications, and automate driver and application updates with safe scheduling and prerequisite checks built in. 04 Reporting #### Monitor & Optimize Reliability signals detect issues proactively; exportable CSV evidence supports audits, governance, and executive reporting. 150K+ endpoints managed in the Nordics 30+ years of endpoint expertise < 30 min average time to first value EU Danish-built · EU-hosted · GDPR-first Business Impact ### Outcomes your team can measure #### Reduced TCO Consolidating tools and automating routine inventory tasks lowers licensing costs and operational overhead. #### Higher asset accuracy A live, self-updating inventory means no more manual audits or spreadsheet reconciliation. #### Improved device reliability Proactive health signals catch issues before they generate support tickets. #### Stronger endpoint resilience Predictable, automated update flows keep every device on a known-good baseline. #### Faster audits Export clean, structured inventory data on demand — no scrambling when auditors ask. The Platform ### Products that power this solution #### Application Manager Automates third-party patching and application deployment — keeping every app in your catalog current. Explore Application Manager #### Provision Manager Cloud-native OS deployment with built-in driver orchestration for a consistent, repeatable baseline. Explore Provision Manager #### Experience Monitor Real-time reliability and performance analytics across all managed endpoints. Explore Experience Monitor #### Security Monitor Configuration drift and vulnerability insights to close security gaps across your estate. Explore Security Monitor FAQ ### Questions we get asked Anything else? Talk to our team → **Does CapaOne Replace Our CMDB or SAM Tool?** Not necessarily. CapaOne gives you an up-to-date view of endpoint hardware, operating system, driver, and application data, with CSV export options so the data feeds your existing CMDB or SAM processes. It works standalone — or with Microsoft Intune. **How Accurate Is the Inventory Compared with Intune?** CapaOne shows detailed endpoint data based on its own agent signals — consistent, live inventory you can trust in day-to-day operations. **Can I Manage Business Applications End-to-End?** Yes. Application packaging, deployment, catalog governance, and version posture are all supported. **Does CapaOne Track Warranties or Leases?** CapaOne can surface warranty-related information when provided, but does not automate warranty or lease workflows. **How Does This Reduce TCO in Practice?** Consolidating disparate tools, fewer manual tasks (driver and application automation), faster audits, and clearer posture insights all contribute to lower TCO. **How Do You Get a Unified, Real-Time Inventory of All Endpoints?** You get a unified inventory by collecting hardware, operating system, driver, and application data from every endpoint into one normalized view, updated continuously rather than assembled from spreadsheets. CapaOne captures this through its own agent signals, reconciles it into clean records, and keeps it live — so IT sees exactly what it has, what each device is running, and where attention is needed. The data exports to CSV for audits, CMDB, and SAM processes. **How Does CapaOne's Inventory Work Alongside Intune?** CapaOne builds one normalized inventory from its own agent on every endpoint, covering hardware, operating system, drivers, and applications, and it identifies each machine by a hardware hash, so one machine is always one record. IT can see when each device last checked in and export the inventory as audit evidence. Intune keeps its own device records and cleanup rules for devices that stop checking in, and CapaOne runs alongside it or entirely without it. **How Does Asset Management Support Software Compliance and Audits?** Accurate asset data is the foundation of software compliance: you cannot prove software rights or demonstrate GDPR and NIS2-aligned handling of endpoint data without a reliable record of what is installed where. CapaOne maintains that record in real time and exports device-level evidence as CSV for audits and governance reviews. The platform is EU-hosted and Danish-built, supporting digital sovereignty requirements. Our guide to documenting endpoint posture for a NIS2 audit sets out what auditors ask to see. ### Ready to trust your inventory? See CapaOne's live asset view on your estate. Works standalone or with Microsoft Intune. Most teams are up and running in under 30 minutes. Book a Demo Start Free Trial --- URL: https://capaone.com/solutions/endpoint-application-management/ Summary: CapaOne automates endpoint application management — package, deploy, update and retire apps across the fleet, with third-party patching built in. ← All solutions Endpoint Application Management ## Package once. Deploy everywhere. Update automatically. CapaOne turns application delivery into a structured, automated workflow — covering third-party patching, no-code packaging for business applications, and staged deployments with prerequisite checks. Works standalone — or with Microsoft Intune. Book a Demo Start Free Trial The Basics ### What Is Endpoint Application Management? Endpoint application management covers the full life of an application on a device: packaging it once, delivering it to the right users, keeping it current as the vendor ships updates, and removing it cleanly when it reaches end of life. Packaging is where deployment projects slow down, and third-party updates are where exposure builds. CapaOne automates both. Application Manager packages and delivers applications, then keeps them current without a separate patching tool, so the platform that installs an application stays responsible for it afterward. CapaOne runs this alongside Microsoft Intune, or entirely without it. We set out the workflow in our guide to automating Windows and application patching. Why It's Hard ### The gaps your current toolset leaves open Most IT teams piece together 4–6 tools. CapaOne collapses them into one. #### Packaging Drag Repetitive application packaging for different teams and hardware configurations slows deployment cycles and consumes scarce IT time. #### Patching Paralysis Manual application updates across regions and device groups create security vulnerabilities and an ever-growing backlog of unpatched software. #### Application Chaos Business apps lack consistent versioning, metadata, and approval processes — making it impossible to know what is running where. #### Inconsistent Evidence Proving deployment history and software versions for audit compliance requires manual collection from multiple systems. #### Tool Sprawl Separate tools for packaging, deployment, and patching create operational friction and don't share context — multiplying costs. #### User Disruption Application installs that conflict with work hours cause failed installations, user frustration, and avoidable support tickets. How It Works ### A clear path from problem to result 01 Application Manager #### Catalog & Package Unified application catalog with metadata, version tracking, and prerequisite checks — turning installers into deployable packages in minutes. 02 Automation #### Deploy & Update Targeted deployment to the right devices and groups, with silent installs out of hours and automated third-party update flows running on policy. 03 Governance #### Govern & Secure Integration with Privilege Manager ensures apps deploy without admin rights; GDPR-first, NIS2-aligned operations with EU-hosted data. 04 Reporting #### Optimize Deployment analytics and version posture insights let you measure update coverage, demonstrate compliance, and reduce endpoint TCO over time. 150K+ endpoints managed in the Nordics 30+ years of endpoint expertise < 30 min average time to first value EU Danish-built · EU-hosted · GDPR-first Business Impact ### Outcomes your team can measure #### Faster deployments Fewer installation failures and no manual packaging steps means applications reach users faster — and stay current automatically. #### Reduced ransomware risk Eliminating update debt across third-party applications closes the most common vulnerability exploited in ransomware attacks. #### Vendor consolidation One platform for packaging, deployment, patching, and reporting replaces several point tools — cutting costs and complexity. #### Audit-ready evidence Deployment history and version posture data are always available for compliance audits — no manual collection required. #### Better user experience Silent installs outside work hours mean users never see a disruption — applications are just there when they need them. The Platform ### Products that power this solution #### Application Manager The core of automated application delivery — catalog governance, packaging, deployment, and patching in one place. Explore Application Manager #### Privilege Manager Enforces least-privilege so applications install without admin rights — no exceptions needed. Explore Privilege Manager #### Security Monitor Surfaces outdated software and vulnerability signals so you know exactly what needs patching first. Explore Security Monitor #### Experience Monitor Reliability analytics that help correlate application deployment quality with endpoint stability. Explore Experience Monitor FAQ ### Questions we get asked Anything else? Talk to our team → **How is CapaOne different from Intune's basic deployment?** CapaOne adds a governed third-party catalog with automated updates, simplified no-code packaging, and version posture tracking — filling the gaps Intune leaves behind. **Does it manage prerequisites?** Yes. Prerequisite checks are configurable during packaging and run automatically before deployment — preventing installation failures before they happen. **Are silent installs supported?** Yes. Applications deploy silently outside work hours by default — users see no prompts and experience no disruption during their working day. We go deeper into the packaging and testing work that eats the hours. **How does CapaOne handle third-party patching?** CapaOne maintains a catalog of pre-packaged third-party applications. Updates are deployed automatically on policy — no manual packaging required for the most common software. **Does CapaOne work with Privilege Manager for deployments?** Yes. Applications deploy without requiring local admin rights on the endpoint, reinforcing your least-privilege policy without creating exceptions. ### Ready to automate your application delivery? See CapaOne Application Manager on your estate — third-party patching, packaging, and deployment from one platform. Most teams see value on day one. Book a Demo Start Free Trial --- URL: https://capaone.com/solutions/endpoint-privilege-management/ Summary: CapaOne endpoint privilege management removes standing local admin rights and replaces them with policy-based, time-bound elevation. ← All solutions Endpoint Privilege Management ## Remove standing admin rights. Keep users productive. CapaOne removes standing local admin rights and replaces them with policy-based, time-bound elevation — keeping users productive without leaving endpoints exposed. Every elevation event is logged and exportable for audits. Works standalone — or with Microsoft Intune. Book a Demo Start Free Trial The Basics ### What is endpoint privilege management? Endpoint privilege management is the practice of removing permanent administrative rights from endpoints and granting elevation only for a defined task, scope, and duration. It sits between identity management, which decides who a user is, and endpoint management, which decides what runs on a device. The reason it matters is reach, not entry. Verizon's 2026 Data Breach Investigations Report records vulnerability exploitation as the most common initial access vector, ahead of credential abuse — attackers get in through unpatched software far more often than through anything a privilege policy governs. Privilege policy governs what happens next: whether an intruder inherits administrative rights or has to earn them. Standing local admin decides how far an intrusion travels, not whether it starts. Why It's Hard ### The gaps your current toolset leaves open Most IT teams piece together 4–6 tools. CapaOne collapses them into one. #### Universal Admin Access Standing local admin rights are hard to track and hard to defend at audit — and they hand attackers privilege escalation without effort. #### Tickets & Delays Simple installs and updates stall while users wait for IT — hurting productivity and the reputation of the IT team. #### Inconsistent Controls Scripts, GPO remnants, and manual exceptions create configuration drift and blind spots that are hard to audit. #### Audit Pressure Proving least-privilege, exception handling, and adherence to NIS2/GDPR is tedious without structured evidence. #### Tool Sprawl Separate privilege management tools don't align with Intune policies or update and patch automation workflows. #### Privilege Bottlenecks Applications requiring admin rights slow deployments and increase operational friction for IT and end users alike. How It Works ### A clear path from problem to result 01 Privilege Manager #### Define & Govern Central policies via Entra ID groups; elevation rules by executable name and path; enforce a least-privilege baseline across the fleet. 02 Elevation #### Elevate Safely Process-based elevation for approved applications; session-based elevation for broader permissions with a defined, time-limited duration. We set out how teams choose between them in the four decisions before you turn elevation on. 03 Application Manager #### Automate Routine Pre-approved applications deploy silently via Application Manager, minimizing interruptions alongside automated update flows. 04 Audit-ready #### Prove & Report Full elevation activity logs and exportable CSV evidence support audits, NIS2 requirements, and EU data sovereignty. 150K+ endpoints managed in the Nordics 30+ years of endpoint expertise < 30 min average time to first value EU Danish-built · EU-hosted · GDPR-first Business Impact ### Outcomes your team can measure #### Reduced ransomware risk Removing standing admin permissions limits how far an intrusion travels — attackers must earn each privilege instead of inheriting it. #### Fewer support tickets Policy-based elevation lets users install approved software themselves — without waiting for IT. #### Platform consolidation One tool handles privilege control, application deployment, and audit reporting — no extra vendors. #### Clear audit evidence Every elevation is logged and exportable — proving least-privilege compliance on demand. #### Faster deployments Pre-approved apps deploy silently without admin prompts, removing friction from routine IT operations. The Platform ### Products that power this solution #### Privilege Manager Enforces least-privilege with policy-based, time-bound elevation and zero standing local admin. Explore Privilege Manager #### Application Manager Automates application deployment and patching — removing the need for admin rights during installs. Explore Application Manager #### Security Monitor Surfaces configuration drift and vulnerability insights that strengthen your privilege control posture. Explore Security Monitor FAQ ### Questions we get asked Anything else? Talk to our team → **Will users still be able to work without persistent local admin?** Yes. Process-based elevation supports defined applications and tasks; session-based elevation is available for broader scope when needed — all without standing admin rights. **Does CapaOne replace Intune?** No. CapaOne works with Microsoft Intune, providing policy-based privilege control and visibility that Intune does not cover natively. **How do developers and power users get the access they need?** Fine-grained elevation rules by executable name and file path let you grant exactly what is needed; session-based elevation provides broader administrative permissions when justified. **How does CapaOne support audits?** Comprehensive logs and CSV exports demonstrate least-privilege enforcement — giving auditors the evidence they need for NIS2, GDPR, and cyber-insurance reviews. Our guide to what an elevation log should record for an audit covers the fields auditors actually ask for. **Can CapaOne automate application deployments alongside privilege control?** Yes. Application Manager handles pre-approved deployments silently, so users never need admin rights for routine installs or updates. **What Does Microsoft Intune Lack for Privilege Management?** Intune manages enrollment, policy, and configuration, but it does not provide just-in-time privilege elevation or a least-privilege baseline that removes standing local admin while keeping users productive. It does not grant process- or session-based elevation by rule, and it does not log elevation activity for audit. CapaOne adds this through Privilege Manager — policy-based elevation using your existing Entra ID groups, with full logging — with or without Intune. **How Do You Remove a Standing Local Admin Without Blocking Users?** You remove the standing local admin by replacing always-on permissions with elevation that is granted only when needed. CapaOne enforces a least-privilege baseline, then automatically allows process-based elevation for approved applications and tasks, and session-based elevation for a defined duration when broader rights are required. Pre-approved applications run through Application Manager without elevation at all, so routine installs and updates are completed without tickets or delays. **Does Removing Local Admin Rights Stop Ransomware?** No. Removing local admin rights does not stop ransomware, but it removes one step most intrusions depend on. Attackers usually get in through unpatched software or stolen credentials, then escalate privileges to move laterally, switch off endpoint defenses with a vulnerable driver, and reach data worth encrypting. An endpoint with no standing administrative rights forces that escalation to be earned rather than inherited. CapaOne Privilege Manager enforces a least-privilege baseline and grants process- or session-based elevation by policy, so every escalation is deliberate and logged. **How Does Just-in-Time Elevation Support NIS2 Access Control?** NIS2 expects organizations to limit administrative access to what each role needs and to document how access is granted. Just-in-time elevation supports this directly: standing local admin is removed, elevation is granted by policy for a defined scope and duration, and every escalation is logged. CapaOne exports this evidence as CSV for audits, and the platform is EU-hosted and Danish-built, supporting digital sovereignty requirements. ### Ready to eliminate standing admin rights? See how CapaOne enforces least-privilege across your fleet — without disrupting users or adding IT overhead. Book a Demo Start Free Trial --- URL: https://capaone.com/solutions/endpoint-provisioning/ Summary: CapaOne replaces on-premises imaging with 100% cloud-native Windows provisioning — from bare metal to ready-to-work in under an hour, no servers. ← All solutions Endpoint Provisioning ## From bare metal to ready in under an hour. CapaOne transforms endpoint provisioning by replacing traditional on-premise deployment with a simple, modern, 100% cloud-native workflow. No imaging servers, no deployment shares, no manual driver packs. Works standalone — or with Microsoft Intune. Book a Demo Start Free Trial The Basics ### What Is Endpoint Provisioning? Endpoint provisioning is the work of taking a device from bare metal to a usable workstation that meets policy: installing the operating system, matching the right drivers to the hardware, and handing someone a machine they can work on. CapaOne does that from the cloud, with no dedicated PXE server and no on-premises deployment server to maintain, and orchestrates drivers as part of the same workflow. That matters when a device arrives new, fails to boot, or needs a rebuild in a remote office. Microsoft Autopilot begins after an operating system already exists — something has to put it there first. We describe the full sequence in what Autopilot leaves open when the disk is blank. Why It's Hard ### The gaps your current toolset leaves open Most IT teams piece together 4–6 tools. CapaOne collapses them into one. #### Legacy Infrastructure Costs Maintaining on-premise deployment servers requires continuous patching and significant expense — a permanent overhead with growing security risk. #### Manual Task Overload Creating and maintaining device images while packaging drivers for various hardware models creates workflow bottlenecks that slow every deployment. #### Inconsistent & Insecure Devices Manual processes result in inconsistent builds, driver conflicts, and weakened security foundations that are hard to audit or standardize. #### Remote Employee Downtime Device failures force expensive return shipments and cause productivity losses lasting days — a growing problem for distributed or hybrid teams. #### Poor Onboarding Experience Delivering a secure, fully-configured device to a new employee on day one is a persistent challenge with on-premise imaging workflows. #### Legacy Limitations Older deployment tools struggle with new hardware adoption, OS upgrades, and fleet standardization — blocking progress without a clear path forward. How It Works ### A clear path from problem to result 01 Provision Manager #### Modernize & Automate Replace legacy deployment infrastructure with a cloud-native solution. Pre-built, maintained Windows images eliminate manual packaging — no imaging server required. 02 Zero-touch #### Enable Hybrid Work Zero-touch onboarding for new devices and cloud-based recovery for remote workers — failed devices resolved in hours, not days of shipping. 03 Provision Manager #### Deploy Securely Every device starts from a clean, standardized Windows baseline with manufacturer-certified drivers matched automatically to the hardware model. 04 Always Current #### Stay Agile Adapt to new hardware generations and execute OS upgrades using continuously updated image and driver libraries — without maintaining them yourself. 150K+ endpoints managed in the Nordics 30+ years of endpoint expertise < 30 min average time to first value EU Danish-built · EU-hosted · GDPR-first Business Impact ### Outcomes your team can measure #### Under 1 hour to ready device From bare metal to fully configured and ready to work — in under an hour, with no technician on site required. #### Zero deployment servers Eliminate the on-premise infrastructure, its maintenance burden, its security risk, and its associated costs. #### Fewer hardware-related tickets Certified driver installation eliminates the compatibility issues that generate support tickets after provisioning. #### Better onboarding experience New employees get a fully configured, secure device on day one — wherever they are located. #### Faster OS upgrades Move to new Windows versions across the fleet without rebuilding images or managing driver packs manually. The Platform ### Products that power this solution #### Provision Manager Cloud-native OS deployment with built-in driver orchestration — from bare metal to ready in under an hour. Explore Provision Manager #### Application Manager Automates application deployment post-provisioning — the natural next step in a cloud-native provisioning workflow. Explore Application Manager #### Security Monitor Verifies device posture post-deployment — confirming every provisioned endpoint starts from a secure baseline. Explore Security Monitor FAQ ### Questions we get asked Anything else? Talk to our team → **Why move endpoint provisioning to the cloud?** It eliminates on-premise server costs and security risks while supporting modern hybrid workforces — devices can be provisioned or recovered from anywhere, without VPN or site visits. **How does it fit with Microsoft Intune?** Provision Manager provides the bare-metal foundation that Autopilot requires — installing Windows cleanly before Autopilot takes over configuration and enrollment. **How does it handle hardware diversity?** Managed certified driver libraries with automated hardware matching eliminate the need for separate images per model — one workflow covers your entire hardware estate. Our guide to why drivers don't stay fixed after deployment covers how the matching works in practice. **Does Provision Manager replace MDT?** Yes. Provision Manager is designed specifically to close the gap MDT leaves behind — with a cloud-native workflow that works for both new deployments and cloud recovery. **Does it require Intune?** No. Provision Manager works standalone, or with Intune — and can be combined with Application Manager for a complete provisioning-to-management workflow. **How quickly can we deploy our first device?** Most organizations deploy their first device in under an hour from initial platform setup. There are no servers to configure and no images to build first. **How Do You Deploy Windows Devices Without On-Premises Infrastructure?** You deploy without on-premises infrastructure by provisioning from the cloud rather than maintaining servers, deployment shares, and image stores. CapaOne Provision Manager uses pre-built Windows OS images, vendor-certified driver packs, and lightweight peer-to-peer PXE boot to perform bare-metal deployment and recovery over an internet connection. Automated driver-to-hardware matching removes the need for separate images per model, and devices hand over to Microsoft Autopilot when used together. **What Does Microsoft Intune and Autopilot Lack for Provisioning?** Autopilot configures a device once it already has a working operating system, but it does not install the OS itself or recover a device that will not boot. Intune does not provision bare metal or orchestrate model-specific drivers. CapaOne Provision Manager adds the bare-metal foundation, cloud recovery, and automated driver orchestration — then hands over to Autopilot or runs entirely on its own. **How Do You Onboard Remote Employees with Zero-Touch Provisioning?** You onboard remote employees by shipping a device directly to them and provisioning it from the cloud, with no IT staging required. CapaOne delivers a standardized, secure OS image with certified drivers to the device over the internet, so a new hire receives a ready-to-work machine on day one. If a remote device fails, cloud-based recovery restores it in hours rather than days of shipping. ### Ready to retire your deployment servers? See how CapaOne Provision Manager provisions a Windows device from bare metal — in under an hour, from the cloud, without a single server. Book a Demo Start Free Trial --- URL: https://capaone.com/solutions/european-sovereignty/ Summary: CapaOne is endpoint management built in Denmark and EU-hosted — GDPR-first, NIS2-aligned, with no endpoint data sent to US jurisdiction. ← All solutions European Sovereignty ## European Endpoint Management — Without the US Exposure Built for data sovereignty, GDPR, and NIS2. As organizations move to reduce dependence on US technology, the endpoint layer is often overlooked. Patch status, device inventory, vulnerability data, and privilege events all flow through your endpoint platform — and if that platform is American, so is the jurisdiction over your data. CapaOne is built in Denmark, hosted in the EU, and designed to keep that data under European control. Works standalone — or with Microsoft Intune. Book a Demo Start Free Trial Why the endpoint layer matters ### Digital Sovereignty Starts Where Your Data Is Processed Digital sovereignty in endpoint management means your organization controls where endpoint data is processed and stored, and under which legal jurisdiction it falls. Endpoint platforms continuously handle sensitive operational data. Keeping it within the EU, under European law, is what turns sovereignty from a principle into an operational reality — and CapaOne is built and hosted entirely in Europe to make that the default, not a configuration. European IT leaders already act on this. In a Gartner survey of 241 CIOs and IT leaders in Western Europe, 61% said geopolitical factors will increase their reliance on local or regional cloud providers, and 53% said geopolitics will restrict their future use of global providers. Gartner also predicts that more than 75% of enterprises outside the US will have a digital sovereignty strategy by 2030. Those decisions cover cloud infrastructure — but endpoint management processes the same operational data under the same jurisdiction. Patch status Application inventory Driver versions Vulnerability exposure Privilege events The jurisdiction problem ### A US-Based Platform Carries US Jurisdiction — Wherever the Data Sits If your endpoint platform is operated by a US company, the data it processes may fall under the US Cloud Act and FISA — regardless of where it is physically stored. EU data residency does not remove US legal reach when the operator is American. This is exposure that GDPR alone does not resolve. We set out what that means for the endpoint layer in why endpoints are the blind spot in most sovereignty strategies. US-operated platform CapaOne — EU-built, EU-hosted Data may fall under the US Cloud Act and FISA Endpoint data stays in the EU, with no transfer to US jurisdiction EU data residency does not remove US legal reach EU-hosted, with endpoint data processed under European law Jurisdictional exposure remains, even with GDPR US data-transfer exposure addressed by design How to evaluate ### What to Look for in a European Endpoint Management Platform Choosing a European endpoint platform is not only about where servers are located. Use the following criteria to evaluate whether a platform delivers genuine sovereignty. #### EU hosting & residency Data processing within Europe, with documented residency you can show an auditor. #### No US data transfer Endpoint data stays in the EU, with no transfer to US jurisdiction — not just EU-located servers. #### Transparency & DPA Full sub-processor transparency and a documented Data Processing Agreement. #### Retention & data rights Configurable retention and deletion, plus support for data-subject rights. #### NIS2-aligned operations Audit-ready posture data and exportable evidence built into daily operations. #### Standalone capability Functions on its own, not dependent on a US-operated platform to work. The CapaOne foundation ### European Sovereignty, Built In — Not Bolted On Built in Denmark Hosted in the EU GDPR-first & NIS2-aligned CapaOne meets these criteria by design: GDPR-first architecture with privacy by design, encryption in transit and at rest, a documented DPA, and least-privilege access through Entra ID. It supports NIS2-aligned operations through automated application and driver updates, vulnerability visibility, privilege control, and exportable audit evidence — all on EU-hosted infrastructure. Works with your stack ### Keep Intune. Remove the Exposure. Run CapaOne as your complete endpoint platform — or with Microsoft Intune. For Intune users, CapaOne operationalizes compliance — application updates, driver updates, vulnerability visibility, privilege control, and exportable audit evidence — all from EU-hosted infrastructure. You keep your Microsoft identity model and policy core, and address the US jurisdictional exposure that the endpoint layer would otherwise introduce. CapaOne (EU-hosted) - Third-party app & driver updates - Privilege control (PAM) - Vulnerability visibility - Exportable audit evidence Microsoft Intune - Policy & enrollment core - Entra ID identity - Conditional Access - M365 app policies Procurement & risk ### Everything Your Procurement Team Will Ask For — Already Documented CapaOne is built to answer the questions European legal and procurement teams raise when evaluating endpoint platforms. Every item on the checklist is covered and documentable. Request Documentation → - ✓ EU hosting locations & residency documentation - ✓ Data Processing Agreement (DPA) + sub-processor register - ✓ SSO/MFA, group-based access controls, log retention & export - ✓ Vulnerability, application, and driver posture reports - ✓ Business continuity & incident-related data flows - ✓ Exportable audit evidence for compliance reviews FAQ ### European Sovereignty, Answered Have more? Talk to our team → **What Are the European Alternatives to US-Based Endpoint Management Platforms?** European alternatives are endpoint management platforms built and operated within the EU, so the operational data they process remains under European jurisdiction rather than the US Cloud Act or FISA. When evaluating them, look for EU hosting and documented data residency, no transfer of endpoint data to US jurisdiction, full sub-processor transparency, a documented DPA, NIS2-aligned operations with exportable evidence, and the ability to run standalone. CapaOne is built in Denmark and hosted in the EU, and meets these criteria as a complete platform — on its own or with Microsoft Intune. We take the wider view in seven platforms compared on what matters to European IT teams. **How Do You Ensure Data Sovereignty in Endpoint Management?** You ensure data sovereignty by controlling where endpoint data is processed and stored, and under which jurisdiction it falls — not only where servers are located, but also who operates the platform and which laws govern the data. In practice, that means choosing an EU-built, EU-hosted platform with documented residency, transparent sub-processors, and configurable retention and deletion. CapaOne is EU-hosted, with no transfer of endpoint data to US jurisdiction, and provides exportable audit evidence to demonstrate it. **What Is the Risk of Using a US-Based Endpoint Management Platform in Europe?** Endpoint management platforms process sensitive operational telemetry — patch status, application inventory, driver versions, vulnerability exposure, and privilege elevation events. If that platform is operated by a US company, that data may be subject to the US Cloud Act and FISA, regardless of where it is physically stored. This creates jurisdictional exposure that GDPR alone does not resolve. A European-built, EU-hosted platform addresses this exposure by keeping endpoint data within the EU and under European law. **Does CapaOne Support GDPR Compliance?** Yes. CapaOne supports GDPR compliance through a GDPR-first architecture: privacy by design and default, encryption in transit and at rest, a documented Data Processing Agreement, least-privilege access controls, and support for data subject rights, including access, rectification, deletion, and export. GDPR alignment is architectural — not a configuration added after the fact. **Does CapaOne Support NIS2 Compliance?** Yes. CapaOne supports NIS2-aligned operations across several dimensions: automated application and driver updates to reduce vulnerability exposure; least-privilege enforcement via policy-based privilege elevation; real-time visibility into endpoint vulnerabilities and configuration drift; and exportable audit evidence for posture reporting and incident investigation. NIS2 alignment is built into the platform's daily operational workflows. **Can CapaOne Run With Microsoft Intune?** Yes — with or without it. CapaOne runs as a complete endpoint platform on its own, and for Intune users, it adds capabilities Intune does not natively cover: automated third-party application updates, vendor-certified driver management, just-in-time privilege elevation, vulnerability visibility, and exportable compliance evidence. All of it runs on EU-hosted infrastructure, so CapaOne strengthens your Intune environment without introducing US jurisdictional exposure through the endpoint layer. **Does CapaOne Provide a Data Processing Agreement (DPA)?** Yes. CapaOne provides a documented Data Processing Agreement covering lawful-basis mapping, sub-processor transparency, data retention and deletion controls, and support for data subject rights. The DPA is designed for straightforward regulatory conversations and audit preparation. Further reading ### Related resources - The Sovereignty Gap Starts at Your Endpoints - NIS2 Requirements for Endpoint Management Ready to get started? ### Keep Your Endpoint Data Under European Control See how CapaOne delivers endpoint management built in Denmark and hosted in the EU — standalone — or with Microsoft Intune. Request a Demo Start Free Trial --- URL: https://capaone.com/solutions/for-it-administrators/ Summary: CapaOne gives IT administrators one platform for app and driver updates, privilege, CVE insight and deployment — with or without Intune. ← All solutions Solutions · For IT Administrators ## Built for IT Administrators. Less scripting. More control. Managing endpoints through a patchwork of tools creates unnecessary complexity. CapaOne consolidates application updates, driver updates, privilege elevation, vulnerability insights, and deployment into a single cloud-based platform — one that works with Microsoft Intune, or entirely without it. Book a Demo Start Free Trial The Daily Reality ### The friction that eats your day Tool sprawl creates operational friction. Here's what most administrators wrestle with. #### Privilege Headaches Managing privilege elevation securely — without handing out standing local admin rights — is hard to do consistently across the fleet. #### Stale Drivers & Apps Keeping drivers and third-party applications current across every endpoint is a never-ending, manual chore that scripts only partly solve. #### No Early Warning You lack visibility into endpoint reliability before issues escalate into tickets — so you find out when the user does. #### Mobile Sprawl Managing device posture across iOS, Android, and Windows from separate consoles multiplies the work and the blind spots. #### Deployment Gaps Deploying custom business applications alongside Intune means stitching together tools and scripts that break with every change. #### Tool Switching Every context switch between consoles is lost time — and one more place a setting can drift out of alignment. What You Get ### One console for the work that fills your week 01 Privilege Manager #### Control Privileges Policy-based elevation removes standing admin rights while keeping users productive — no more handing out local admin to get work done. 02 Application Manager #### Automate Updates Vendor-supported driver packages and third-party application updates flow out automatically — with or without Microsoft Intune. 03 Experience Monitor #### See Problems Early Endpoint reliability signals surface instability before it reaches the helpdesk — so you fix root cause, not symptoms. 04 Unified #### Manage Everything Mobile device management, custom application deployment, and vulnerability insights — all from the same cloud platform. 150K+ endpoints managed in the Nordics 30+ years of endpoint expertise < 30 min average time to first value EU Danish-built · EU-hosted · GDPR-first Business Impact ### Outcomes your team can measure #### Less manual scripting Automation replaces the repetitive scripts and manual steps that consume your week — freeing time for work that matters. #### Faster onboarding An intuitive, unified console means new team members get productive quickly, without learning five separate tools. #### Better security visibility Privilege control, vulnerability insights, and compliance posture are visible in one place — no more guesswork. #### Reclaimed time With routine work automated, you get back the hours to focus on strategic projects instead of firefighting. #### European data sovereignty Danish-built and EU-hosted, with local support that actually understands your environment. In Their Words ### Trusted by IT teams across the Nordics Managing IT for 60 team members alone could have been a major challenge — but not anymore. With CapaOne, everything runs seamlessly. Thomas Fest IT System Administrator, Lattec The Reliability dashboard provides a quick and clear starting point for troubleshooting, allowing us to focus where it matters. Nicklas P. Sørensen IT Specialist, Holbæk Municipality FAQ ### Questions we get asked Anything else? Talk to our team → **Does CapaOne replace Microsoft Intune?** No. CapaOne works standalone, or with Intune — adding privilege management, third-party patching, driver updates, and reliability insights that Intune does not cover natively. **Do I still need to write deployment scripts?** Far less. CapaOne automates packaging, deployment, and updates through policy — replacing most of the scripting that administrators rely on today. **Can users still install software without admin rights?** Yes. Policy-based elevation lets approved applications install without standing local admin — so users stay productive and you stay in control. **How quickly can I get started?** CapaOne is cloud-native with no on-premise servers to stand up. Most administrators are managing real endpoints within their first couple of days. Further reading ### Related resources - A New Chapter in Endpoint Management - 5 Steps to Strengthen Driver Compliance ### Ready to simplify your day? See how CapaOne consolidates your endpoint tools into one platform, with or without Intune — less scripting, more control. Most admins are up and running in under 30 minutes. Book a Demo Start Free Trial --- URL: https://capaone.com/solutions/for-it-executives/ Summary: CapaOne gives CIOs endpoint resilience, compliance and cost efficiency — a strategic platform with EU sovereignty, standalone or with Intune. ← All solutions Solutions · For IT Executives ## Built for IT Executives. Resilience, compliance, control. CapaOne is the strategic endpoint management platform that works standalone, or with Microsoft Intune — built for CIOs and IT leaders who want visibility, control, and data sovereignty over every device. Drive endpoint resilience, strengthen compliance, and reduce cost across the enterprise. Book a Demo Start Free Trial The Executive View ### The risks that reach your desk At the leadership level, endpoint management is about risk, cost, and sovereignty — not consoles. #### Vendor Sprawl A patchwork of point tools creates complexity, integration cost, and governance gaps that are hard to oversee at the board level. #### Audit & Compliance NIS2 and GDPR demand demonstrable endpoint controls and evidence — exposure that lands squarely on IT leadership. #### Ransomware Risk Unpatched endpoints open the way in, and standing admin rights decide how far an intrusion travels once inside. #### Operational Cost High costs and complexity in endpoint management inflate TCO without delivering proportional resilience or value. #### Data Sovereignty Reliance on US-hosted platforms conflicts with European data residency requirements and growing sovereignty expectations. #### Proving Outcomes Translating endpoint operations into governance outcomes and operational impact the business understands is a persistent challenge. The Strategic Case ### From operational burden to governed advantage 01 Consolidation #### Simplify Consolidate multiple point solutions into one platform — bringing vendor and tool governance under a single, accountable layer. 02 Sovereignty #### Strengthen Strengthen endpoint governance and data sovereignty with an EU-hosted platform — keeping control of your data within Europe. 03 Compliance #### Support & Accelerate NIS2-aligned, GDPR-first compliance, faster updates, and reduced mean-time-to-resolution improve both posture and service. 04 Governance #### Demonstrate Improve service reliability and audit readiness, and demonstrate governance outcomes and operational impact to the business. 150K+ endpoints managed in the Nordics 30+ years of endpoint expertise < 30 min average time to first value EU Danish-built · EU-hosted · GDPR-first Business Impact ### Outcomes your team can measure #### Reduced total cost of ownership Consolidating vendors and automating operations lowers licensing, integration, and operational cost across the estate. #### Lower ransomware exposure Eliminating standing admin rights and closing patch gaps reduces the enterprise attack surface measurably. #### Full EU data control Danish-built and EU-hosted — your endpoint data stays under European rules, supporting sovereignty mandates. #### Reduced legal & financial risk Audit-ready evidence and enforced compliance lower exposure to regulatory and insurance penalties. #### Higher productivity & uptime Stronger operational reliability keeps employees productive and reduces costly downtime. #### Enhanced trust & reputation Demonstrable governance and resilience strengthen customer and stakeholder confidence. In Their Words ### Trusted by IT teams across the Nordics CapaOne has become an indispensable part of our IT operation — the support and the continuous product development set it apart in a complex environment. Thomas Dennig Team Lead IT When CapaOne was implemented we had over 1,000 missing updates. Today the daily number is consistently zero — that gives both IT and management confidence. Thomas Holm-Frederiksen IT Manager, Vordingborg Køkkenet FAQ ### Questions we get asked Anything else? Talk to our team → **How does CapaOne reduce total cost of ownership?** By consolidating multiple point tools into one platform and automating manual operations, CapaOne cuts licensing, integration, and operational overhead — with metrics that support the business case. **Does CapaOne support NIS2 and GDPR compliance?** Yes. The platform is EU-hosted and Danish-built, with enforced policy controls and audit-ready evidence designed around European regulatory requirements. **Where is our data hosted?** CapaOne is EU-hosted by design. Your endpoint data is stored and processed within Europe — not routed through non-EU infrastructure — supporting data sovereignty mandates. **Does adopting CapaOne mean replacing Microsoft Intune?** No. CapaOne works standalone, or with Intune where you already run it — preserving your Microsoft investment while adding the governance, sovereignty, and automation capabilities Intune does not provide. **How does CapaOne reduce ransomware risk?** Removing standing local admin rights and automating patch coverage narrow the way in — and limit how far an attacker travels after getting through. Further reading ### Related resources - CapaSystems User Group 2026 - Reduce Tool Sprawl in Endpoint Management ### Ready to govern endpoints strategically? See how CapaOne reduces TCO, strengthens compliance, and keeps your data in Europe — a platform built for IT leadership that works standalone, or with Intune. Book a Demo Start Free Trial --- URL: https://capaone.com/solutions/for-it-managers/ Summary: CapaOne helps IT managers cut complexity, prove ROI and strengthen compliance posture — one platform, standalone or with Intune. ← All solutions Solutions · For IT Managers ## Built for IT Managers. Empower your team. Prove ROI. CapaOne is a unified cloud platform that works standalone, or with Microsoft Intune — designed for IT Managers to streamline operations, strengthen compliance, and reduce total cost of ownership, while giving you full visibility and control across every endpoint. Book a Demo Start Free Trial The Management Challenge ### What stands between you and a calm operation Most IT functions juggle several vendors and consoles. CapaOne consolidates them into one — purpose-built for mid-market organizations. #### Fragmented Tooling Multiple vendors and overlapping solutions create complexity, integration cost, and operational risk across endpoint management. #### Manual Workload Repetitive tasks like patch management and driver updates consume team resources that should go to higher-value work. #### Limited Visibility Without centralized oversight, it is hard to know the real state of the endpoint estate — or to report on it with confidence. #### Compliance Gaps Meeting NIS2 and GDPR requirements for endpoint operations is difficult without unified policy enforcement and evidence. #### Data Sovereignty Many platforms route data through US infrastructure, conflicting with European data residency and regulatory expectations. #### Proving Value Demonstrating ROI to leadership is hard when the gains are buried in scattered tools and manual processes. How CapaOne Helps ### From scattered tools to one accountable platform 01 One Platform #### Consolidate Unify tools, vendors, and data under one integrated platform — patching, deployment, rights management, and MDM in a single console. 02 Automation #### Automate Automation-first workflows eliminate repetitive tasks and free your team to focus on strategic priorities instead of routine maintenance. 03 Visibility #### Monitor & Control Centralized visibility and data-driven insights across the entire endpoint estate — the reporting leadership actually asks for. 04 Governance #### Govern Compliance Enforce NIS2-aligned, GDPR-first policies with streamlined configuration management and audit-ready evidence on demand. 150K+ endpoints managed in the Nordics 30+ years of endpoint expertise < 30 min average time to first value EU Danish-built · EU-hosted · GDPR-first Business Impact ### Outcomes your team can measure #### ROI you can show leadership Clear metrics on automation effectiveness and tool consolidation make the business case to the board straightforward. #### Optimized resources Improved service delivery with reduced overhead — your team does more without growing headcount. #### Faster onboarding Enterprise-grade mobile and endpoint management accelerates new-device and new-hire deployment. #### Stronger security posture Automated updates and privilege management strengthen protection across the fleet, continuously. #### Strategic oversight Data-driven insights enable informed decisions — not reactive firefighting. #### European data residency Danish-built, EU-hosted infrastructure keeps you aligned with GDPR and NIS2 by design. In Their Words ### Trusted by IT teams across the Nordics When CapaOne was implemented we had over 1,000 missing updates. Today the daily number is consistently zero — that gives both IT and management confidence. Thomas Holm-Frederiksen IT Manager, Vordingborg Køkkenet Like having a self-driving car — you let go of the wheel, and it drives itself. Thomas Nyborg Hansen IT Manager, Folketidende Gruppen Automated patching and clear visibility give us complete control across the estate — without the manual overhead we used to carry. Søren Dahl Nielsen System Deployment Manager FAQ ### Questions we get asked Anything else? Talk to our team → **Does CapaOne replace Microsoft Intune?** No. CapaOne works standalone, or with Intune — consolidating patching, privilege management, driver updates, and MDM that Intune does not fully cover, while preserving your Microsoft investment. **How does CapaOne help reduce total cost of ownership?** By consolidating multiple point tools into one platform and automating manual work, CapaOne cuts licensing, integration, and operational costs — with metrics you can report to leadership. **Can CapaOne help with NIS2 and GDPR compliance?** Yes. The platform is EU-hosted and Danish-built, with policy enforcement and audit-ready evidence designed around European compliance requirements. **Where is our data stored?** CapaOne is EU-hosted by design — your endpoint data stays within Europe, not routed through US infrastructure. Further reading ### Related resources - Reduce Tool Sprawl in Endpoint Management - European Endpoint Management and Data Sovereignty ### Ready to consolidate and prove ROI? See how CapaOne unifies your endpoint toolstack, automates the routine, and gives you the reporting leadership wants, with or without Intune. Book a Demo Start Free Trial --- URL: https://capaone.com/solutions/for-it-support-teams/ Summary: CapaOne helps IT support teams troubleshoot, update and restore devices faster — one cloud platform, with or without Microsoft Intune. ← All solutions Solutions · For IT Support Teams ## Built for IT Support. Fix faster. Keep users happier. CapaOne gives IT Support teams a unified cloud platform to troubleshoot, update, and restore devices quickly — with the reliability insights to spot problems before users even notice. Works with or without Microsoft Intune. Book a Demo Start Free Trial At the Front Line ### Troubleshooting, simplified Support teams carry urgent tickets, complex dependencies, and constant pressure to resolve fast. Here's where it hurts. #### Urgent Ticket Pressure Urgent tickets, complex dependencies, and the pressure to resolve quickly make it hard to ever get ahead of the queue. #### Repetitive Manual Tasks Application updates, driver installations, and routine fixes eat hours that could go to the issues that really need a human. #### No Unified Insight Without unified reliability data, identifying what is actually causing instability means hunting across multiple consoles. #### Recurring Incidents The same reliability patterns come back again and again — because there is no way to catch them early and intervene. #### Blind Device Posture A lack of clear device posture visibility means you often start a ticket without knowing the state of the machine. #### Tool Switching Jumping between separate tools to diagnose, update, and verify slows every resolution and increases the chance of error. Your Workflow ### From ticket to verified fix — in one place 01 Experience Monitor #### Monitor & Identify Real-time reliability and performance signals show device stability at a glance — and CVE-based vulnerability insights pinpoint risk. 02 Application Manager #### Trigger & Push Scheduled driver updates and automated application deployments run in the background; push new apps to users the moment they need them. 03 Privilege Manager #### Complete Admin Tasks Finish admin-dependent fixes through policy-based elevation — no need to dispatch standing local admin rights to resolve a ticket. 04 Verification #### Verify the Fix Immediate feedback through reliability signals confirms the issue is resolved — so you close the ticket with confidence, not hope. 150K+ endpoints managed in the Nordics 30+ years of endpoint expertise < 30 min average time to first value EU Danish-built · EU-hosted · GDPR-first Business Impact ### Outcomes your team can measure #### Faster resolution Unified insight and one-click actions cut time-to-fix dramatically — and reduce the volume of tickets reaching you at all. #### Fewer repeat incidents Catching reliability patterns early means the same problem stops coming back week after week. #### Less manual work Automated driver and application updates — running as often as twice daily — remove the routine toil from your day. #### More time for real work With the repetitive load lifted, the team gets time for higher-value, strategic improvements. #### One platform, no switching Diagnose, fix, and verify in a single console — no more jumping between tools mid-ticket. In Their Words ### Trusted by IT teams across the Nordics The Reliability dashboard provides a quick and clear starting point for troubleshooting, allowing us to focus where it matters. Nicklas P. Sørensen IT Specialist, Holbæk Municipality Managing IT for 60 team members alone could have been a major challenge — but not anymore. With CapaOne, everything runs seamlessly. Thomas Fest IT System Administrator, Lattec FAQ ### Questions we get asked Anything else? Talk to our team → **Does CapaOne replace Microsoft Intune for support work?** No. CapaOne works standalone, or with Intune where you already run it — adding reliability signals, automated updates, and policy-based elevation that make front-line troubleshooting faster. **How does CapaOne help reduce ticket volume?** By surfacing reliability issues before users report them and automating routine updates, many problems are resolved — or prevented — before a ticket is ever created. **Can support staff complete admin tasks without local admin rights?** Yes. Policy-based elevation lets the team complete admin-dependent fixes without handing out standing local admin — keeping resolution fast and secure. **How do we know a fix actually worked?** Reliability signals provide immediate feedback after an action, so you can verify a device is healthy before closing the ticket. Further reading ### Related resources - A New Chapter in Endpoint Management - CapaOne and Vordingborg Køkkenet ### Ready to fix problems faster? See how CapaOne gives support teams one console to diagnose, resolve, and verify, with or without Intune. Most teams feel the difference in their first week. Book a Demo Start Free Trial --- URL: https://capaone.com/solutions/intune-patch-management/ Summary: CapaOne Application Manager automates third-party patching on its own or alongside Intune. EU-hosted, with audit-ready evidence. ← All solutions Intune Patch Management ## Intune keeps Windows current. We patch everything else. CapaOne Application Manager automates third-party patching for browsers, PDF readers, runtimes and line-of-business apps, with no manual packaging and audit-ready evidence. It runs on its own or alongside Intune, which keeps Windows updates covered. Book a Demo Start Free Trial Available now #### Application Manager Third-party patching that runs on its own or alongside Intune — the apps attackers target most, kept current without lifting a finger. Manual packaging None Third-party coverage Maintained catalog Intune integration Full support Data residency EU-hosted The Third-Party Gap ### Intune patches Windows. Not the apps on top of it. Microsoft Intune keeps the operating system and Store apps up to date, and it does that job well. But the software your users actually work in all day — browsers, PDF readers, Java and .NET runtimes, collaboration tools, and your own line-of-business apps — falls outside what Intune patches automatically. That is the gap Application Manager is built to close — working with Intune, not replacing it. #### Windows is covered — the rest is not Intune keeps Windows and Store apps current. Browsers, PDF readers, runtimes and line-of-business tools sit outside that scope, and they are exactly where most attacks land. #### Manual packaging does not scale Wrapping every third-party installer as a Win32 app, then re-wrapping it on every new version, is slow, error-prone, and never quite keeps up with the release pace. #### Unpatched apps are the open door The majority of exploited vulnerabilities target common third-party software, not the OS. A single outdated browser or runtime can undo an otherwise clean patch posture. How It Fits ### Intune covers the OS. We cover everything installed on it. Application Manager slots into your existing Intune setup and takes over exactly the part of the patch estate Intune leaves open — third-party and line-of-business applications. - Managed device Enrolled in Intune - Intune Windows Update + Store apps - The third-party gap Browsers, runtimes, LOB apps - Application Manager Third-party apps patched automatically CapaOne - Fully patched fleet With audit-ready evidence Your existing Intune setup stays exactly as it is. CapaOne simply closes the part of the patch estate Intune was never built to cover. What You Can Do ### Third-party patching, fully automated. Everything you need to keep the apps Microsoft leaves behind current — without scripting, manual packaging, or chasing vendor releases. #### Maintained app catalog A curated catalog of common enterprise apps that stay current automatically — no chasing vendor release notes. #### No manual packaging New versions are packaged and delivered for you. No Win32 wrapping, no re-wrapping on every release. #### Policy-driven updates Define the versions you want everywhere; updates flow out on schedule without hands-on work. #### Staged rollouts Pilot a new version on a test ring before it reaches the whole fleet — minimize risk systematically. #### Entra ID targeting Reuse your existing Entra ID (Azure AD) groups to target updates — no parallel structure to maintain. #### Coverage reporting See patch status across every app and endpoint on demand — know what is current and what is not. #### CVE-aware prioritization Understand which outstanding updates close known vulnerabilities, so the riskiest gaps get fixed first. #### Audit & compliance export Export patch evidence for NIS2, ISO 27001, SOC 2 and cyber-insurance reviews in a few clicks. #### Works standalone too No Intune? Application Manager runs as a complete third-party patching solution on its own. What Gets Patched ### The apps attackers target — kept current A maintained catalog of common enterprise software, plus your own installers. A representative selection — the full catalog is broader and updated continuously. #### Browsers Google Chrome, Mozilla Firefox, Opera, Brave #### PDF & documents Adobe Acrobat Reader, Foxit Reader, LibreOffice #### Runtimes & frameworks Java (OpenJDK), .NET runtimes, Node.js, Python #### Collaboration Zoom, Slack, Microsoft Teams, Webex #### Remote access TeamViewer, AnyDesk, Citrix Workspace #### Utilities & archivers 7-Zip, Notepad++, VLC, FileZilla, PuTTY #### Developer tools Git, Visual Studio Code, PowerShell #### Line-of-business apps Your own installers, packaged and kept current How We Compare ### The honest comparison All of these tools close the third-party patch gap for Intune-managed fleets. Here is how Application Manager stacks up on the things that matter beyond the patch job itself. Capability | Patch My PC | Scappman | Ivanti Neurons | Application Manager | Automated third-party patching | ✓ | ✓ | ✓ | ✓ | Custom / line-of-business app packaging | ✓ | Partial | ✓ | ✓ | Works without Intune (standalone) | ✗ | ✗ | ✓ | ✓ | Part of a unified endpoint platform | ✗ | ✗ | ✓ | ✓ | Built-in CVE / vulnerability insight | Partial | ✗ | ✓ | ✓ | Privilege management included | ✗ | ✗ | Add-on | ✓ | EU-hosted, GDPR-first | ✗ | Partial | ✗ | ✓ | Pricing | Per device | Per device | Contact for pricing | €1/endpoint/month | Business Case ### What it means in practice What your IT team gains when third-party patching runs itself instead of eating hours every week. 0 #### Installers to package by hand The catalog is packaged and kept current for you — reclaim the hours spent wrapping and re-wrapping apps. ↓ #### Fewer patch-related tickets Apps that stay current on their own remove an entire category of support and remediation work. 100% #### Third-party visibility See patch status for every covered app across every endpoint — no blind spots outside the OS. ✓ #### Audit-ready at any moment Coverage and exception evidence is always on hand for NIS2, ISO 27001 and insurer reviews. Why Teams Trust CapaOne ### Three decades of endpoint management, built in Europe. 30+ years of endpoint experience 150,000+ endpoints managed EU Danish-built, EU-hosted NIS2 GDPR-first & NIS2-aligned Typical implementation ### From decision to production in four steps 01 #### Connect & discover Connect the platform and inventory the third-party apps already installed across your fleet. 02 #### Define your standards Choose the approved apps and versions you want everywhere — reuse your existing Entra ID groups to target them. 03 #### Pilot on a test ring Validate updates on a limited set of endpoints before promoting them to the whole estate. 04 #### Operationalize & prove Let updates flow automatically, and export coverage evidence whenever an audit calls for it. Most teams are up and running in about an hour — connect, define your standards, and updates start flowing the same day. Security & Compliance ### Close the gap attackers rely on Third-party applications are the most common route to a compromised endpoint. Application Manager keeps them current automatically — and gives you the evidence to prove it. - Close the third-party patch gap attackers target most — the majority of exploited vulnerabilities live in common apps, not the OS - Keep browsers, PDF readers and runtimes on their latest secure versions automatically, with no manual intervention - Prioritize the updates that close known CVEs first, so the riskiest exposures are remediated fastest - Demonstrate patch compliance at audit with clear, exportable evidence across your whole fleet - Keep all endpoint data in the EU, under European rules — no patch or inventory data sent to U.S. jurisdiction #### CVE-aware patching See which outstanding updates close known vulnerabilities and act on the riskiest first. #### Continuous coverage Apps stay current on policy — the gap never quietly reopens between release cycles. #### Audit evidence Patch status and exception records exportable on demand for NIS2, ISO 27001 and SOC 2. #### European data sovereignty Danish-built, EU-hosted. Your endpoint data stays in Europe, under European rules. FAQ ### Frequently asked questions Anything else? Talk to our team → **Does Application Manager Replace Intune?** No. Application Manager runs on its own or alongside Intune. Intune keeps handling Windows updates, Store apps and device policy, and CapaOne patches the third-party apps. You keep your existing setup. **How Does Third-Party Patching Work Alongside Intune?** Application Manager keeps a maintained catalog of third-party apps current on policy. On an Intune-managed fleet, it targets updates through your existing Entra ID groups while Intune continues to handle Windows updates. Without Intune, it runs the same way as a complete third-party patching solution. **What Third-Party Apps Does It Keep Patched?** A maintained catalog of common enterprise software — browsers, PDF readers, runtimes such as Java and .NET, collaboration and remote-access tools, utilities, and more. You can also package your own line-of-business installers and keep them current the same way. The catalog is updated continuously as new versions ship. **Do I Still Have to Package Apps into Win32 Packages Myself?** No. That manual packaging and re-packaging is exactly what Application Manager removes. New versions are packaged and delivered for you, so apps stay current without anyone wrapping installers by hand. **Can I Target Updates Using My Existing Entra ID Groups?** Yes. Application Manager reuses your existing Entra ID (Azure AD) groups, so you target updates with the same structure you already use in Intune — no parallel group hierarchy to build or maintain. **How Do I Prove Patch Compliance for an Audit?** The platform reports patch status across every covered app and endpoint, and lets you export that evidence — including approved exceptions — on demand. That gives you the documentation NIS2, ISO 27001, SOC 2 and cyber-insurance reviews ask for, without manual record-keeping. **Does It Work If We Do Not Use Intune?** Yes. Application Manager runs standalone as a complete third-party patching and application-deployment solution. Intune is optional, never a requirement. **Where Is Our Data Stored?** CapaOne is Danish-built and EU-hosted. Your endpoint, patch and inventory data is stored and processed within the EU, under European rules — no endpoint data is sent to U.S. jurisdiction. ### Complete your Intune in an hour. See Application Manager close your third-party patch gap on your own estate — working with Intune, or running entirely on its own. Book a Demo Start Free Trial --- URL: https://capaone.com/solutions/mdt-replacement/ Summary: MDT is retired. See how CapaOne Provision Manager replaces it — cloud-native Windows deployment from bare metal, with or without Intune. ← All solutions Works standalone Perfect with Intune ## MDT is retired. Here's your replacement. Provision Manager gives you what Microsoft Deployment Toolkit (MDT) did — and what Autopilot and Intune can't: a cloud-native way to install Windows on any device from bare metal. No servers. No images to maintain. No compromises. Book a Demo Start Free Trial Available now #### Provision Manager MDT is already retired. Don't let your deployment infrastructure become a security liability while you wait. Infrastructure required Zero servers Time to first deployment Under 1 hour Windows image types One universal image Intune integration Full support MDT Is Retired ### Autopilot doesn't replace MDT. CapaOne does. Microsoft recommends switching to Autopilot — but Autopilot requires a working OS. It doesn't help when you have a new device without an OS, a broken device that needs reimaging, or a recovery scenario after a malware attack. That's exactly the gap Provision Manager is built to fill. #### No more security updates Microsoft retired MDT rather than patching known security vulnerabilities — leaving active deployments exposed with no path to remediation. #### No compatibility with future Windows versions MDT will not support Windows 12. Every hardware refresh brings you closer to a complete block. #### No cloud support in MDT Microsoft built MDT for on-premise environments. It doesn’t solve remote onboarding, cloud recovery, or zero-infrastructure deployments. What CapaOne Solves ### Autopilot starts after OS installation. We handle what happens before. Microsoft Autopilot and Intune are excellent at what they're built for. But they assume the device is already running an OS. Provision Manager is the missing foundation. - New device No OS, no configuration - Provision Manager Bare-metal OS deploy + certified drivers via cloud CapaOne - Windows running Ready for enrollment - Autopilot Optional - Endpoint Management CapaOne, Intune, or another platform The same applies to broken devices, malware recovery, and remote onboarding — all scenarios where Autopilot can’t start. What You Can Do ### Everything MDT could do. And much more. Provision Manager is built for the way modern IT teams work — cloud-first, remote-first, infrastructure-free. #### Cloud-native bare-metal deploy Install Windows on any device directly from the cloud — no local server, no image to maintain, and no need to send a technician. A USB pen covers the single-device case on site. #### Remote recovery Re-image a broken or malware-infected device from the cloud in under one hour. No shipping back to IT. #### Universal OS image One hardware-agnostic image for all your device models. We deliver and maintain the latest Windows images for you. #### Automatic driver orchestration The platform identifies the hardware model and installs correct, manufacturer-certified drivers automatically. Dell, HP, Lenovo, Microsoft. #### Staged deployments Test new driver versions on selected user groups before rolling out to your entire fleet. Minimize risk systematically. #### Intune & Autopilot integration Provision Manager hands off exactly where Autopilot begins. Zero-touch from bare metal to daily use. #### Audit & compliance Full visibility into OS versions and driver activity across all endpoints. Documentation ready for audit at any time. #### Regional settings Configure keyboard layout, language, and locale settings directly in the deployment template. #### Zero infrastructure Decommission your deployment servers and move to a pure cloud model. No server maintenance, no patching, no capacity planning. How We Compare ### The honest comparison Microsoft Autopilot and Intune are excellent at what they're built for. But they assume the device is already running an OS. Provision Manager is the missing foundation. Capability | MDT | Intune + Autopilot | SmartDeploy | Provision Manager | Bare-metal OS deployment | ✓ | ✗ | ✓ | ✓ | Remote recovery (no shipping) | ✗ | ✗ | Partial | ✓ | Zero infrastructure required | ✗ | ✓ | ✗ | ✓ | No image maintenance | ✗ | ✓ | ✗ | ✓ | Automatic certified driver install | Manual | ✗ | Partial | ✓ | Actively supported in 2026 | ✗ | ✓ | ✓ | ✓ | EU-hosted, GDPR-first | ✗ | Partial | ✗ | ✓ | Part of unified endpoint platform | ✗ | Microsoft only | ✗ | ✓ | Price | Free (retired) | Included in M365 | Contact for pricing | €1/endpoint/month | Business Case ### What it means in practice What your IT department gains when switching from on-premise deployment to Provision Manager. <1h #### From bare metal to ready device First deployment template configured and first device booted in under one hour. 0 #### Deployment servers needed Decommission all on-premise deployment infrastructure and its associated maintenance burden. ↓ #### Fewer hardware-related tickets Manufacturer-certified drivers eliminate an entire category of support cases. ✓ #### Audit-ready documentation Provision Manager logs all OS and driver activity. No manual record-keeping required. Client Testimonial "The flexibility is what stood out immediately. I reinstalled a machine from a remote office — no local server, no USB key, no company network. And knowing I can recover a completely bricked device from the cloud changes how I think about device failures entirely." Lars Olsen Senior Desktop Manager, LEMAN Typical implementation ### From decision to production in four steps 01 #### Configure deployment templates Set up OS settings, regional preferences, and driver policies directly in the platform. 02 #### Connect your management layer Integrate with Intune for a clean handoff — or run Provision Manager standalone without Intune. 03 #### Pilot on selected devices Validate the workflow on a limited number of endpoints before rolling out broadly. 04 #### Operationalize the solution Use Provision Manager for all new deployments, remote onboarding, and cloud recovery. Most teams complete step 01–02 on day one and run their first deployment the same day. Security & Compliance ### A clean, verifiable foundation on every device Provision Manager closes the security gaps that uncontrolled imaging workflows and outdated drivers leave behind. - Reduce your attack surface by ensuring all endpoints run the latest manufacturer-approved driver versions - Eliminate risk from unknown configurations by deploying a clean, standardized OS image to every device - Demonstrate compliance at audit with clear visibility into OS and driver status across your entire fleet - Restore any Windows device to a known-good state after a malware attack via a secure, cloud-based reimaging process - Only official, manufacturer-certified driver packages — no risk of compromised installations #### Secure OS image We deliver clean, up-to-date Windows images directly in the platform. #### Certified drivers Dell, HP, Lenovo and Microsoft. Official packages only. #### Full logging Provision Manager logs all deployment activity and keeps it available for audit at any time. #### European data sovereignty European-built platform. Hosted in the EU. Your data stays in Europe. FAQ ### Frequently asked questions Anything else? Talk to our team → **Why can’t I just use Autopilot as an MDT replacement?** Autopilot is a device configuration service, not a deployment tool. It requires a device already running Windows. If a device has no OS, a corrupted OS, or needs a rebuild after malware, Autopilot cannot help. Provision Manager handles bare-metal deployment — then hands the device off to Autopilot. **Does Provision Manager require Microsoft Intune?** No. Provision Manager works standalone — no Intune required. For organizations already running Intune, it integrates fully and provides the bare-metal foundation Autopilot needs. For those without Intune, it operates as a complete cloud deployment solution. **Can Provision Manager fully replace our on-premise deployment servers?** Yes. Provision Manager replaces your deployment servers — no dedicated PXE server, no deployment shares, no image store to maintain. A device can boot two ways: from the cloud, where an existing computer on the same network answers the request on demand, or from a USB pen for quick on-site setup of a single device. Either way, the device installs directly from the cloud. You can decommission your legacy deployment infrastructure entirely. **What if a remote deployment fails?** Provision Manager includes real-time monitoring of deployment status. If a deployment fails, you can retry remotely without touching the device. The platform logs what happened and where the failure occurred, so troubleshooting is straightforward. **What about driver matching — do we need to maintain driver libraries?** No. Provision Manager automatically identifies the hardware model and installs the correct manufacturer-certified driver pack. We maintain the driver catalog — you don’t need to manage driver libraries manually. **What about OS images — do we need to build and maintain them ourselves?** No. We deliver and maintain clean, up-to-date Windows images directly in the platform. There is no golden image to build, sysprep, or update. One universal image works across all your hardware models. **How is a deployment initiated?** Provision Manager supports two deployment methods. From the cloud — when a new device wants to cloud boot, another computer on the network responds on demand and lets it install directly from the cloud. No dedicated server, no extra hardware. From a USB key — quick and simple for on-site setup of a single device. OS installation, drivers, regional settings, and Autopilot handoff all run automatically — no user interaction required. ### Ready to retire MDT for good? See Provision Manager provision a device from bare metal — in under an hour, from the cloud. Most organizations deploy their first device on day one. Book a Demo Start Free Trial --- URL: https://capaone.com/solutions/mid-market-endpoint-management/ Summary: CapaOne consolidates patching, provisioning and privilege for mid-market IT teams — endpoint management for 200–1,000 employees. ← All solutions Works standalone Perfect with Intune ## Endpoint Management for Mid-Market Organizations Enterprise-grade complexity, without the enterprise budget or headcount to match. CapaOne gives a lean IT team one platform to run every endpoint — instead of six disconnected tools. Book a Demo Calculate Your Savings CapaOne is an endpoint management platform built for mid-market organizations — typically 200 to 1,000 employees, run by IT teams of five to twenty people. It replaces four to six point tools with one console for patching, application deployment, OS provisioning, privilege control, and endpoint monitoring. CapaOne is Danish-built and EU-hosted, with a GDPR-first, NIS2-aligned posture. ### The Mid-Market Squeeze Mid-market IT sits in a hard spot: enough complexity to demand enterprise-grade control, without the budget or headcount that enterprises bring to it. A team of five to twenty people patches third-party applications, updates drivers, controls admin rights, onboards devices, and proves compliance to auditors and the board — usually across four to six separate point tools. Every added tool means another console, another contract, and another gap between them. Costs climb, visibility fragments, and manual work lands on people who are already stretched thin. ### One Platform Instead of Six Tools CapaOne consolidates endpoint operations into a single cloud platform: one agent per device, one console for the team, and automation that removes the repetitive work. #### Consolidate the Tool Stack Application Manager automates third-party application deployment and updates. Provision Manager handles cloud-native OS provisioning and driver orchestration. Privilege Manager enforces least privilege with just-in-time elevation and no standing local admin. #### Automate the Manual Work Workflows patch applications and update drivers on a schedule, elevate privileges on request, and provision new devices without hands-on imaging. Security Monitor surfaces vulnerability and configuration drift across endpoints; Experience Monitor gives live reliability insight that speeds up troubleshooting. #### Turn Operations Into Compliance Evidence Centralized logging and reporting turn everyday operations into audit evidence, and a GDPR-first, NIS2-aligned posture supports the frameworks mid-market organizations answer to. ### Proven With Mid-Market IT Teams ISC Consulting Engineers — around 330 employees, a six-person IT team managing roughly 270 PCs and 250 mobile devices. After a CIS18 audit, ISC needed consistent updates, controlled admin rights, and reliable mobile management, delivered through Application Manager, Provision Manager (driver handling), Privilege Manager, and Mobile Manager. “I will always recommend CapaSystems. They are indispensable if you, like us, have a complex environment. They deliver, meet all requirements, and then some – but the human factor, where we as customers feel heard, understood, and always experience that the task is handled with care, is truly unique.” — Thomas Dennig, Team Lead IT, ISC Consulting Engineers Vordingborg Køkkenet — a small IT function managing close to 200 endpoints. On first rollout, the dashboard showed more than 1,000 missing updates across devices. Today the daily count is consistently zero. “Time is a crucial factor for us — we couldn't manage all our endpoints without automating a large portion of our tasks.” — Thomas Holm-Frederiksen, IT Manager, Vordingborg Køkkenet ### Works With Microsoft Intune, or Without It CapaOne is a complete endpoint management platform in its own right. For the many mid-market organizations already running Microsoft Intune, CapaOne adds what Intune alone doesn't cover — automated third-party patching, driver and OS provisioning, and just-in-time privilege elevation — from the same console. Run CapaOne standalone, or use it to fill the gaps Intune leaves behind. FAQ ### Frequently Asked Questions Anything else? Talk to our team → **Which Endpoint Management Platform Works Best for Organizations with 200 to 1,000 Employees?** CapaOne is an endpoint management platform designed for mid-market organizations of 200 to 1,000 employees. It consolidates patching, application deployment, OS provisioning, privilege control, and monitoring into one console, so an IT team of five to twenty people can manage every endpoint without running four to six separate point tools. CapaOne is Danish-built and EU-hosted, with a GDPR-first, NIS2-aligned posture. **How Many Point Tools Can CapaOne Replace?** CapaOne typically replaces four to six point solutions — third-party patching, driver and firmware updates, vulnerability insight, OS provisioning, and privilege management — with one platform, one agent, and one console. **Does CapaOne Require Microsoft Intune?** No. CapaOne runs standalone as a complete platform, or alongside Intune to add third-party patching, provisioning, and privilege elevation that Intune alone doesn't cover. **Is CapaOne a Fit for a Small IT Team?** Yes. CapaOne is built for lean teams — one agent, one console, fast time-to-value, and no implementation consultants required. Mid-market organizations such as ISC Consulting Engineers and Vordingborg Køkkenet run it with IT teams of a handful of people. **How Much Does CapaOne Cost for a Mid-Market Organization?** Pricing is per endpoint, with volume discounts and a minimum annual contract. See the pricing page for tiers, or request a tailored quote for your environment. ### See What CapaOne Frees Up for Your Team Talk to a CapaOne specialist and we'll model the return for your exact environment. Book a Demo See Pricing --- URL: https://capaone.com/solutions/mobile-device-management/ Summary: Manage iOS, iPadOS and Android devices from one cloud platform — enrollment, configuration, compliance, and app delivery unified. ← All solutions Mobile Device Management ## Manage every mobile device from one console. CapaOne unifies enrollment, configuration, compliance, and application delivery across iOS, iPadOS, and Android devices in one cloud-based platform. Works standalone — or with Microsoft Intune. Book a Demo Start Free Trial The Basics ### What Is Mobile Device Management? Mobile device management is how IT enrolls, configures, and secures phones and tablets, delivers the applications people need on them, and proves — when an auditor asks — that those devices follow the organization's rules. Mobile devices reach the same data as laptops by a different route, and they usually land in a separate tool with its own console and its own reporting. CapaOne manages iOS, iPadOS, and Android in the same platform that manages Windows devices, so enrollment, configuration, compliance, and app delivery follow one operating model instead of two. We set out why mobile risk moved from IT to the executive floor. Why It's Hard ### The gaps your current toolset leaves open Most IT teams piece together 4–6 tools. CapaOne collapses them into one. #### Fragmented Visibility Enrollment status, app posture, and device inventory scattered across disparate tools — making it impossible to get a single trusted view. #### Inconsistent Setup Manual device configuration creates drift, leading to unpredictable behavior and a support burden that grows with the fleet. #### App Delivery Friction Limited central control over mandatory software installations slows deployments and leads to support tickets that IT has to chase. #### Compliance Pressure Proving device posture, OS version, encryption, and protection levels is time-consuming without unified, exportable evidence. #### Tool Sprawl Separate tools for enrollment, deployment, and reporting don't integrate cleanly with Intune or each other — creating operational friction. #### Operational Overhead Routine mobile tasks require excessive manual steps, slowing response times and increasing the risk of configuration errors. How It Works ### A clear path from problem to result 01 Mobile Manager #### Enroll & Standardize Zero-touch enrollment via Apple DEP, Android Enterprise, and Samsung Knox — with consistent onboarding flows, configuration profiles, and device posture checks. 02 Compliance #### Compliance & Protection Device inventory, OS version enforcement over Legacy MDM and DDM, data protection controls, and CSV exports for audits — covering both corporate and BYOD devices. 03 App Delivery #### App Lifecycle Deploy mandatory apps silently, manage updates centrally, and distribute managed apps — all without end-user friction or IT intervention per device. 04 Remote Actions #### Troubleshoot & Act Device visibility with remote actions — lock, wipe, selective wipe, and Lost Mode — plus policy drift detection to catch issues before they escalate. 150K+ endpoints managed in the Nordics 30+ years of endpoint expertise < 30 min average time to first value EU Danish-built · EU-hosted · GDPR-first Business Impact ### Outcomes your team can measure #### Higher device posture integrity Consistent enrollment and configuration profiles keep every mobile device on a known-good, compliant baseline. #### Fewer support tickets Better visibility and proactive alerts reduce the volume of mobile issues that reach the helpdesk. #### Stronger endpoint security OS version enforcement, encryption, and data protection controls applied across the fleet — over Legacy MDM and DDM alike. #### Greater operational efficiency One console replaces multiple tools — cutting the time spent switching between MDM, app, and reporting systems. #### Better employee experience Predictable enrollment and reliable app availability mean new devices are truly ready on day one. The Platform ### Products that power this solution #### Mobile Manager Unifies enrollment, configuration, compliance, and app delivery for iOS, iPadOS, and Android. Explore Mobile Manager #### Application Manager Automates app deployment and updates across managed endpoints — mobile and desktop alike. Explore Application Manager #### Security Monitor Configuration drift and vulnerability insights that strengthen your mobile compliance posture. Explore Security Monitor FAQ ### Questions we get asked Anything else? Talk to our team → **Does CapaOne replace Intune for MDM?** No. CapaOne manages mobile devices standalone — enrollment, configuration, compliance, and app delivery from one console. It also works with Microsoft Intune, adding device visibility, app delivery consistency, and remote actions where you need them. **How does CapaOne handle BYOD privacy?** Corporate and personally-owned devices use platform-native data protection controls that separate corporate apps from personal data — keeping employee privacy intact. Our guide to the gap personal devices leave in a compliance report covers where the line between corporate and personal data sits. **What if a device goes missing or becomes non-compliant?** CapaOne provides lock, wipe, selective wipe, and Lost Mode actions — all triggerable from the central console without physical access to the device. **Does CapaOne support zero-touch enrollment?** Yes. Zero-touch enrollment is supported via Apple DEP, Android Enterprise, and Samsung Knox — devices configure themselves out of the box. **Which mobile platforms are supported?** Mobile Manager supports iOS, iPadOS, and Android — covering both company-owned and BYOD scenarios from a single platform. Apple devices run under Legacy MDM or Apple Declarative Device Management, and on iOS 27 through DDM. **What Does Microsoft Intune Lack for Mobile Device Management?** Intune handles core mobile enrollment and policy, but many teams still lack consistent app delivery across private and public stores, unified posture visibility across iOS, iPadOS, and Android in one view, and a fast path for essential remote actions. CapaOne adds this through Mobile Manager — zero-touch enrollment, configuration profiles, data protection controls, and remote actions in a single operator-friendly workflow — with or without Intune. **How Do You Manage iOS and Android Devices from One Console?** You manage them from one console by unifying enrollment, configuration, compliance, and app delivery into a single workflow rather than separate per-platform tools. CapaOne enrolls devices via Apple DEP, Android Enterprise, and Samsung Knox, applies configuration profiles for Wi-Fi, VPN, certificates, and restrictions, and delivers private and public apps with mandatory installs and silent updates — across iOS, iPadOS, and Android — from the same place. **How Do You Prove Mobile Device Compliance for Audits?** You prove mobile compliance by maintaining a live record of device posture — encryption, passcode, operating system version, management mode, and applied configurations — and exporting it as evidence. CapaOne tracks this posture across the mobile fleet, flags policy drift, and exports device-level data as CSV for audits and governance reviews. The platform is EU-hosted and Danish-built, supporting GDPR and NIS2-aligned operations, as well as digital sovereignty. ### Ready to unify your mobile management? See CapaOne Mobile Manager on your fleet — iOS, iPadOS, and Android from one console. Most teams are up and running in under 30 minutes. Book a Demo Start Free Trial --- URL: https://capaone.com/solutions/reporting-and-monitoring/ Summary: CapaOne turns endpoint telemetry into clear insight across health, reliability, security posture and performance — with audit-ready exports. ← All solutions Reporting and Monitoring ## See everything. Prove anything. CapaOne turns endpoint telemetry into clear, actionable insight across health, reliability, and security posture — with audit-ready exports for governance and compliance. Works standalone — or with Microsoft Intune. Book a Demo Start Free Trial The Basics ### What Is Endpoint Reporting and Monitoring? Endpoint reporting and monitoring means seeing the state of your devices as it changes, and turning that into something an auditor or a leadership team can read without translation. Most IT teams hold plenty of data. What they lack is one version of it. When operations, support, and security each read a different dashboard, the discussion turns to which number is right rather than what to do next. CapaOne gathers device health, vulnerability findings, and configuration data in one place and exports them in a form that holds up as audit evidence. We take the same problem from the other end in deciding which vulnerabilities to fix first. Why It's Hard ### The gaps your current toolset leaves open Most IT teams piece together 4–6 tools. CapaOne collapses them into one. #### Siloed Data Health, performance, reliability, application, driver, and configuration data scattered across multiple tools — preventing a single, trusted view. #### Reactive Firefighting Issues surface through support tickets rather than telemetry — raising response times and user dissatisfaction across the organization. #### Reporting Gaps Leadership needs clarity, support needs root cause analysis, and auditors need evidence — none of which manual spreadsheets can reliably provide. #### Inconsistent Metrics Teams measure reliability, performance, and security differently across departments — making cross-functional reporting unreliable. #### Tool Sprawl Additional monitoring solutions add expense without adding meaningful context — and still don't give a unified view of endpoint health. #### Missing Historical Context Without a record of how endpoints looked last week, it is hard to tell whether a problem is new or has been building for a while. How It Works ### A clear path from problem to result 01 Telemetry #### Collect & Normalize Aggregates live endpoint telemetry with standardized metrics across applications, drivers, OS, vulnerabilities, and security configurations. 02 Dashboards #### Visualize & Detect Dashboards show endpoint health, security posture, and reliability, with views by OS version and compliance status. 03 Experience Monitor #### Investigate Clearly Experience Monitor shows application crashes, unexpected shutdowns, and other errors per device, with up to three months of reliability history — so you can see where problems cluster and when they started. 04 Reporting #### Prove & Share CSV exports for audits and leadership reviews, plus 30 days of history on security posture, configuration drift, and update status to show how things are moving. 150K+ endpoints managed in the Nordics 30+ years of endpoint expertise < 30 min average time to first value EU Danish-built · EU-hosted · GDPR-first Business Impact ### Outcomes your team can measure #### Faster incident resolution Proactive telemetry means IT knows about issues before users do — cutting mean time to resolution dramatically. #### Reduced ticket volume Problems are caught and resolved before they generate a support ticket — improving both IT efficiency and user satisfaction. #### Improved security posture Continuous drift detection and vulnerability signals keep endpoints aligned to your intended security baseline. #### Enhanced endpoint reliability Reliability scores and crash events identify problem devices early — before they disrupt productivity. #### Stronger governance Exportable evidence and clear posture trends make NIS2 and GDPR audits straightforward — not a fire drill. The Platform ### Products that power this solution #### Experience Monitor Real-time reliability, crash analytics, and performance signals across all managed endpoints. Explore Experience Monitor #### Security Monitor CVE-based vulnerability signals and configuration drift detection across your entire endpoint estate. Explore Security Monitor #### Application Manager Automates application deployment and patching — directly addressing what monitoring surfaces. Explore Application Manager FAQ ### Questions we get asked Anything else? Talk to our team → **Can CapaOne replace our separate monitoring tools?** Often, yes. CapaOne brings reliability, device health, and security posture data together in one place — with no extra silo to maintain. Works standalone, or with Microsoft Intune. **How real-time is the data?** Dashboards update continuously based on endpoint agent signals — you see the current state of your fleet, not a cached snapshot from last night. **Can I trigger remediation directly from a dashboard?** Dashboards provide visibility; operational changes are executed through Application Manager or Provision Manager — keeping monitoring and action cleanly separated. **How are reports shared with auditors?** Dashboards are built for the IT team in the CapaOne console. To share vulnerability and posture data with auditors or leadership, export it as CSV — no additional reporting tool needed. **How Do You Get Unified Visibility Across All Endpoints?** You get unified visibility by consolidating reliability, performance, security, application, driver, and configuration telemetry into a single, normalized view rather than using separate monitoring tools. CapaOne standardizes these signals into shared metrics and dashboards covering operating system version, reliability score, update status, and compliance. One console shows endpoint health, posture, and emerging issues across the entire fleet. **How Do You Produce Audit-Ready Compliance Documentation for Endpoints?** You produce audit-ready documentation by capturing endpoint posture continuously and exporting it as evidence whenever an audit or review calls for it, rather than assembling spreadsheets before each audit. CapaOne keeps 30 days of history for security posture, configuration drift, and update status, and up to three months for the reliability score. Device-level posture data exports as CSV for audits, leadership reviews, and incident analysis. The platform is EU-hosted and Danish-built, supporting GDPR and NIS2-aligned operations, as well as digital sovereignty. Our guide to proving endpoint posture in a NIS2 audit sets out which records hold up. **What Does Microsoft Intune Lack for Endpoint Reporting and Monitoring?** Intune reports on policy and compliance state, but it does not bring reliability and security posture data together in a single view. CapaOne does — with history and exportable evidence — with or without Intune. ### Ready for real-time endpoint visibility? See CapaOne's unified monitoring dashboard on your estate. Works standalone or with Microsoft Intune. Most teams are up and running in under 30 minutes. Book a Demo Start Free Trial --- URL: https://capaone.com/solutions/security-and-compliance/ Summary: CapaOne delivers endpoint vulnerability management — see exposures in real time, enforce least-privilege and export evidence, all EU-hosted. ← All solutions Solutions · Security & Compliance ## Endpoint security & compliance. Audit-ready by design. CapaOne brings endpoint vulnerability visibility and compliance together in one EU-hosted platform. See security exposures in real time, understand what's at risk, enforce least-privilege, and export audit evidence in clicks. Works standalone — or with Microsoft Intune. Book a Demo Start Free Trial Why It's Hard ### Security and compliance shouldn't be a fire drill Most teams stitch together several tools and spreadsheets to prove posture. CapaOne brings it into one view. #### Vulnerability Visibility Gap Endpoint data is scattered across multiple tools, forcing manual swivel-chair checks and spreadsheet tracking just to see your exposure. #### Compliance & Audit Burden Without integrated evidence export and device-level change tracking, every audit becomes a scramble to assemble proof by hand. #### Privilege Management Complexity Standing local admin accounts create real security risk — but overly restrictive controls slow users down and generate tickets. #### Operational Reliability Issues Outdated drivers, third-party application gaps, and configuration drift go undetected until a user reports a problem. #### Configuration Drift Firewall, encryption, and Windows Update settings quietly drift out of baseline across the fleet, widening the attack surface. #### Data Sovereignty Pressure Proving GDPR and NIS2 alignment is harder when endpoint data is processed through non-EU infrastructure. How It Works ### From scattered signals to provable posture 01 Security Monitor #### Unified Risk Visibility Real-time CVE-based vulnerability insights across endpoints, prioritized by severity, exposure, and business unit — with firewall, encryption, Windows Update, and drift signals on one dashboard. 02 Application Manager #### Exposure Reduction Third-party and business application updates via Application Manager, model-aware driver currency via Provision Manager, and continuous configuration and reliability monitoring. 03 Privilege Manager #### Least-Privilege Enforcement Time-limited elevation for approved applications and tasks with no standing local admins — granular rules by executable name and file path, every event logged. 04 Audit-ready #### Prove Compliance EU-hosted, GDPR-aligned infrastructure with NIS2-supporting reporting, CSV exports, device-level change tracking, and SSO/MFA access controls — audit evidence in clicks. 150K+ endpoints managed in the Nordics 30+ years of endpoint expertise < 30 min average time to first value EU Danish-built · EU-hosted · GDPR-first Business Impact ### Outcomes your team can measure #### One trusted view Consolidate endpoint security operations into a single dashboard — no more swivel-chair checks across disconnected tools. #### Automated audit evidence Replace manual compliance checks with CSV exports, logs, and device-level change tracking generated on demand. #### Reduced exposure Cut your attack surface through automated patching and least-privilege — without slowing users down. #### Issues caught early Reliability and configuration signals surface stability problems before users ever experience them. #### Framework-ready controls Consistent operational controls support NIS2, GDPR, and common security frameworks out of the box. The Platform ### Products that power this solution #### Security Monitor CVE-based vulnerability signals and configuration drift detection across your entire endpoint estate. Explore Security Monitor #### Privilege Manager Time-limited, policy-based elevation with zero standing local admin — fully logged for audit. Explore Privilege Manager #### Application Manager Automated third-party patching that closes the vulnerability gap at the source. Explore Application Manager #### Experience Monitor Reliability and performance signals that catch stability issues before users report them. Explore Experience Monitor FAQ ### Questions we get asked Anything else? Talk to our team → **Does CapaOne replace Microsoft Intune?** No. CapaOne works standalone, or with Intune — adding real-time vulnerability visibility, least-privilege enforcement, and audit-ready evidence that Intune does not provide natively. **How does CapaOne help with NIS2 and GDPR?** The platform is EU-hosted and GDPR-aligned, with NIS2-supporting reporting on posture and update status. Exportable logs, CSV reports, and device-level change tracking give you the evidence audits require. **How does CapaOne identify vulnerabilities?** Security Monitor uses CVE-based signals combined with configuration and version posture to surface exposures across OS, applications, and drivers — prioritized by severity, exposure, and business unit. Counting findings stops working once there are thousands — we set out why exposure beats list length when deciding what to fix. **Can CapaOne remediate exposures, not just report them?** Yes. Application Manager and Provision Manager deploy the latest versions automatically, so detection and remediation happen on the same platform — no tool-switching. **How is least-privilege enforced without slowing users down?** Privilege Manager grants time-limited elevation for approved applications and tasks with no standing local admins. Rules are scoped by executable name and file path, and every elevation is logged for audit. **Where is our data hosted?** CapaOne is EU-hosted by design — endpoint data is stored and processed within Europe, supporting GDPR and data sovereignty requirements. **How Do You Get Visibility into Endpoint Security and Compliance Status?** You get visibility into endpoint security and compliance status by bringing exposure data and posture signals into a single place, rather than checking each tool separately. CapaOne shows real-time, CVE-based vulnerability insight across all endpoints, alongside firewall and encryption status, Windows Update posture, pending reboots, and configuration drift. Prioritized views filter by severity, device group, or business unit, so IT teams can see what is at risk and confirm coverage from a single, trusted view — with no spreadsheets or manual checks. **How Do You Prove Endpoint Compliance to Auditors?** You prove endpoint compliance by producing evidence on demand rather than assembling it manually before each audit. CapaOne exports audit evidence in clicks — CSV reports, activity logs, and device-level change tracking — covering vulnerability posture, update status, and privilege activity. Because the evidence comes from everyday operations, the data auditors ask for is always current, not reconstructed after the fact. Auditors ask for specific documents — our checklist of what a NIS2 audit expects from an endpoint team goes through them. **What Is Audit-Ready Endpoint Management?** Audit-ready endpoint management means compliance evidence is a by-product of daily operations, not a separate reporting exercise. It combines real-time vulnerability and posture visibility, enforced least-privilege with logged elevation activity, and exportable evidence such as logs and change tracking. CapaOne delivers all three on one EU-hosted platform, so an organization can demonstrate its security posture at any time rather than scrambling before an audit. **How Does Least-Privilege Support Compliance?** Least-privilege supports compliance by removing standing local admin rights and recording who elevated, for what, and when. CapaOne enforces time-limited elevation for approved applications and tasks, with granular rules by executable name and file path, and logs every elevation for full audit traceability. This reduces the attack surface and produces the access-control evidence that security frameworks and auditors expect. Further reading ### Related resources - Real-Time Vulnerability Insight - EU-Hosted, Privacy-First Endpoint Data - NIS2 Requirements for Endpoint Management - Audit Evidence on Demand ### Ready to make compliance audit-ready? See CapaOne's unified security and compliance view on your estate — EU-hosted, with or without Intune. Most teams are up and running in under 30 minutes. Book a Demo Start Free Trial --- URL: https://capaone.com/solutions/unified-endpoint-automation/ Summary: Endpoint automation with CapaOne: third-party patching, driver updates, staged deployments and prerequisite checks, run from one platform. ← All solutions Unified Endpoint Automation ## Automate the routine. Focus on what matters. Endpoint automation for the work that consumes most of IT's time — third-party application patching, driver updates, staged deployments, and prerequisite checks. CapaOne runs it from one platform, in one workflow, with consistent results across the fleet. Works standalone — or with Microsoft Intune. Book a Demo Start Free Trial The Basics ### What Is Unified Endpoint Automation? Unified endpoint automation means one platform carries the recurring work of endpoint operations — application updates, driver updates, configuration, and the checks that confirm they worked — instead of teams stitching the same outcome together from scripts and separate tools. Scripts solve the problem once. They also become the thing only one person understands, and they fail quietly when a vendor changes an installer. CapaOne runs these workflows as a product capability rather than as code someone maintains on the side, so the automation outlives the person who set it up and the next administrator inherits a system instead of a folder. We looked at how wide that gap actually is in the difference between wanting automation and having it. Why It's Hard ### The gaps your current toolset leaves open Most IT teams piece together 4–6 tools. CapaOne collapses them into one. #### Manual Effort Everywhere Packaging applications, deploying updates, and handling hardware drivers demand repeated, time-consuming work from already stretched IT teams. #### Inconsistent Processes Different teams rely on different tools and scripts, creating configuration drift and unpredictable results across the fleet. #### Tool Sprawl Applications, drivers, and health telemetry live in separate consoles with no shared lifecycle view — multiplying costs and context-switching. #### Aging Components Outdated applications and drivers reduce stability, increase support tickets, and widen security exposure windows across the estate. #### Hard to Show Value Operational gains and manual task reductions are difficult to document clearly — making it hard to justify the team's time investments. #### Limited Change Control Updates are hard to roll out safely without phased deployment, scheduling controls, and prerequisite checks built into the workflow. How It Works ### A clear path from problem to result 01 Application Manager #### Keep Applications Current Automated third-party updates with prerequisite checks and a unified application catalog — version visibility across the entire fleet. 02 Provision Manager #### Driver Currency Vendor-supported driver packages deployed on schedule with full driver visibility across different hardware models in the estate. 03 Reporting #### Scaled Consistency Standardized workflows and shared operational insights across teams — with CSV export reporting to track improvements over time. 150K+ endpoints managed in the Nordics 30+ years of endpoint expertise < 30 min average time to first value EU Danish-built · EU-hosted · GDPR-first Business Impact ### Outcomes your team can measure #### Reduced manual workload Fully automated update flows free your team from repetitive packaging and deployment tasks — reclaiming hours every week. #### Fewer incidents Keeping applications and drivers current prevents the stability issues and compatibility problems that generate support tickets. #### Improved endpoint stability Consistent, policy-driven updates mean every device in the fleet stays on a known-good, predictable baseline. #### Consistent operations Standardized workflows replace ad-hoc scripts and tool-switching — the same process runs regardless of who is on shift. #### Clearer reporting Exportable dashboards communicate update status and operational improvements to leadership without manual compilation. The Platform ### Products that power this solution #### Application Manager Automates packaging, deployment, and third-party patching for every application in your catalog. Explore Application Manager #### Provision Manager Cloud-native OS deployment with built-in driver orchestration for a consistent, repeatable baseline. Explore Provision Manager #### Experience Monitor Real-time reliability and performance analytics to spot issues before they become incidents. Explore Experience Monitor FAQ ### Questions we get asked Anything else? Talk to our team → **Does CapaOne replace Intune?** No. CapaOne automates third-party application and driver updates standalone — packaging, prerequisite checks, scheduled deployments, and reporting from one platform. It also works with Microsoft Intune where you already run it. **Can CapaOne automate all endpoint updates?** CapaOne automates third-party application and driver updates. OS updates remain handled through Intune or your existing Windows Update processes. **How does CapaOne help reduce incidents?** Keeping applications and drivers current ensures a stable and reliable endpoint environment — the most common source of compatibility issues and crashes. **How do I share results with stakeholders?** CSV exports communicate update status and operational improvements to leadership — no manual reporting required. **How Do You Consolidate Endpoint Management into One Platform?** You consolidate by replacing separate tools for patching, driver updates, application deployment, and reporting with one platform that runs them through shared, automated workflows. CapaOne brings application lifecycle, driver currency, and operational reporting into a single console, so IT standardizes everyday tasks instead of stitching together disparate tools and ad-hoc scripts. It runs as a complete platform on its own or with Microsoft Intune. Our guide to replacing separate tools with one platform walks through the sequence. **How Do You Automate App and Driver Updates Without Scripts?** You automate them by defining update flows once and letting the platform handle detection, deployment, and scheduling, instead of maintaining custom scripts per task. CapaOne delivers third-party application and vendor-supported driver updates on a schedule IT controls, with prerequisite checks that reduce failed installations. Standardized deployment flows replace fragile scripts and manual routines, so updates roll out predictably across the fleet. **Where Does Endpoint Automation Go Beyond Intune?** Intune handles enrollment, policy, and Windows updates, but it does not automate the full third-party application and driver lifecycle, leaving much of the packaging, sequencing, and driver currency to manual effort or separate tools. CapaOne adds automated application and driver workflows, a unified catalog with version visibility, and phased deployment — with or without Intune. ### Ready to automate your endpoint operations? See how CapaOne eliminates the manual work from patching, driver updates, and application deployment — on your estate, in under 30 minutes. Book a Demo Start Free Trial --- URL: https://capaone.com/solutions/vulnerability-management/ Summary: CapaOne vulnerability management: see every endpoint exposure across OS, apps, drivers and configs — and fix what matters first. ← All solutions Vulnerability Management ## Find every exposure. Fix what matters first. A unified view of your entire endpoint attack surface — across OS, applications, drivers, and configurations. See what's exposed, where it is, and what to fix first. Works standalone — or with Microsoft Intune. Book a Demo Start Free Trial The Basics ### What Is Endpoint Vulnerability Management? Endpoint vulnerability management is the work of finding the weaknesses on your devices, deciding which ones matter, closing them, and keeping the evidence that you did. Finding vulnerabilities is rarely the hard part. A scan returns thousands of findings, and a flat list tells nobody where to start. CapaOne maps CVEs to the endpoints they actually affect, ranks them by the risk they carry in your environment, and remediates through the same platform that found them — so discovery and repair stop being two separate projects. We set out why a flaw on an internet-facing host outranks the same flaw elsewhere. Why It's Hard ### The gaps your current toolset leaves open Most IT teams piece together 4–6 tools to manage endpoint exposure. CapaOne collapses them into one — the single, exportable view that meeting NIS2 requirements for endpoint management depends on. #### Gaps in Visibility Vulnerabilities surface across disparate tools — making endpoint exposure assessment difficult and slow. #### Slow Investigations Teams switch between consoles to understand which endpoints are exposed and why, delaying meaningful action. #### Tool Sprawl One tool scans, another updates, a third reports — with spreadsheets filling the gaps between them. #### Aging Components Outdated applications and stale drivers extend exposure windows and require ongoing manual effort. #### Configuration Drift Missing or weakened security settings create inconsistencies across the fleet, broadening the attack surface. #### Compliance Pressure Demonstrating reduced exposure for NIS2/GDPR is hard without unified evidence across the estate. How It Works ### From blind spot to closed gap — in four steps 01 Security Monitor #### Discover Exposure CVE-based signals from Security Monitor map every known risk across OS, applications, and drivers. Version and configuration posture surfaces outdated software, stale drivers, and drift — giving IT full clarity within minutes. 02 Risk Scoring #### Prioritize Effort Scope, severity, and impact indicators convert to an overall risk score. Grouping by OS, filters, and tags lets teams drive maximum risk reduction with minimum effort — always working what matters most first. 03 Application Manager #### Reduce Exposure Application Manager keeps third-party apps current. Provision Manager deploys vendor-supported driver versions. Security Monitor surfaces misconfigurations so teams restore protections before issues escalate — all from the same platform. 04 Audit-ready #### Prove & Govern CSV exports give auditors, leadership, and security teams clear evidence of vulnerabilities and posture gaps. As an EU-hosted platform, CapaOne supports a NIS2-aligned, GDPR-first posture. 150K+ endpoints managed in the Nordics 30+ years of endpoint expertise < 30 min average time to first value EU Danish-built · EU-hosted · GDPR-first Business Impact ### Outcomes your team can measure #### Faster remediation Accelerated identification of vulnerable versions and misconfigurations cuts average exposure time across the fleet. #### Expedited investigations Unified, cross-layer security context means no more switching between consoles to understand what’s exposed and why. #### No more blind spots Consolidated risk visibility eliminates the security gaps that emerge between disconnected tools. #### Audit-ready governance Exportable evidence and clear posture trends make NIS2 and GDPR audits straightforward — not a fire drill. #### Smarter prioritization Risk scoring by severity, scope, and impact means your team works what matters — not just what’s loudest. The Platform ### Products that power this solution #### Security Monitor CVE-based vulnerability signals and configuration drift detection across your entire endpoint estate. Explore Security Monitor #### Application Manager Automates third-party patching and app deployment — closing the vulnerability gap at the source. Explore Application Manager #### Provision Manager Cloud-native OS deployment with built-in driver orchestration for a consistent, secure baseline. Explore Provision Manager FAQ ### Questions we get asked Anything else? Talk to our team → **Does CapaOne replace Microsoft Intune?** CapaOne works standalone — or with Microsoft Intune. For vulnerability and exposure management, it runs as a complete platform on its own — giving you cross-layer visibility across OS, applications, drivers, and configurations. For teams already running Intune, it adds the vulnerability context Intune doesn’t cover. **How does CapaOne identify vulnerabilities?** Security Monitor generates CVE-based vulnerability signals across operating systems, applications, and drivers, then maps each known risk to the affected endpoints. Version and configuration posture surfaces outdated software, stale drivers, and drift from your intended standards. **Can CapaOne remediate vulnerabilities automatically?** Yes. Application Manager keeps third-party and business applications current, and Provision Manager deploys vendor-supported driver versions — so you close exposures at the source, not just report them. Our guide to compensating controls for vulnerabilities you cannot patch yet covers what to do in the meantime. **How do I share reports with auditors and leadership?** Export the data as CSV. CapaOne exports cover vulnerabilities, affected endpoints, and posture gaps — clear evidence for auditors, leadership, and security teams. **Does CapaOne support NIS2 and GDPR compliance?** CapaOne gives you a unified, exportable record of endpoint exposure and posture — the evidence NIS2 and GDPR audits call for. As an EU-hosted platform, it supports a GDPR-first, NIS2-aligned posture across your estate. **Does CapaOne Help with Prioritization?** Yes. Vulnerabilities can be viewed by severity, exploitability, impact, and scope, so teams focus where risk reduction matters most rather than working through a flat list of findings. **How Do You Get Unified Visibility into Endpoint Vulnerabilities?** You get unified visibility by collecting vulnerability signals from every layer into a single view, rather than stitching together separate scanners and reports. CapaOne Security Monitor maps CVE-based risk, outdated software, stale drivers, and configuration drift to specific endpoints, then ranks exposure by severity, exploitability, and scope. One console shows what is exposed, where it is, and what to fix first — across operating systems, applications, drivers, and configurations. ### Ready to close the gaps? See CapaOne on your estate, standalone or with Intune. Most teams are up and running in under 30 minutes. Book a Demo Start Free Trial --- URL: https://capaone.com/solutions/why-capaone-intune/ Summary: CapaOne is a complete, EU-hosted endpoint platform — third-party patching, drivers, CVE insight, privilege and mobile, with or without Intune. ← All solutions CapaOne + Intune ## One Platform for Every Endpoint — With Intune, or Without It CapaOne is a complete, EU-hosted endpoint management platform. It automates third-party application updates, driver lifecycle, vulnerability insight, policy-based privilege elevation, reliability signals, and mobile operations — in one console. Run it as your primary platform, or with Microsoft Intune to cover the operational work a baseline deployment leaves manual. You reduce tools, lower cost, and speed up daily endpoint operations. Book a Demo Start Free Trial 150K+ endpoints managed in the Nordics 30+ years of endpoint expertise < 30 min average time to first value Danish-built · EU-hosted · GDPR-first A fair starting point ### What Intune Does Well For organizations standardized on Microsoft 365 and Entra ID, Intune is a strong foundation. It delivers cloud-first policy management, configuration and compliance enforcement, conditional access tied to identity, and baseline mobile device management — all integrated with the Microsoft ecosystem. Operating-system update delivery is a particular strength: Windows updates flow on a predictable cadence from one trusted pipeline. None of that needs replacing. The question is what happens around it once an estate becomes hybrid and security obligations expand — and that is where CapaOne does its work. The operational gaps ### Where a Baseline Intune Deployment Runs Out of Road In a hybrid estate, a baseline Intune deployment leaves predictable operational areas open — and most teams fill them with four, five, or six separate point tools. The pattern is consistent: third-party application patching, vulnerability context and remediation, driver and provisioning lifecycle, just-in-time privilege control, unified reporting, asset inventory, automation across apps and drivers, and operational depth for mobile. CapaOne closes all of these in one platform. For the detailed breakdown of each area, see the full Intune gap analysis. Standalone, or with Intune ### Standalone, or with Intune — Your Choice CapaOne runs as a complete endpoint management platform on its own. If you already run Intune, the two divide the work cleanly — CapaOne automates the operational layer (third-party patching, drivers, vulnerability remediation, privilege elevation, reliability, mobile), while Intune handles identity, policy, enrollment, and OS update delivery. You keep your Microsoft identity model, Intune policies, and existing device trust. The split is a choice, not a requirement. CapaOne - Third-party patching & application lifecycle - CVE vulnerability context & remediation - Bare-metal provisioning & driver orchestration - Just-in-time privilege elevation, no standing admin - Reliability signals & real-time inventory Microsoft Intune - Identity & access (Entra ID) - Configuration & compliance policy - Conditional Access - OS update delivery Day-to-day operations ### The Operational Capabilities IT Teams Rely On Day-to-Day CapaOne adds the operational layer that turns a policy foundation into daily, automated endpoint operations: - Automated third-party application updates via Application Manager - Driver updates based on vendor-supported model packages - Exposure visibility across the operating system, applications, and drivers - Policy-based privilege elevation with no standing local admin - Reliability and experience signals for faster root-cause analysis - Mobile device operations across iOS, iPadOS, and Android One unified dashboard, consistent inventory, and shared workflows mean fewer consoles, fewer agents, and faster decisions. How It Works ### How CapaOne Fits Your Estate 01 Deploy in Days, Not Months Run CapaOne as your complete platform, or with an existing Microsoft setup. If you run Intune, CapaOne preserves your identity model, policies, and device trust — no policy changes required. 02 Automate Updates Application Manager automates third-party application updates; Provision Manager handles driver lifecycle and vendor-supported model packages. 03 Add Security & Privilege Security Monitor delivers CVE-based exposure visibility across the operating system, applications, and drivers; Privilege Manager enables policy-based elevation with no standing local admin. 04 Consolidate Operations Experience Monitor adds reliability signals for faster root-cause analysis, and Mobile Manager consolidates iOS, iPadOS, and Android — all in one EU-hosted console. Consolidation & TCO ### Consolidate Tools, Cut TCO, and Move Faster - Replace 4–5 point tools with one platform covering applications, drivers, exposure signals, privilege elevation, reliability, and mobile devices - Lower TCO: fewer licenses, fewer agents, fewer renewals, less overlap - Simpler operations: automation reduces repetitive packaging and scheduling - Single dashboard: real-time inventory, targeting, and reporting in one place Security & Sovereignty ### Security, Governance, and EU Sovereignty CapaOne helps organizations meet European expectations for privacy, control, and clear evidence: - EU-hosted platform, built in Denmark - Exportable evidence for NIS2/GDPR reviews - Policy-based least-privilege with Privilege Manager - Application and driver currency to reduce exposure windows - Real-time configuration signals: encryption, firewall, install status, pending reboot You keep your Microsoft identity model, Intune policies, and existing device trust — while adding the operational clarity and automation that a baseline deployment leaves to manual work. By Role ### Outcomes for IT Teams #### IT Administrators - Automate third-party updates and driver updates - See inventory, posture, risk signals, and reliability in one console - Use safe, policy-based elevation to complete tasks without back-and-forth More for IT Administrators → #### IT Managers - Lower TCO and simplify the vendor landscape - Run CapaOne standalone, or add targeted automation to an existing Intune setup - Governance-ready KPIs: coverage, exposure, stability, change activity More for IT Managers → #### IT Support Teams - Faster diagnosis with reliability insights - Fewer tickets thanks to automated updates - Safe elevation eliminates delays in resolving local admin needs More for IT Support Teams → #### IT Executives - Strengthen the Microsoft investment by automating the operational layer - Strengthen decisions with unified risk, posture, and stability data - Reduce risk with solid governance and clearer exposure insight More for IT Executives → The Platform ### Products That Power This Solution #### Application Manager Automates the third-party application updates a baseline setup does not cover natively. Explore Application Manager #### Provision Manager Driver lifecycle and vendor-supported model packages for cloud-native provisioning. Explore Provision Manager #### Security Monitor CVE-based exposure visibility across the operating system, applications, and drivers. Explore Security Monitor #### Privilege Manager Policy-based, just-in-time elevation with zero standing local admin. Explore Privilege Manager #### Experience Monitor Reliability and experience signals for faster root-cause analysis. Explore Experience Monitor #### Mobile Manager Consolidated mobile operations across iOS, iPadOS, and Android. Explore Mobile Manager Comparison ### Replacing a Stack of Point Tools Most Intune estates fill the operational gaps with single-purpose tools — a separate product for patching, drivers, privilege, vulnerability scanning, asset discovery, and security. CapaOne consolidates those areas into one platform. Here is how it maps to the tools teams commonly run. Category | Point tool | What CapaOne consolidates | Patching & packaging | Patch My PC, RoboPack | Third-party patching, drivers, privilege, reliability, and mobile in one place | Vulnerability | SecTeer (VulnDetect / PatchPro) | Security insight, updates, privilege, and reliability unified | Privilege (PAM) | Admin By Request | Just-in-time privilege inside the same platform as updates and reporting | Asset & inventory | Lansweeper | Real-time inventory and operational insight | UEM / RMM | NinjaOne, ManageEngine, Ivanti | Works with Intune; reduces agents and duplication | Security | Heimdal, SentinelOne | Patching, drivers, privilege, mobile, and reliability, natively | FAQ ### Frequently Asked Questions Anything else? Talk to our team → **Which endpoint management tasks require a supplement to Microsoft Intune?** Intune handles enrollment, policy, and Windows Update well, but several day-to-day tasks fall outside its native scope: third-party application patching, driver and firmware lifecycle management, CVE-based vulnerability prioritization, just-in-time privilege elevation without standing local admin, and endpoint reliability signals for faster root-cause analysis. CapaOne covers all of these in one platform through Application Manager, Provision Manager, Security Monitor, Privilege Manager, and Experience Monitor. **What are the alternatives to Intune for patch management and vulnerability management?** Teams that already run Intune rarely want a second full UEM. For patching and vulnerability management specifically, the practical path is to add a platform that automates both. CapaOne provides third-party application patching through Application Manager and CVE-based vulnerability insight through Security Monitor, prioritized by severity, exploitability, and scope across the operating system, applications, and drivers. It runs standalone or with Intune, so IT teams gain complete patch and vulnerability coverage without adding separate single-purpose tools. **Can CapaOne run without Microsoft Intune?** Yes. CapaOne is a complete endpoint management platform in its own right. Teams without Intune run it as their primary platform for application patching, driver updates, provisioning, privilege management, vulnerability insight, reliability monitoring, and mobile management. Teams that run Intune use CapaOne to automate the operational tasks a baseline deployment leaves manual. It works standalone or with Intune. **Does adding CapaOne mean changing your Intune policies or enrollment?** No. CapaOne keeps your Microsoft identity model, Intune policies, and existing device trust in place. It targets your existing Entra ID groups and honors your current structure, adding automation and visibility without re-architecting what already works. ### Ready to Get Started? Consolidate your endpoint operations with CapaOne — standalone, or with Intune. Most teams are up and running in under 30 minutes. Request a Demo View Pricing --- URL: https://capaone.com/solutions/windows-endpoint-management/ Summary: Provision, secure and maintain Windows endpoints end to end — from one platform. ← All solutions Works standalone Perfect with Intune ## Windows Endpoint Management Provision, secure and maintain Windows endpoints end to end — from one platform. Book a Demo #### Provisioning Cloud-native deployment with built-in driver management. #### Patching OS and third-party updates kept current automatically. #### Privilege control Least privilege with just-in-time elevation. #### Monitoring Continuous health, compliance and vulnerability visibility. Keep exploring ### Related solutions #### Why CapaOne + Intune Explore → #### Intune Patch Management Explore → #### Security & Compliance Explore → #### European Sovereignty Explore → #### Endpoint Management for Mid-Market Organizations Explore → ### One platform. Every endpoint. See it on your own estate — with or without Intune. Book a Demo Watch the product tour # Comparisons --- URL: https://capaone.com/capaone-vs-admin-by-request/ Summary: CapaOne is a cloud-native, EU-hosted endpoint platform — an Admin By Request alternative covering privilege and five more jobs. CapaOne vs. ## CapaOne vs Admin By Request. Privilege Control, and Everything Around It. CapaOne is one platform for everything an endpoint estate needs to run: build the machine, keep its applications current, control who elevates, manage the mobile fleet, and see where exposure sits — in a single console, on a single agent. Admin By Request is a specialist in privileged access, built around removing standing local admin rights. The two meet on privilege. Outside that overlap, they cover different ground — and one of them covers more of it. Book a Demo Start Free Trial Up to 6 Products in one platform EU-built, EU-hosted Hosting & ownership ~€1 / endpoint / mo Pricing With or without Intune The Real Question ### Two Danish Vendors, Two Different Scopes Admin By Request builds depth into privileged access: per-application elevation, time-limited admin sessions, pre-approval lists, break-glass accounts, and a full audit trail. CapaOne builds breadth across endpoint operations, and privilege control is one of six products in it. Both are headquartered in Denmark and host in Europe, so data residency does not separate them. Scope does. #### Specialist in Privileged Access Admin By Request centers on removing standing local admin rights, with secure remote access and web access management alongside it. #### Six Products, Six Jobs CapaOne covers application deployment, OS provisioning, driver orchestration, mobile management, vulnerability posture, and endpoint reliability — alongside privilege control. #### The Overlap Is Real Privilege elevation appears in both, and it is where a direct comparison belongs. Everything outside it is a question of how many contracts an organization wants to carry. Consolidation ### One Console for Endpoint Operations Buying a point solution is not the same as buying a platform. In CapaOne the operations are one engine: a vulnerability Security Monitor finds can be closed by an Application Manager workflow, a device provisioned by Provision Manager arrives with its privilege policy already applied, and the same agent carries all of it. Nobody exports a list from one console and walks it over to another. 5+ Point Tools Separate consoles for patching, privilege, provisioning, mobile, and monitoring. CapaOne Platform One cloud-native platform consolidates every endpoint operation. One Console A single pane of glass across the whole fleet. Lower TCO Fewer contracts, fewer agents, less manual effort. Six products. One platform, one agent, one contract. Side by Side ### CapaOne vs Admin By Request: The Honest Comparison Admin By Request is a capable specialist in endpoint privilege management, developed in Denmark and hosted in Europe. The real difference is scope: one job covered in depth, against six jobs covered on one platform. Three rows below run against us, and they stay — they are why the rest of the table can be trusted. Capability | Admin By Request | CapaOne Platform | Removing standing local admin rights | ✓ Per-application and session elevation | ✓ Policy-driven elevation through existing Entra ID groups | Elevation audit trail | ✓ Full logging and session recording | ✓ User, endpoint, executable, path, time, duration, outcome — exportable to CSV | Operating systems for privilege control | ✓ Windows, macOS, and Linux | ✓ Windows client and Windows Server | Emergency local admin access | ✓ Break glass, LAPS replacement | ✓ Break glass with auto-revoke | Secure remote access and vendor sessions | ✓ A separate product | Not part of the platform | Third-party application patching and deployment | Not part of the platform | ✓ Packaging, deployment, and automatic updates | Bare-metal OS deployment | Not part of the platform | ✓ Cloud-native, no dedicated PXE server | Driver orchestration | Not part of the platform | ✓ Manufacturer-certified, model-aware, staged | Mobile device management | Not part of the platform | ✓ iOS, iPadOS, and Android | Vulnerability and configuration posture | Not part of the platform | ✓ CVEs mapped to affected endpoints, plus configuration drift | Endpoint reliability and performance | Not part of the platform | ✓ Real-time experience monitoring | Getting started | Onboarding and support levels tailored by territory | ✓ No implementation project, no consultants — real actions on day one, in under 30 minutes | Free tier | ✓ 25 licenses, all features | Free trial across the platform | Pricing model | Quote-based; scoped per region and term | ✓ Published: €1 per endpoint per month per product, five Windows products for the price of three | The Platform ### One Platform, Six Products CapaOne is built for the way modern, mid-market IT teams work — cloud-first, consolidated, and infrastructure-light. #### Application Manager Simplify packaging, accelerate deployment, and automate updates for third-party and line-of-business applications. Explore Application Manager #### Privilege Manager Enforce least-privilege with just-in-time elevation through existing Entra ID groups — and no standing local admin. Explore Privilege Manager #### Provision Manager Deploy Windows from bare metal in the cloud, with automated, manufacturer-certified driver orchestration. Explore Provision Manager #### Mobile Manager Unify enrollment, configuration, compliance, and app delivery across iOS, iPadOS, and Android. Explore Mobile Manager #### Security Monitor Surface configuration drift and vulnerability insight across every endpoint in the fleet. Explore Security Monitor #### Experience Monitor Track endpoint reliability and performance in real time to improve the day-to-day user experience. Explore Experience Monitor #### One Agent per Endpoint A single agent reduces complexity, improves stability, and speeds up troubleshooting. #### Cloud-Native by Design Zero-touch, remote rollout that scales and supports hybrid work — with no on-premise servers to run. #### EU-Built, EU-Hosted Data stays in Europe, with no transfer of endpoint data to US jurisdiction. The Gap ### The Five Jobs Next to Privilege Removing local admin rights closes one attack path. It does not deploy the patch that removes the vulnerability, provision the replacement laptop, enroll the phone, or tell you which endpoints have drifted out of configuration. Mid-market IT teams of five to twenty people carry all of those jobs. The tools arrive one at a time, each bought to solve the problem in front of the team that quarter, and the console count grows faster than the team does. Every additional vendor brings its own agent, its own portal, its own renewal date, and its own support path. Consolidation is not a feature. It is what happens when six jobs share one engine, one agent, and one contract. #### Patching Application Manager packages, deploys, and updates third-party applications on a schedule users can see. #### Provisioning Provision Manager builds machines from bare metal with model-aware driver orchestration, without a dedicated PXE server. #### Mobile Mobile Manager handles enrollment, configuration, compliance, and app delivery on iOS, iPadOS, and Android. #### Vulnerabilities Security Monitor maps CVEs to the endpoints they affect and surfaces configuration drift before it becomes an incident. #### Experience Experience Monitor shows where reliability and performance actually break, in real time across the fleet. Pricing ### What Published Pricing Changes CapaOne publishes its price. One euro per endpoint per month per product, all five Windows products for the price of three, a minimum annual contract of €1,500, and volume discounts in tiers. An IT manager can build the business case from the website and take a number to the CFO without booking a call. Admin By Request prices differently. The price depends on endpoint count and contract term, varies by region, and is scoped by the regional team, so the figure arrives through a conversation. The free plan covers 25 licenses with every feature, which makes evaluation genuinely free. Which works out cheaper depends on the organization, and neither vendor can answer that in advance for a stranger. Only one of the two, however, can be calculated in advance at all. The rate card is only part of what an endpoint platform costs. The other part is what it takes to start using it — and for CapaOne that figure is zero. There is no implementation project, no on-premises server to stand up, and no consultant to book. You run real actions on day one, in under 30 minutes. #### Published Rate €1 per endpoint per month per product. Five Windows products for the price of three. A €1,500 minimum annual contract, and volume discounts in tiers. #### Nothing to Set Up A cloud service and one agent. No on-premises servers, no imaging infrastructure, no implementation consultants. #### Productive on Day One You run real actions on day one, in under 30 minutes — not after a rollout project. Business Impact ### What It Means in Practice What mid-market IT teams gain when they consolidate onto CapaOne. 6 Products in One Platform One agent, one console, one contract — across patching, privilege, provisioning, mobile, vulnerabilities, and experience. €0 Setup and Implementation No implementation project, no consultants, no on-premises servers. You run real actions on day one. ~€1 Per Endpoint, per Month Transparent pricing — up to five Windows products, pay for max three. 30+ Years of Endpoint Experience A platform built on three decades of endpoint management practice. Standing local admin was our biggest unresolved risk. CapaOne removed it fleet-wide in a single afternoon. Municipal IT · 600+ managed endpoints How It Works ### From Decision to Production in Four Steps 01 #### Connect Your Environment Deploy one agent and integrate with your existing Entra ID groups. 02 #### Consolidate Your Tooling Replace point tools across patching, privilege, provisioning, mobile, and security. 03 #### Pilot on Selected Devices Validate the platform on a limited set of endpoints before rolling out broadly. 04 #### Operationalize the Platform Run CapaOne as your endpoint platform — standalone, or alongside Intune. Compliance ### Compliance as the Result of Everyday Operations CapaOne turns routine endpoint work into continuous, demonstrable compliance — NIS2-aligned and GDPR-first. - Enforce least-privilege with just-in-time elevation and no standing local admin. - Keep every endpoint patched across the operating system and third-party applications. - Surface configuration drift and vulnerabilities before they become incidents. - Document control for audit with clear visibility across the entire fleet. - Keep endpoint data in Europe, with no transfer to US jurisdiction. #### Always Up to Date Automated patching closes security gaps across OS and applications. #### Least-Privilege Just-in-time elevation through existing Entra ID groups, with full logging. #### Audit-Ready Clear visibility and logging across every managed endpoint. #### European Data Sovereignty EU-built and EU-hosted. Your endpoint data stays in Europe. FAQ ### Frequently Asked Questions Still weighing your options? Talk to our team → **Is CapaOne an Admin By Request Alternative?** It depends on what you are replacing. If you need to remove standing local admin rights and grant time-limited elevation with a full audit trail, CapaOne Privilege Manager covers that ground. If you also carry third-party patching, OS provisioning, mobile management, or vulnerability posture on separate contracts, CapaOne replaces those as well. If you need secure remote access or web access management, CapaOne does not cover those. **Where Do CapaOne and Admin By Request Overlap?** On endpoint privilege management. Both remove standing local admin rights, grant elevation for a limited time, and log what happened. Both run as cloud services without on-premises infrastructure. The overlap is genuine, and an organization that needs only privilege control has two reasonable options. **Which Operating Systems Does CapaOne Privilege Manager Support?** Windows client and Windows Server. Admin By Request covers Windows, macOS, and Linux for privilege management, so an organization with a mixed fleet should weigh that difference directly. CapaOne Mobile Manager covers iOS, iPadOS, and Android for mobile device management. **Does CapaOne Require an Approval Queue for Elevation?** No. Elevation is policy-driven. The user triggers it and receives access immediately within a time-limited window, because the policy has already decided what is permitted. The access remains scoped, time-limited, and logged. **How Does CapaOne Pricing Compare to Admin By Request?** The two are priced on different principles. CapaOne publishes a single rate of roughly €1 per endpoint per month, with up to five Windows products available for the price of three, so an IT manager can budget the platform straight from the website. Admin By Request scopes price by endpoint count, contract term, and region, and directs buyers to a conversation for a final figure. Which works out cheaper depends on how many jobs an organization needs covered — but only one of the two can be calculated in advance. **What Does CapaOne Cost to Implement?** Nothing beyond the subscription. CapaOne runs as a cloud service with one agent and no on-premises servers, and deployment does not require implementation consultants. You run real actions on day one, in under 30 minutes. **Does CapaOne Work With Microsoft Intune?** Yes, and it also runs entirely without it. CapaOne is a complete endpoint management platform on its own, and it integrates with Intune where an organization already runs it. **Where Is CapaOne Hosted?** In the EU, with no transfer of endpoint data to US jurisdiction. Admin By Request is also a Danish company hosting in Europe, so data residency does not separate the two. ### Count the Tools Before You Count the Price If privilege control is the only gap in your endpoint operation, a specialist will close it. If patching, provisioning, mobile, and vulnerability posture sit on separate contracts beside it, you are comparing one purchase against four. CapaOne closes all of it in one platform, on one agent, at a price you can read before you call — and with nothing to set up before you start. Request a Demo Start Free Trial --- URL: https://capaone.com/capaone-vs-heimdal/ Summary: CapaOne is a cloud-native, EU-hosted endpoint platform for mid-market IT — the operations layer Heimdal doesn't cover, with or without Intune. CapaOne vs. ## CapaOne vs Heimdal. Securing Endpoints, or Running Them. CapaOne is one platform for everything an endpoint estate needs to run: build the machine, keep its applications current, control who elevates, manage the mobile fleet, and see where exposure sits — in a single console, on a single agent. Heimdal is a cybersecurity suite built around threat prevention, detection, and response. The two meet on patching and privilege. Outside that overlap, they answer different questions — and most organizations need both answered. Book a Demo Start Free Trial Up to 6 Products in one platform Bare metal to mobile Operational coverage ~€1 / endpoint / mo Pricing With or without Intune The Real Question ### Two Platforms, Two Different Jobs Heimdal builds outward from security: DNS filtering, antivirus, ransomware protection, email security, and detection and response, with patching and privileged access as part of that suite. CapaOne builds outward from operations: deploy the machine, keep its applications current, control who elevates, manage the mobile fleet, and surface exposure. Where the two meet is patching and privilege. Where they do not meet is most of the rest. #### Security-First Suite Heimdal's platform centers on threat prevention, antivirus, and detection and response — capabilities CapaOne does not offer and does not claim. #### Operations-First Platform CapaOne covers bare-metal OS deployment, driver orchestration, mobile management, and endpoint reliability — none of which sit in a security suite. #### The Overlap Is Narrow Third-party patching and privilege elevation appear in both. That overlap is real, and it is where a direct comparison actually belongs. Consolidation ### One Console for Endpoint Operations Buying modules is not the same as buying a platform. In CapaOne the operations are one engine: a vulnerability Security Monitor finds can be closed by an Application Manager workflow, a device provisioned by Provision Manager inherits its baseline configuration, and every elevation Privilege Manager grants is logged into the same audit trail. Nothing needs wiring together, because nothing was separate to begin with. Six Products Application, privilege, provisioning, mobile, security, and experience — all included. One Engine Operations trigger each other automatically instead of being integrated by hand. One Agent A single agent per endpoint, and a single console across the whole fleet. One Price Up to five Windows products, pay for a maximum of three. No module-by-module add-ons. Not a suite of modules. One platform that already fits together. Side by Side ### CapaOne vs Heimdal: The Honest Comparison Both platforms patch third-party applications and control privilege elevation. The differences sit on either side of that overlap — and on some rows Heimdal covers ground CapaOne does not. Capability | Heimdal | CapaOne Platform | Third-party application patching | ✓ Windows, macOS, Linux; 350+ applications | ✓ Deeper on Windows — patching, packaging, and custom application deployment where mid-market fleets actually sit | Privilege elevation | ✓ PEDM, session management, application control | ✓ Just-in-time via existing Entra ID groups | Vulnerability and exposure insight | ✓ | ✓ CVE signals plus configuration drift | Bare-metal OS deployment | Not part of the platform | ✓ Cloud-native, no imaging server | Driver orchestration | Not part of the platform | ✓ Manufacturer-certified, model-aware | Mobile device management | Not part of the platform | ✓ iOS, iPadOS, and Android | Endpoint reliability and performance | Not part of the platform | ✓ Real-time experience monitoring | Antivirus, DNS filtering, email security | ✓ Extensive | Already covered by your Microsoft stack — CapaOne does not resell a layer you pay for twice | Detection and response, managed SOC | ✓ EDR/XDR and MXDR | Runs alongside your security stack rather than duplicating it | Integrated operations | Modules licensed and configured separately | ✓ One engine — a Security Monitor finding closes through an Application Manager workflow | Built for | Security teams, MSPs, and MSSPs | ✓ Mid-market in-house IT (200–1,000) | Pricing model | Quote-based — twelve products, each with its own pricing model | ✓ Published: ~€1/endpoint/month, five Windows products for the price of three | The Platform ### One Platform, Six Products CapaOne is built for the way modern, mid-market IT teams work — cloud-first, consolidated, and infrastructure-light. #### Application Manager Simplify packaging, accelerate deployment, and automate updates for third-party and line-of-business applications. Explore Application Manager #### Privilege Manager Enforce least-privilege with just-in-time elevation through existing Entra ID groups — and no standing local admin. Explore Privilege Manager #### Provision Manager Deploy Windows from bare metal in the cloud, with automated, manufacturer-certified driver orchestration. Explore Provision Manager #### Mobile Manager Unify enrollment, configuration, compliance, and app delivery across iOS, iPadOS, and Android. Explore Mobile Manager #### Security Monitor Surface configuration drift and vulnerability insight across every endpoint in the fleet. Explore Security Monitor #### Experience Monitor Track endpoint reliability and performance in real time to improve the day-to-day user experience. Explore Experience Monitor #### One Agent per Endpoint A single agent reduces complexity, improves stability, and speeds up troubleshooting. #### Cloud-Native by Design Zero-touch, remote rollout that scales and supports hybrid work — with no on-premise servers to run. #### EU-Built, EU-Hosted Data stays in Europe, with no transfer of endpoint data to US jurisdiction. The Gap ### What a Security Platform Leaves Open Four operational jobs that sit outside a cybersecurity suite — and still have to be done by someone every week. New device Provisioning A machine arrives, or one fails. Someone has to build it from bare metal and get the right drivers on it. Mobile Enrollment & Compliance Phones and tablets need enrolling, configuring, and keeping compliant — iOS, iPadOS, and Android. Slow laptop Reliability Crashes and degradation reach the service desk as tickets, not as security alerts. Software Packaging & Delivery Line-of-business applications still have to be packaged, deployed, and kept current across the fleet. None of these are security problems. All of them are somebody's Monday. The flexibility is what stood out immediately. I reinstalled a machine from a remote office — no local server, no USB key, no company network. And knowing I can recover a completely bricked device from the cloud changes how I think about device failures entirely. Lars Olsen, Senior Desktop Manager, LEMAN How It Works ### Adding the Operations Layer CapaOne goes in alongside what you already run. Nothing has to come out first. 01 #### Map the Overlap Decide where patching and privilege should live. Both platforms do them, and you only need one owner per job. 02 #### Deploy One Agent Install the CapaOne agent and connect your existing Entra ID groups. Your security agent stays where it is. 03 #### Start With the Gap Provisioning, mobile, and application delivery are uncontested — the fastest place to prove value without touching anything that works. 04 #### Consolidate What Duplicates Once the operations layer runs, decide whether the overlapping modules are still worth paying for twice. Compliance ### Compliance as the Result of Everyday Operations CapaOne turns routine endpoint work into continuous, demonstrable compliance — NIS2-aligned and GDPR-first. - Enforce least-privilege with just-in-time elevation and no standing local admin. - Keep every endpoint patched across the operating system and third-party applications. - Surface configuration drift and vulnerabilities before they become incidents. - Document control for audit with clear visibility across the entire fleet. - Keep endpoint data in Europe, with no transfer to US jurisdiction. #### Always Up to Date Automated patching closes security gaps across OS and applications. #### Least-Privilege Just-in-time elevation through existing Entra ID groups, with full logging. #### Audit-Ready Clear visibility and logging across every managed endpoint. #### European Data Sovereignty EU-built and EU-hosted. Your endpoint data stays in Europe. FAQ ### Frequently Asked Questions Still weighing your options? Talk to our team → **Is CapaOne a Heimdal Alternative?** It depends on what you are replacing. If you are looking for endpoint operations — bare-metal OS deployment, driver orchestration, application management, mobile device management, and privilege control in one console — CapaOne covers that ground and a security suite does not. If you are looking for antivirus, DNS filtering, email security, or detection and response, CapaOne is not a replacement for those capabilities. **Where Do CapaOne and Heimdal Overlap?** Two areas: third-party application patching and privilege elevation. Both platforms automate application updates and both remove standing local admin in favor of controlled elevation. Outside those two areas the platforms address different problems — operations on one side, threat prevention and response on the other. **Can CapaOne Replace a Security Platform?** No, and it is not designed to. CapaOne surfaces vulnerability and configuration exposure across the fleet and closes much of it through automated patching and least-privilege, but it does not perform threat detection, antivirus scanning, or incident response. Organizations typically run endpoint operations and endpoint security side by side. **Does CapaOne Deploy Operating Systems?** Yes. Provision Manager delivers cloud-native bare-metal Windows deployment with manufacturer-certified, model-aware driver orchestration, so a device can be built from scratch without an on-premise imaging server. This is endpoint operations rather than endpoint security, and it sits outside the scope of a cybersecurity suite. **Which Devices Does CapaOne Manage?** CapaOne manages Windows endpoints across application management, provisioning, privilege control, and vulnerability insight. Mobile Manager covers iOS, iPadOS, and Android for enrollment, configuration, compliance, and app delivery. **How Does CapaOne Pricing Compare to Heimdal?** The two are priced on different principles. CapaOne publishes a single rate of roughly €1 per endpoint per month, with up to five Windows products available for the price of three, so an IT manager can budget the platform straight from the website. Heimdal prices per module across twelve enterprise products and services, each with its own pricing model, and directs buyers to a sales conversation for a final figure. Which works out cheaper depends entirely on how many modules an organization actually needs — but only one of the two can be calculated in advance. **How Is CapaOne Priced?** CapaOne uses transparent pricing of roughly €1 per endpoint per month. Organizations can use up to five Windows products and pay for a maximum of three — without edition tiers or module-by-module add-ons. **Does CapaOne Work With Microsoft Intune?** Yes. CapaOne runs standalone or alongside Intune. For Intune users, it adds what Intune leaves out — third-party patching, OS and driver provisioning, and advanced privilege elevation — without an enterprise rollout. ### Security and Operations Are Two Budgets, Not One If your security layer is already covered, the operations layer is still open — bare-metal deployment, driver orchestration, application management, mobile, and endpoint reliability. CapaOne closes it in one platform, standalone or alongside Intune, without displacing anything that already works. Request a Demo Start Free Trial --- URL: https://capaone.com/capaone-vs-ivanti/ Summary: CapaOne is a cloud-native, EU-hosted endpoint management platform for mid-market IT — an Ivanti alternative built for fit, not overhead. CapaOne vs. ## CapaOne vs Ivanti. Enterprise Power, Mid-Market Fit. CapaOne gives mid-market teams the endpoint operations they actually use — patching, provisioning, privilege management, mobile, and security insight — in one cloud-native platform built in Europe. Run it standalone, or alongside Intune. Book a Demo Start Free Trial Up to 6 Products in one platform EU-built, EU-hosted Hosting & ownership ~€1 / endpoint / mo Pricing With or without Intune The Real Question ### Enterprise Power, Without the Enterprise Overhead Ivanti Neurons is a broad, mature platform spanning UEM, patch, mobile, and service management — built for the enterprise and assembled across many acquisitions. Mid-market teams of 5–20 people weigh different priorities: the right fit, fast time-to-value, transparent pricing, and clarity on who owns and hosts the platform. CapaOne answers those directly. #### Built for the Enterprise Ivanti's portfolio spans a wide enterprise estate, assembled across multiple acquisitions. Lean teams carry that breadth as overhead. #### Heavier Implementation Broad, enterprise rollouts often call for dedicated expertise. Mid-market teams want to be up and running in under an hour. #### Ownership & Jurisdiction A US-headquartered, PE-owned vendor raises data-governance questions under NIS2 and GDPR that European ownership answers directly. Consolidation ### Enterprise Operations, Without the Sprawl Enterprise platforms assemble breadth across many modules and acquisitions. CapaOne delivers the endpoint operations mid-market teams need in one console and one agent — whether or not Intune is in the stack. 5+ Point Tools Separate consoles for patching, privilege, provisioning, mobile, and monitoring. CapaOne Platform One cloud-native platform consolidates every endpoint operation. One Console A single pane of glass across the whole fleet. Lower TCO Fewer contracts, fewer agents, less manual effort. All the operations you use, none of the weight you don't. Side by Side ### CapaOne vs Ivanti: The Honest Comparison Ivanti Neurons is a broad, mature enterprise platform spanning UEM, patch, mobile, and service management. The real differences sit in fit, weight, ownership, and pricing — not in a feature checklist. Capability | Ivanti (Neurons) | CapaOne Platform | Unified endpoint management breadth | ✓ Extensive | ✓ | Automated patching (OS & third-party) | ✓ | ✓ | OS deployment / provisioning | ✓ | ✓ Cloud bare-metal + certified driver packs | Privilege management | ✓ | ✓ Just-in-time via Entra ID | Mobile device management | ✓ | ✓ | Cloud-native architecture | Cloud (Neurons) or on-premise (EPM heritage) | ✓ Cloud-native, built from the ground up | Built for | Enterprise; portfolio assembled via acquisitions | ✓ Mid-market in-house IT (200–1,000) | Implementation effort | Enterprise rollout; dedicated expertise | ✓ Up and running in under an hour | EU-owned and operated vendor | ✗ US-headquartered (South Jordan, UT), PE-owned | ✓ Danish-built, EU-owned | EU data hosting | Regional cloud available | ✓ EU-hosted, no transfer to US jurisdiction | Pricing model | Enterprise / quote-based | ✓ Transparent, ~€1/endpoint/month | The Platform ### One Platform, Six Products CapaOne is built for the way modern, mid-market IT teams work — cloud-first, consolidated, and infrastructure-light. #### Application Manager Simplify packaging, accelerate deployment, and automate updates for third-party and line-of-business applications. Explore Application Manager #### Privilege Manager Enforce least-privilege with just-in-time elevation through existing Entra ID groups — and no standing local admin. Explore Privilege Manager #### Provision Manager Deploy Windows from bare metal in the cloud, with automated, manufacturer-certified driver orchestration. Explore Provision Manager #### Mobile Manager Unify enrollment, configuration, compliance, and app delivery across iOS, iPadOS, and Android. Explore Mobile Manager #### Security Monitor Surface configuration drift and vulnerability insight across every endpoint in the fleet. Explore Security Monitor #### Experience Monitor Track endpoint reliability and performance in real time to improve the day-to-day user experience. Explore Experience Monitor #### One Agent per Endpoint A single agent reduces complexity, improves stability, and speeds up troubleshooting. #### Cloud-Native by Design Zero-touch, remote rollout that scales and supports hybrid work — with no on-premise servers to run. #### EU-Built, EU-Hosted Data stays in Europe, with no transfer of endpoint data to US jurisdiction. Business Impact ### What It Means in Practice What mid-market IT teams gain when they consolidate onto CapaOne. 30+ Years of Endpoint Experience A platform built on three decades of endpoint management practice. 150K+ Endpoints Under Management Proven at scale across European IT organizations. ~€1 Per Endpoint, per Month Transparent pricing — up to five Windows products, pay for max three. EU Built, Owned & Hosted European ownership and hosting, with data kept in Europe. Like having a self-driving car — you let go of the wheel, and it drives itself. How It Works ### From Decision to Production in Four Steps 01 #### Connect Your Environment Deploy one agent and integrate with your existing Entra ID groups. 02 #### Consolidate Your Tooling Replace point tools across patching, privilege, provisioning, mobile, and security. 03 #### Pilot on Selected Devices Validate the platform on a limited set of endpoints before rolling out broadly. 04 #### Operationalize the Platform Run CapaOne as your endpoint platform — standalone, or alongside Intune. Compliance ### Compliance as the Result of Everyday Operations CapaOne turns routine endpoint work into continuous, demonstrable compliance — NIS2-aligned and GDPR-first. - Enforce least-privilege with just-in-time elevation and no standing local admin. - Keep every endpoint patched across the operating system and third-party applications. - Surface configuration drift and vulnerabilities before they become incidents. - Document control for audit with clear visibility across the entire fleet. - Keep endpoint data in Europe, with no transfer to US jurisdiction. #### Always Up to Date Automated patching closes security gaps across OS and applications. #### Least-Privilege Just-in-time elevation through existing Entra ID groups, with full logging. #### Audit-Ready Clear visibility and logging across every managed endpoint. #### European Data Sovereignty EU-built and EU-hosted. Your endpoint data stays in Europe. FAQ ### Frequently Asked Questions Still weighing your options? Talk to our team → **Is CapaOne an Ivanti Alternative?** Yes. CapaOne is a European endpoint management platform built for mid-market in-house IT teams. It consolidates patching, provisioning, privilege management, mobile management, and security insight in one cloud-native console — without the breadth and rollout weight of an enterprise suite — and runs standalone or alongside Intune. **How Does CapaOne Compare to an Enterprise UEM Platform?** Enterprise UEM platforms cover a very wide estate and are often assembled across multiple acquisitions, which adds configuration depth and implementation effort. CapaOne is purpose-built for mid-market teams: one cloud-native console, one agent, fast time-to-value, transparent pricing, and European ownership and hosting. **Does CapaOne Work With Microsoft Intune?** Yes. CapaOne runs standalone or alongside Intune. For Intune users, it adds what Intune leaves out — third-party patching, OS and driver provisioning, and advanced privilege elevation — without an enterprise rollout. **Where Is CapaOne Hosted?** CapaOne is Danish-built, EU-owned, and EU-hosted, with no transfer of endpoint data to US jurisdiction — owned and governed in Europe, not only hosted there. **How Is CapaOne Priced?** CapaOne uses transparent pricing of roughly €1 per endpoint per month. Organizations can use up to five Windows products and pay for a maximum of three — without edition tiers or module-by-module add-ons. **How Long Does It Take to Get Started?** Most teams are up and running in under an hour. CapaOne uses one agent per endpoint and script-optional workflows, so the first point tool is often replaced within the first week. **Which Products Are Included?** The platform includes Application Manager, Privilege Manager, Provision Manager, Mobile Manager, Security Monitor, and Experience Monitor — six products in one console. ### See CapaOne Next to Your Current Stack Book a demo to compare CapaOne against your endpoint tooling — or start a free trial and explore the platform hands-on. Request a Demo Start Free Trial --- URL: https://capaone.com/capaone-vs-manageengine/ Summary: CapaOne is a cloud-native, EU-hosted endpoint management platform for mid-market IT — a ManageEngine alternative without the module sprawl. CapaOne vs. ## CapaOne vs ManageEngine. One Platform, Built in Europe. CapaOne brings patching, provisioning, privilege management, mobile, and security insight together in one cloud-native platform — the depth of a broad suite, without the configuration weight. Built and hosted in Europe. Run it standalone, or alongside Intune. Book a Demo Start Free Trial Up to 6 Products in one platform EU-built, EU-hosted Hosting & ownership ~€1 / endpoint / mo Pricing With or without Intune The Real Question ### A Broad Suite Isn't the Same as the Right Fit ManageEngine Endpoint Central is a capable, wide-ranging suite. But mid-market IT teams of 5–20 people rarely struggle to find features — they struggle with configuration depth, vendor sprawl, and questions about where their data lives. CapaOne answers the fit question, not just the feature checklist. #### Configuration Overhead Broad enterprise suites carry module depth that lean teams must configure, learn, and maintain — long after the demo ends. #### Vendor & Tool Sprawl Five or more point tools mean more contracts, more agents, and more gaps between them. Consolidation lowers both cost and risk. #### Ownership & Jurisdiction For NIS2 and GDPR programs, who owns and governs the platform matters — not only which region a data center sits in. Consolidation ### Depth Without the Module Sprawl A broad suite spreads endpoint work across many modules to configure and maintain. CapaOne brings the same operations into one console and one agent per endpoint — whether or not Intune is in the stack. 5+ Point Tools Separate consoles for patching, privilege, provisioning, mobile, and monitoring. CapaOne Platform One cloud-native platform consolidates every endpoint operation. One Console A single pane of glass across the whole fleet. Lower TCO Fewer contracts, fewer agents, less manual effort. Fewer modules to configure — the same ground covered. Side by Side ### CapaOne vs ManageEngine: The Honest Comparison ManageEngine Endpoint Central covers most core endpoint operations well. The real differences sit in architecture, fit, ownership, and pricing — not in a feature checklist. Capability | ManageEngine Endpoint Central | CapaOne Platform | Cloud-native architecture | Partial — SaaS or self-hosted on-premise | ✓ Cloud-native, built from the ground up | Third-party application patching | ✓ | ✓ | OS deployment / bare-metal provisioning | ✓ | ✓ | Privilege management | ✓ | ✓ Just-in-time via Entra ID | Mobile device management | ✓ | ✓ | Vulnerability & security insight | ✓ | ✓ | Built for mid-market (200–1,000 endpoints) | Broad SMB-to-enterprise suite | ✓ Purpose-built for mid-market | EU-owned and operated vendor | ✗ Zoho Corp, headquartered outside the EU | ✓ Danish-built, EU-owned | EU data hosting | Optional EU data center | ✓ EU-hosted, no transfer to US jurisdiction | Pricing model | Edition / module-tiered | ✓ Transparent, ~€1/endpoint/month | Time to first value | More configuration depth | ✓ Up and running in under an hour | The Platform ### One Platform, Six Products CapaOne is built for the way modern, mid-market IT teams work — cloud-first, consolidated, and infrastructure-light. #### Application Manager Simplify packaging, accelerate deployment, and automate updates for third-party and line-of-business applications. Explore Application Manager #### Privilege Manager Enforce least-privilege with just-in-time elevation through existing Entra ID groups — and no standing local admin. Explore Privilege Manager #### Provision Manager Deploy Windows from bare metal in the cloud, with automated, manufacturer-certified driver orchestration. Explore Provision Manager #### Mobile Manager Unify enrollment, configuration, compliance, and app delivery across iOS, iPadOS, and Android. Explore Mobile Manager #### Security Monitor Surface configuration drift and vulnerability insight across every endpoint in the fleet. Explore Security Monitor #### Experience Monitor Track endpoint reliability and performance in real time to improve the day-to-day user experience. Explore Experience Monitor #### One Agent per Endpoint A single agent reduces complexity, improves stability, and speeds up troubleshooting. #### Cloud-Native by Design Zero-touch, remote rollout that scales and supports hybrid work — with no on-premise servers to run. #### EU-Built, EU-Hosted Data stays in Europe, with no transfer of endpoint data to US jurisdiction. Business Impact ### What It Means in Practice What mid-market IT teams gain when they consolidate onto CapaOne. 30+ Years of Endpoint Experience A platform built on three decades of endpoint management practice. 150K+ Endpoints Under Management Proven at scale across European IT organizations. ~€1 Per Endpoint, per Month Transparent pricing — up to five Windows products, pay for max three. EU Built, Owned & Hosted European ownership and hosting, with data kept in Europe. Like having a self-driving car — you let go of the wheel, and it drives itself. How It Works ### From Decision to Production in Four Steps 01 #### Connect Your Environment Deploy one agent and integrate with your existing Entra ID groups. 02 #### Consolidate Your Tooling Replace point tools across patching, privilege, provisioning, mobile, and security. 03 #### Pilot on Selected Devices Validate the platform on a limited set of endpoints before rolling out broadly. 04 #### Operationalize the Platform Run CapaOne as your endpoint platform — standalone, or alongside Intune. Compliance ### Compliance as the Result of Everyday Operations CapaOne turns routine endpoint work into continuous, demonstrable compliance — NIS2-aligned and GDPR-first. - Enforce least-privilege with just-in-time elevation and no standing local admin. - Keep every endpoint patched across the operating system and third-party applications. - Surface configuration drift and vulnerabilities before they become incidents. - Document control for audit with clear visibility across the entire fleet. - Keep endpoint data in Europe, with no transfer to US jurisdiction. #### Always Up to Date Automated patching closes security gaps across OS and applications. #### Least-Privilege Just-in-time elevation through existing Entra ID groups, with full logging. #### Audit-Ready Clear visibility and logging across every managed endpoint. #### European Data Sovereignty EU-built and EU-hosted. Your endpoint data stays in Europe. FAQ ### Frequently Asked Questions Still weighing your options? Talk to our team → **Is CapaOne a ManageEngine Alternative?** Yes. CapaOne consolidates patching, provisioning, privilege management, mobile management, and security insight into one cloud-native platform, built and hosted in Europe. Teams choose it for mid-market fit, transparent pricing, and European ownership — and run it standalone or alongside Intune. **Does CapaOne Cover the Same Endpoint Operations?** CapaOne covers third-party patching, OS provisioning, privilege management, mobile management, and vulnerability insight within a single platform. The difference is the model: cloud-native architecture, one console, one agent, and a design built for mid-market teams rather than broad enterprise breadth. **Does CapaOne Work With Microsoft Intune?** Yes. CapaOne runs as your primary endpoint platform, or alongside Intune. Where Intune leaves gaps — third-party patching, driver and OS provisioning, advanced privilege elevation — CapaOne closes them from one console. **Where Is CapaOne Hosted?** CapaOne is Danish-built, EU-owned, and EU-hosted, with no transfer of endpoint data to US jurisdiction. For NIS2 and GDPR programs, vendor ownership and jurisdiction weigh as much as the region a data center sits in. **How Is CapaOne Priced?** CapaOne uses transparent pricing of roughly €1 per endpoint per month. Organizations can use up to five Windows products and pay for a maximum of three — without edition tiers or module-by-module add-ons. **How Long Does It Take to Get Started?** Most teams are up and running in under an hour. CapaOne uses one agent per endpoint and script-optional workflows, so the first point tool is often replaced within the first week. **Which Products Are Included?** The platform includes Application Manager, Privilege Manager, Provision Manager, Mobile Manager, Security Monitor, and Experience Monitor — six products in one console. ### See CapaOne Next to Your Current Stack Book a demo to compare CapaOne against your endpoint tooling — or start a free trial and explore the platform hands-on. Request a Demo Start Free Trial --- URL: https://capaone.com/capaone-vs-ninjaone/ Summary: CapaOne is a cloud-native, EU-hosted endpoint management platform for in-house IT — a NinjaOne alternative built for single-tenant focus. CapaOne vs. ## CapaOne vs NinjaOne. European Endpoint Management for In-House IT. CapaOne is one cloud-native platform for in-house IT teams — patching, provisioning, privilege management, mobile, and security insight in a single console, built and owned in Europe. Run it standalone, or alongside Intune. Book a Demo Start Free Trial Up to 6 Products in one platform EU-built, EU-hosted Hosting & ownership ~€1 / endpoint / mo Pricing With or without Intune The Real Question ### RMM Roots vs an In-House Endpoint Platform NinjaOne is a capable, fast unified IT platform, grown from the RMM and managed-service world. In-house mid-market teams weigh different priorities: depth in privilege and compliance, pricing they can forecast, and clarity on who owns and hosts the platform. CapaOne answers those directly. #### MSP-Shaped Tooling RMM platforms are shaped around multi-client managed-service delivery. In-house teams often need depth in privilege, provisioning, and compliance over multi-tenant breadth. #### Quote-Based Pricing Per-device quotes make budgeting and consolidation harder to forecast than transparent, per-endpoint pricing. #### Ownership & Jurisdiction A US-headquartered vendor raises data-governance questions under NIS2 and GDPR that European ownership and hosting answer directly. Consolidation ### Built for One Organization, Not Many Tenants RMM platforms are shaped around managing many clients at once. CapaOne focuses everything on a single organization's endpoints — one console, one agent — whether or not Intune is in the stack. 5+ Point Tools Separate consoles for patching, privilege, provisioning, mobile, and monitoring. CapaOne Platform One cloud-native platform consolidates every endpoint operation. One Console A single pane of glass across the whole fleet. Lower TCO Fewer contracts, fewer agents, less manual effort. Single-tenant focus, not multi-client overhead. Side by Side ### CapaOne vs NinjaOne: The Honest Comparison NinjaOne is a fast, capable unified IT platform with strong RMM and backup from its MSP roots. The real differences sit in ownership, in-house fit, privilege depth, and pricing — not in a feature checklist. Capability | NinjaOne | CapaOne Platform | Cloud-native architecture | ✓ | ✓ | Automated patching (OS & third-party) | ✓ | ✓ | Mobile device management | ✓ | ✓ | OS deployment / provisioning | Image-based (golden image, bootable media) | ✓ Image-free, cloud bare-metal + certified driver packs | RMM monitoring & backup | ✓ Strong (MSP roots) | Endpoint reliability & security monitoring | Privilege management | Partial — local admin & password automation | ✓ Just-in-time via Entra ID, no standing local admin | Built for | RMM/MSP roots; MSPs + IT teams | ✓ Mid-market in-house IT (200–1,000) | EU-owned and operated vendor | ✗ US-headquartered (Austin, TX) | ✓ Danish-built, EU-owned | EU data hosting | Regional hosting | ✓ EU-hosted, no transfer to US jurisdiction | Pricing model | Quote-based / per device | ✓ Transparent, ~€1/endpoint/month | The Platform ### One Platform, Six Products CapaOne is built for the way modern, mid-market IT teams work — cloud-first, consolidated, and infrastructure-light. #### Application Manager Simplify packaging, accelerate deployment, and automate updates for third-party and line-of-business applications. Explore Application Manager #### Privilege Manager Enforce least-privilege with just-in-time elevation through existing Entra ID groups — and no standing local admin. Explore Privilege Manager #### Provision Manager Deploy Windows from bare metal in the cloud, with automated, manufacturer-certified driver orchestration. Explore Provision Manager #### Mobile Manager Unify enrollment, configuration, compliance, and app delivery across iOS, iPadOS, and Android. Explore Mobile Manager #### Security Monitor Surface configuration drift and vulnerability insight across every endpoint in the fleet. Explore Security Monitor #### Experience Monitor Track endpoint reliability and performance in real time to improve the day-to-day user experience. Explore Experience Monitor #### One Agent per Endpoint A single agent reduces complexity, improves stability, and speeds up troubleshooting. #### Cloud-Native by Design Zero-touch, remote rollout that scales and supports hybrid work — with no on-premise servers to run. #### EU-Built, EU-Hosted Data stays in Europe, with no transfer of endpoint data to US jurisdiction. Business Impact ### What It Means in Practice What mid-market IT teams gain when they consolidate onto CapaOne. 30+ Years of Endpoint Experience A platform built on three decades of endpoint management practice. 150K+ Endpoints Under Management Proven at scale across European IT organizations. ~€1 Per Endpoint, per Month Transparent pricing — up to five Windows products, pay for max three. EU Built, Owned & Hosted European ownership and hosting, with data kept in Europe. Like having a self-driving car — you let go of the wheel, and it drives itself. How It Works ### From Decision to Production in Four Steps 01 #### Connect Your Environment Deploy one agent and integrate with your existing Entra ID groups. 02 #### Consolidate Your Tooling Replace point tools across patching, privilege, provisioning, mobile, and security. 03 #### Pilot on Selected Devices Validate the platform on a limited set of endpoints before rolling out broadly. 04 #### Operationalize the Platform Run CapaOne as your endpoint platform — standalone, or alongside Intune. Compliance ### Compliance as the Result of Everyday Operations CapaOne turns routine endpoint work into continuous, demonstrable compliance — NIS2-aligned and GDPR-first. - Enforce least-privilege with just-in-time elevation and no standing local admin. - Keep every endpoint patched across the operating system and third-party applications. - Surface configuration drift and vulnerabilities before they become incidents. - Document control for audit with clear visibility across the entire fleet. - Keep endpoint data in Europe, with no transfer to US jurisdiction. #### Always Up to Date Automated patching closes security gaps across OS and applications. #### Least-Privilege Just-in-time elevation through existing Entra ID groups, with full logging. #### Audit-Ready Clear visibility and logging across every managed endpoint. #### European Data Sovereignty EU-built and EU-hosted. Your endpoint data stays in Europe. FAQ ### Frequently Asked Questions Still weighing your options? Talk to our team → **Is CapaOne a NinjaOne Alternative?** Yes. CapaOne is a European endpoint management platform built for in-house mid-market IT teams. It consolidates patching, provisioning, privilege management, mobile management, and security insight in one cloud-native console, owned and hosted in Europe — and runs standalone or alongside Intune. **How Does CapaOne Differ From an RMM Platform?** RMM platforms grew from multi-client managed-service delivery and are strong on monitoring, remote control, and backup. CapaOne centers on in-house endpoint operations: application management, just-in-time privilege elevation, provisioning, mobile, and security insight — built for a single organization rather than multi-tenant service delivery, and owned and hosted in Europe. **Does CapaOne Work With Microsoft Intune?** Yes. CapaOne works standalone or alongside Intune. For Intune environments, it adds the operations Intune leaves out — third-party patching, OS and driver provisioning, and just-in-time privilege elevation — in one place. **Where Is CapaOne Hosted?** CapaOne is Danish-built, EU-owned, and EU-hosted, with no transfer of endpoint data to US jurisdiction. For teams weighing vendor jurisdiction under NIS2 and GDPR, European ownership answers the question directly. **How Is CapaOne Priced?** CapaOne uses transparent pricing of roughly €1 per endpoint per month. Organizations can use up to five Windows products and pay for a maximum of three — without edition tiers or module-by-module add-ons. **How Long Does It Take to Get Started?** Most teams are up and running in under an hour. CapaOne uses one agent per endpoint and script-optional workflows, so the first point tool is often replaced within the first week. **Which Products Are Included?** The platform includes Application Manager, Privilege Manager, Provision Manager, Mobile Manager, Security Monitor, and Experience Monitor — six products in one console. ### See CapaOne Next to Your Current Stack Book a demo to compare CapaOne against your endpoint tooling — or start a free trial and explore the platform hands-on. Request a Demo Start Free Trial --- URL: https://capaone.com/capaone-vs-omnissa/ Summary: CapaOne is a cloud-native, EU-hosted endpoint management platform for mid-market IT — an Omnissa alternative, built and owned in Europe. CapaOne vs. ## CapaOne vs Omnissa. One Platform, Built in Europe. CapaOne brings patching, provisioning, privilege management, mobile, and security insight together in one cloud-native platform — enterprise-grade endpoint operations, sized and priced for mid-market IT. Built and owned in Europe. Run it standalone, or alongside Intune. Book a Demo Start Free Trial Up to 6 Products in one platform EU-built, EU-hosted Hosting & ownership ~€1 / endpoint / mo Pricing With or without Intune The Real Question ### Enterprise Breadth Isn't the Same as the Right Fit Omnissa Workspace ONE is a capable, enterprise-grade platform with deep reach — across desktops, mobile, servers, virtual desktops, and more. But mid-market IT teams of 5–20 people rarely need that breadth. They need endpoint operations sized for their team, priced transparently, and governed in Europe. CapaOne answers the fit question, not the enterprise feature checklist. #### Enterprise Weight Broad enterprise platforms carry reach — servers, virtual desktops, rugged, IoT — that lean teams pay for and maintain but rarely use. #### Ownership & Jurisdiction For NIS2 and GDPR programs, who owns and governs the platform matters — not only which region a data center sits in. #### Transparent Pricing Enterprise platforms priced through sales engagement make budgeting hard. Per-endpoint transparency makes cost predictable. Consolidation ### Depth Without the Enterprise Weight A broad enterprise platform spreads endpoint work across wide-ranging modules built for the largest, most diverse fleets. CapaOne brings the operations mid-market teams actually use into one console and one agent per endpoint — whether or not Intune is in the stack. 5+ Point Tools Separate consoles for patching, privilege, provisioning, mobile, and monitoring. CapaOne Platform One cloud-native platform consolidates every endpoint operation. One Console A single pane of glass across the whole fleet. Lower TCO Fewer contracts, fewer agents, less manual effort. Enterprise-grade operations — sized for the team that runs them. Side by Side ### CapaOne vs Omnissa: The Honest Comparison Omnissa Workspace ONE covers endpoint operations at enterprise scale. The real differences for mid-market teams sit in fit, architecture, ownership, and pricing — not in a feature checklist. Capability | Omnissa Workspace ONE | CapaOne Platform | Cloud-native architecture | Cloud or on-premise deployment | ✓ Cloud-native, built from the ground up | Third-party application patching | ✓ | ✓ | OS deployment / bare-metal provisioning | ✓ | ✓ | Privilege management | Policy-based device controls | ✓ Just-in-time via Entra ID | Mobile device management | ✓ Enterprise MDM heritage (AirWatch) | ✓ | Vulnerability & security insight | ✓ | ✓ | Scope | Broad workspace suite (UEM + virtual desktops + DEX) | Focused endpoint management platform | Built for mid-market (200–1,000 endpoints) | Enterprise-scale platform | ✓ Purpose-built for mid-market | EU-owned and operated vendor | ✗ KKR-owned (US private equity), HQ Mountain View, CA | ✓ Danish-built, EU-owned | EU data hosting | EU data center regions available | ✓ EU-hosted, no transfer to US jurisdiction | Pricing model | Enterprise pricing via sales engagement | ✓ Transparent, ~€1/endpoint/month | Time to first value | Enterprise configuration depth | ✓ Up and running in under an hour | The Platform ### One Platform, Six Products CapaOne is built for the way modern, mid-market IT teams work — cloud-first, consolidated, and infrastructure-light. #### Application Manager Simplify packaging, accelerate deployment, and automate updates for third-party and line-of-business applications. Explore Application Manager #### Privilege Manager Enforce least-privilege with just-in-time elevation through existing Entra ID groups — and no standing local admin. Explore Privilege Manager #### Provision Manager Deploy Windows from bare metal in the cloud, with automated, manufacturer-certified driver orchestration. Explore Provision Manager #### Mobile Manager Unify enrollment, configuration, compliance, and app delivery across iOS, iPadOS, and Android. Explore Mobile Manager #### Security Monitor Surface configuration drift and vulnerability insight across every endpoint in the fleet. Explore Security Monitor #### Experience Monitor Track endpoint reliability and performance in real time to improve the day-to-day user experience. Explore Experience Monitor #### One Agent per Endpoint A single agent reduces complexity, improves stability, and speeds up troubleshooting. #### Cloud-Native by Design Zero-touch, remote rollout that scales and supports hybrid work — with no on-premise servers to run. #### EU-Built, EU-Hosted Data stays in Europe, with no transfer of endpoint data to US jurisdiction. Business Impact ### What It Means in Practice What mid-market IT teams gain when they consolidate onto CapaOne. 30+ Years of Endpoint Experience A platform built on three decades of endpoint management practice. 150K+ Endpoints Under Management Proven at scale across European IT organizations. ~€1 Per Endpoint, per Month Transparent pricing — up to five Windows products, pay for max three. EU Built, Owned & Hosted European ownership and hosting, with data kept in Europe. Like having a self-driving car — you let go of the wheel, and it drives itself. How It Works ### From Decision to Production in Four Steps 01 #### Connect Your Environment Deploy one agent and integrate with your existing Entra ID groups. 02 #### Consolidate Your Tooling Replace point tools across patching, privilege, provisioning, mobile, and security. 03 #### Pilot on Selected Devices Validate the platform on a limited set of endpoints before rolling out broadly. 04 #### Operationalize the Platform Run CapaOne as your endpoint platform — standalone, or alongside Intune. Compliance ### Compliance as the Result of Everyday Operations CapaOne turns routine endpoint work into continuous, demonstrable compliance — NIS2-aligned and GDPR-first. - Enforce least-privilege with just-in-time elevation and no standing local admin. - Keep every endpoint patched across the operating system and third-party applications. - Surface configuration drift and vulnerabilities before they become incidents. - Document control for audit with clear visibility across the entire fleet. - Keep endpoint data in Europe, with no transfer to US jurisdiction. #### Always Up to Date Automated patching closes security gaps across OS and applications. #### Least-Privilege Just-in-time elevation through existing Entra ID groups, with full logging. #### Audit-Ready Clear visibility and logging across every managed endpoint. #### European Data Sovereignty EU-built and EU-hosted. Your endpoint data stays in Europe. FAQ ### Frequently Asked Questions Still weighing your options? Talk to our team → **Is CapaOne an Omnissa Alternative?** Yes. CapaOne consolidates patching, provisioning, privilege management, mobile management, and security insight into one cloud-native platform, built and hosted in Europe. Mid-market teams choose it for fit, transparent pricing, and European ownership — and run it standalone or alongside Intune. **How Is CapaOne Different From Omnissa Workspace ONE?** Omnissa Workspace ONE is an enterprise-grade platform with broad reach across desktops, mobile, servers, and virtual desktops. CapaOne focuses on the endpoint operations mid-market teams use most — patching, provisioning, privilege, mobile, and security insight — in one console, with transparent per-endpoint pricing and European ownership. **Does CapaOne Work With Microsoft Intune?** Yes. CapaOne runs as your primary endpoint platform, or alongside Intune. Where Intune leaves gaps — third-party patching, driver and OS provisioning, advanced privilege elevation — CapaOne closes them from one console. **Where Is CapaOne Hosted?** CapaOne is Danish-built, EU-owned, and EU-hosted, with no transfer of endpoint data to US jurisdiction. For NIS2 and GDPR programs, vendor ownership and jurisdiction weigh as much as the region a data center sits in. **Who Owns CapaOne?** CapaOne is built and owned by CapaSystems, a Danish company. That ownership sits in Europe, and endpoint data stays EU-hosted with no transfer to US jurisdiction — a distinction that matters when an endpoint platform holds patch status, inventory, and privilege data across the fleet. **How Is CapaOne Priced?** CapaOne uses transparent pricing of roughly €1 per endpoint per month. Organizations can use up to five Windows products and pay for a maximum of three — without edition tiers or module-by-module add-ons. **How Long Does It Take to Get Started?** Most teams are up and running in under an hour. CapaOne uses one agent per endpoint and script-optional workflows, so the first point tool is often replaced within the first week. ### See CapaOne Next to Your Current Stack Book a demo to compare CapaOne against your endpoint tooling — or start a free trial and explore the platform hands-on. Request a Demo Start Free Trial --- URL: https://capaone.com/capaone-vs-patch-my-pc/ Summary: CapaOne is a Danish-built, EU-hosted endpoint platform — a Patch My PC alternative that patches and runs the whole estate. CapaOne vs. ## CapaOne vs Patch My PC. A Platform, or a Publisher. CapaOne is one platform for everything an endpoint estate needs to run: build the machine, keep its applications current, control who elevates, manage the mobile fleet, and see where exposure sits — in a single console, on a single agent. Patch My PC packages and publishes third-party applications into Microsoft ConfigMgr or Intune, which then deliver them. The two meet on application patching. Outside that overlap, one of them runs the estate and the other feeds it. Book a Demo Start Free Trial Up to 6 Products in one platform EU-built, EU-hosted Hosting & ownership ~€1 / endpoint / mo Pricing With or without Intune The Real Question ### Two Ways to Solve Third-Party Patching Patch My PC has done one job since 2011 and does it deeply: a curated catalog, automated packaging, and publishing into Microsoft’s own management infrastructure. CapaOne patches third-party applications as one of six products that also provision machines, control privilege, manage phones, and surface exposure. Both approaches are reasonable. They answer different questions about how much of the endpoint an organization wants to hand to one vendor. #### A Publisher, by Design Patch My PC packages applications and publishes them into ConfigMgr or Intune. Delivery to the device is handled by Microsoft’s own components. #### A Platform, by Design CapaOne carries its own console and its own agent, and runs with Microsoft Intune or entirely without it. #### Danish, and Close By Built in Denmark, hosted in the EU, supported in Danish or English, in your time zone — by a company that has managed endpoints for thirty years. Consolidation ### One Console for Endpoint Operations A catalog that publishes into someone else’s console solves the packaging. It does not tell you what happened next. In CapaOne the same agent that updates an application reports which endpoints still run the old version, which of them are exposed to a known CVE, and which of them were built last week with a different driver set. The answer arrives in the console that did the work. 5+ Point Tools Separate consoles for patching, privilege, provisioning, mobile, and monitoring. CapaOne Platform One cloud-native platform consolidates every endpoint operation. One Console A single pane of glass across the whole fleet. Lower TCO Fewer contracts, fewer agents, less manual effort. One platform, one agent, one contract — with its own delivery to the device. Side by Side ### CapaOne vs Patch My PC: The Honest Comparison Patch My PC is a capable specialist in third-party application patching, with a catalog it has curated since 2011. The clearest difference is delivery: their packages are handed to Microsoft’s own infrastructure, while CapaOne carries its own agent. Four rows below run against us, and they stay — they are why the rest of the table can be trusted. Capability | Patch My PC | CapaOne Platform | Third-party application patching | ✓ Curated catalog, automated packaging, since 2011 | ✓ Packaging, deployment, and automatic updates | Delivery to the device | Handled by ConfigMgr or the Intune Management Extension | ✓ CapaOne’s own agent | Runs without Microsoft management infrastructure | Requires ConfigMgr, WSUS, or Intune | ✓ Standalone, or alongside Intune | Operating systems for application patching | ✓ Windows and macOS | ✓ Windows | Custom in-house applications | ✓ Packaged in Patch My PC Cloud, published into ConfigMgr or Intune | ✓ Packaging and deployment | Privilege elevation | Not part of the platform | ✓ Policy-driven, through existing Entra ID groups | Bare-metal OS deployment | Not part of the platform | ✓ Cloud-native, no dedicated PXE server | Driver orchestration | Not part of the platform | ✓ Manufacturer-certified, model-aware, staged | Mobile device management | Not part of the platform | ✓ iOS, iPadOS, and Android | Vulnerability and configuration posture | ✓ CVE visibility in Enterprise Premium | ✓ CVEs mapped to affected endpoints, plus configuration drift | Endpoint reliability and performance | Not part of the platform | ✓ Real-time experience monitoring | Pricing | ✓ Published: $3.50 per device per year, $3,500 annual minimum | ✓ Published: €1 per endpoint per month per product, five Windows products for the price of three | The Platform ### One Platform, Six Products CapaOne is built for the way modern, mid-market IT teams work — cloud-first, consolidated, and infrastructure-light. #### Application Manager Simplify packaging, accelerate deployment, and automate updates for third-party and line-of-business applications. Explore Application Manager #### Privilege Manager Enforce least-privilege with just-in-time elevation through existing Entra ID groups — and no standing local admin. Explore Privilege Manager #### Provision Manager Deploy Windows from bare metal in the cloud, with automated, manufacturer-certified driver orchestration. Explore Provision Manager #### Mobile Manager Unify enrollment, configuration, compliance, and app delivery across iOS, iPadOS, and Android. Explore Mobile Manager #### Security Monitor Surface configuration drift and vulnerability insight across every endpoint in the fleet. Explore Security Monitor #### Experience Monitor Track endpoint reliability and performance in real time to improve the day-to-day user experience. Explore Experience Monitor #### One Agent per Endpoint A single agent reduces complexity, improves stability, and speeds up troubleshooting. #### Cloud-Native by Design Zero-touch, remote rollout that scales and supports hybrid work — with no on-premise servers to run. #### EU-Built, EU-Hosted Data stays in Europe, with no transfer of endpoint data to US jurisdiction. The Gap ### The Five Jobs Next to Patching A fleet where every third-party application is current is a fleet that has solved the part everyone talks about. The remaining work is quieter. It shows up when a laptop dies on a Tuesday, when a developer needs to install something the policy did not anticipate, when a phone walks out of the building, or when a machine has drifted three settings away from the build it shipped with. None of those are patching problems, and none of them are solved by patching well. They are separate purchases, each with its own console, its own agent and its own renewal date — and in a team of five to twenty people, each one also costs an afternoon of somebody’s attention every month. CapaOne covers them because they run on the same engine as the patching. A machine provisioned by Provision Manager arrives with its privilege policy already applied. A vulnerability Security Monitor finds closes through an Application Manager workflow. The work does not move between consoles, because there is only one. #### The Laptop That Died on a Tuesday Provision Manager builds it back from bare metal, with the right drivers for that model, without an imaging server standing by. #### The Install the Policy Did Not Anticipate Privilege Manager grants time-limited elevation through existing Entra ID groups, with no standing local admin and a full audit trail. #### The Phone That Left the Building Mobile Manager enrolls, configures and wipes iOS, iPadOS and Android devices from the same console as the Windows fleet. #### The Three Settings That Drifted Security Monitor names the machines a given CVE applies to, and flags the ones whose configuration no longer matches the build they shipped with. #### The Crashes Nobody Reported Experience Monitor scores every Windows endpoint on its critical events, errors and warnings, so the unstable laptop is found before its user gives up and calls. Business Impact ### What It Means in Practice What mid-market IT teams gain when they consolidate onto CapaOne. 6 Products in One Platform One agent, one console, one contract — across patching, privilege, provisioning, mobile, vulnerabilities, and experience. 150K+ Endpoints Under Management Proven at scale across European IT organizations. EU Built, Owned & Hosted Danish-built and EU-hosted, with support in your time zone. 30+ Years of Endpoint Experience A platform built on three decades of endpoint management practice. Went from 1,000+ missing updates to zero. The estate finally feels under control. Vordingborg Køkkenet, Manufacturing How It Works ### From Decision to Production in Four Steps 01 #### Connect Your Environment Deploy one agent and integrate with your existing Entra ID groups. 02 #### Consolidate Your Tooling Replace point tools across patching, privilege, provisioning, mobile, and security. 03 #### Pilot on Selected Devices Validate the platform on a limited set of endpoints before rolling out broadly. 04 #### Operationalize the Platform Run CapaOne as your endpoint platform — standalone, or alongside Intune. Compliance ### Compliance as the Result of Everyday Operations CapaOne turns routine endpoint work into continuous, demonstrable compliance — NIS2-aligned and GDPR-first. - Enforce least-privilege with just-in-time elevation and no standing local admin. - Keep every endpoint patched across the operating system and third-party applications. - Surface configuration drift and vulnerabilities before they become incidents. - Document control for audit with clear visibility across the entire fleet. - Keep endpoint data in Europe, with no transfer to US jurisdiction. #### Always Up to Date Automated patching closes security gaps across OS and applications. #### Least-Privilege Just-in-time elevation through existing Entra ID groups, with full logging. #### Audit-Ready Clear visibility and logging across every managed endpoint. #### European Data Sovereignty EU-built and EU-hosted. Your endpoint data stays in Europe. FAQ ### Frequently Asked Questions Still weighing your options? Talk to our team → **Is CapaOne a Patch My PC Alternative?** For third-party application patching, yes — CapaOne Application Manager packages, deploys, and updates third-party applications with its own agent. If you also carry provisioning, privilege control, mobile management, or vulnerability posture on separate contracts, CapaOne replaces those as well. If you manage macOS applications today, weigh that difference directly: Patch My PC covers Windows and macOS, and CapaOne Application Manager covers Windows. **Does Patch My PC Require Microsoft Intune or ConfigMgr?** Yes. Patch My PC packages applications and publishes them into ConfigMgr, WSUS, or Intune, and delivery to the device is handled by Microsoft’s own components. CapaOne carries its own agent and console, so it runs with Intune or entirely without it. That is the clearest difference between the two. **Where Do CapaOne and Patch My PC Overlap?** On third-party application patching. Both automate packaging and updating of third-party applications, and both maintain a catalog so IT teams do not repackage the same installer every month. The overlap is genuine, and an organization that needs only third-party patching has two reasonable options. **How Does CapaOne Pricing Compare to Patch My PC?** Both vendors publish their prices. Patch My PC charges $3.50 per device per year with a $3,500 annual minimum covering up to 1,000 devices. CapaOne charges €1 per endpoint per month per product, with five Windows products for the price of three and a €1,500 minimum annual contract. For third-party patching alone, Patch My PC works out cheaper at most fleet sizes. The comparison changes when provisioning, privilege, mobile, and vulnerability posture sit on separate contracts beside it. **Which Operating Systems Does CapaOne Support?** Mobile Manager covers iOS, iPadOS, and Android. Application Manager, Provision Manager, Security Monitor, and Experience Monitor cover Windows, and Privilege Manager covers Windows client and Windows Server. **What Does CapaOne Cost to Implement?** Nothing beyond the subscription. CapaOne runs as a cloud service with one agent and no on-premises servers, and deployment does not require implementation consultants. You run real actions on day one, in under 30 minutes. **Does CapaOne Work With Microsoft Intune?** Yes, and it also runs entirely without it. CapaOne is a complete endpoint management platform on its own, and it integrates with Intune where an organization already runs it. **Where Is CapaOne Built and Hosted?** CapaOne is built in Denmark by CapaSystems A/S and hosted in the EU, with no transfer of endpoint data to US jurisdiction. Support runs in Danish or English, in your time zone. ### Count the Contracts, Not Just the Licenses A specialist is the right purchase when the specialty is the whole problem: if Microsoft’s management layer already runs underneath your fleet and applications are the last thing you patch by hand, Patch My PC will do that job well for years. The calculation changes the day the second contract arrives, and then the third — when the question is no longer which tool patches best, but how many consoles one team can keep in its head, and whether the vendor answering the phone is in your time zone and your language. Request a Demo Start Free Trial # Blog, case studies and guides --- URL: https://capaone.com/blog/endpoint-update-coverage-inventory-work-list/ Published: 2026-10-22 Summary: Endpoint update coverage shows which endpoints your update process misses. Turn the inventory into a weekly work list with CapaOne. ← All articles Blog ## Endpoint Update Coverage: Turning Your Inventory Into a Work List Your inventory already knows which endpoints your updates miss. The work is reading it that way. By CapaOne Support · October 22, 2026 Endpoint update coverage describes how far your updates actually reach: which endpoints run current versions of their applications, drivers and operating system, and which do not. IT teams usually already own the data behind it, because the endpoint inventory records what every machine runs. What they rarely own is a routine that turns that inventory into a short list of machines to fix this week. An inventory answers the question “what do we have?”. Update coverage answers a different one: “where do our updates not reach?”. The second question decides your exposure, and answering it means reading the same inventory in a different way. Coverage breaks in four places: outdated applications and failed patches, drivers with an available update, Windows versions nearing their end-of-updates date, and endpoints too quiet to scan. ### Why an Inventory Alone Doesn’t Give You Endpoint Update Coverage Raw inventory data describes. By itself, it tells you what each endpoint reported the last time it checked in. The work begins when you filter that data into exceptions that need action, and three things keep teams from getting there. Averages hide the gap. A fleet-wide patch figure can look healthy while one group of machines has missed every update since spring. The average tells you that most endpoints are fine. It does not tell you which ones are not. Each gap sits in a different view. Application versions live in one place, drivers in another, Windows versions on a dashboard and quiet endpoints in the device list. Nobody opens all four views on the same day, so nobody sees one machine that shows up in three of them. Nobody owns the list. Without a fixed filter and a fixed day, the review happens when an incident or an audit forces it. By then the gap has had months to grow. ### Four Places Where Endpoint Update Coverage Breaks The gaps fall into four groups, and each one shows up in the inventory in its own way. #### Outdated Applications and Failed Patches Outdated software builds up when an update fails, when a device misses a deployment window, or when nobody schedules the application at all. Some of those endpoints have an update waiting that nobody has installed yet. Others have a failed patch: an update tried to land and did not. We cover how application versions drift, and how a live application inventory exposes it, in a separate post. For update coverage, the point is simpler: every endpoint whose software is not up to date belongs on this week’s list, and the ones with failed patches deserve a closer look. #### Outdated Drivers with an Available Update Drivers drift by hardware model. One laptop model receives a new driver package, another keeps last year’s version, and nobody notices until a docking station stops working or a security advisory names the driver. A driver gap rarely announces itself, which is why it needs its own filter rather than a support ticket. Keep hardware models that your driver tooling does not support in a separate group, so “an update exists” never mixes with “nobody can tell for this model”. #### Windows Versions That Fall Behind Each Windows release follows a servicing lifecycle with an end-of-updates date that depends on the edition, and a device that stays on a release past that date stops receiving its monthly security updates. Microsoft’s Windows 11 release information lists November 10, 2026 as the end of updates for version 23H2 on Enterprise and Education editions. Pro editions follow a shorter cycle: version 24H2 Home and Pro reached end of updates on October 13, 2026. The upgrade itself usually belongs to whatever delivers Windows updates in your environment. The first step belongs to the inventory: knowing which endpoints still run the older version, and how many there are. #### Endpoints Too Quiet to Scan An inventory scan needs the endpoint to be online. A device that has gone quiet keeps the record it last sent, so it can look current while it runs software from months ago. These endpoints need their own routine, and stale devices covers how to find and sort them. On the weekly list, they mark the machines whose data you cannot yet trust. ### Turning Your Inventory into a Weekly Work List The work list is one saved view that shows every endpoint with at least one of the four gaps. In the CapaOne Endpoint Management Platform, you build it in the Windows endpoint list. Illustration, not a screenshot: four filters combined with OR give one saved work list. Endpoint names are examples. Five steps get you there: - Build one filter per gap. Software Up-to-Date negated for applications; add Failed Patch Count above zero when you want to isolate failed deployments. Driver Up-to-Date negated for drivers. OS Version set to the Windows release you want to retire, such as 23H2. Last Check-in older than your threshold for quiet endpoints. - Combine them with OR. Switching the word between two filters from AND to OR turns four narrow lists into one: every endpoint that has at least one problem. Build narrower lists as separate saved filters with AND: for example endpoints that have a failed patch and are online right now, so you can fix them today, or Driver Up-to-Date negated together with Driver Supported, so a known driver update never mixes with a model CapaOne cannot assess. - Save the filter and mark it as a favorite. The filter also lives in the page URL, so you can bookmark it or share it with a colleague who covers the list while you are away. - Refresh the relevant inventory before you act. Request a software scan for application gaps, a driver scan for driver status, or a security scan for Windows update data. If the endpoint is offline, CapaOne queues the request and runs it when the endpoint reconnects. - Prioritize by risk, then export. Start with the endpoints you can act on immediately, then rank the rest by risk and deadline. A failed security update or a Windows release close to its end-of-updates date may belong at the top. Select every endpoint that matches the filter and export the list to CSV at the end of the review, so next week’s list has something to compare against. Keep the review on a fixed weekday. A list that shrinks tells you the routine works. A list that grows points to a cause worth finding, such as a driver package that keeps failing on one model or an application that never made it into the update schedule. ### One Agent Behind All Four Gaps All four gaps trace back to one agent. The CapaOne agent on each endpoint reports software, hardware and drivers into one inventory, and the endpoint list shows the update status next to each machine. The software badge in the Updates column comes from Application Manager, and a red badge on the endpoint name shows how many patches failed. The driver badge and the driver updates on each endpoint’s Drivers tab come from Provision Manager. Security Monitor adds the security side, including a report on OS versions and missing Windows updates. Because the data comes from one agent, every filter describes the same machines in the same terms. That consistency is what makes endpoint asset management useful day to day: the coverage figures you report upward and the list you work from describe the same fleet. The few endpoint numbers leadership can use build on exactly this data. ### Where Intune Fits into the Work List CapaOne works with Microsoft Intune, or entirely without it. In environments where Intune delivers Windows updates, the CapaOne work list shows which endpoints still run a Windows release you want to retire, and Security Monitor reports which ones miss Windows updates. Applications, drivers and the operating system then sit side by side in one routine. Where CapaOne runs on its own, nothing about the list changes: the same filters, the same weekly review. ### What Changes When the List Runs Every Week Coverage stops being a percentage in a report and becomes a named list of machines. A failed update gets a second attempt within days instead of surfacing during an incident. A Windows version approaching its end-of-updates date shows up as a count you can plan around, not as a deadline you discover. And when someone asks which endpoints your updates do not reach, you can answer with a list instead of an estimate. Building the first list takes one filter per gap and one saved view. Book a demo of CapaOne Endpoint Management Platform for a walkthrough of the filters on a live fleet, or start a free trial and build your own work list hands-on. ### Frequently Asked Questions **What Is Endpoint Update Coverage?** Endpoint update coverage describes how far your updates actually reach across the fleet: which endpoints run current versions of their applications, drivers and operating system, and which do not. The useful output is not a percentage but a list of the endpoints that fall outside it, so IT knows which machines to fix next. **How Do I Find Endpoints That Are Missing Driver or Application Updates?** Filter the endpoint inventory on update status rather than browsing device by device. In CapaOne, the Windows endpoint list can filter on whether software and drivers are up to date, on failed patches, on OS version and on last check-in. Combine the filters with OR to get one list of every endpoint with at least one gap, then save the filter so the same list is one click away next week. **How Often Should IT Review Update Coverage?** Weekly is a practical starting cadence: often enough that a failed update gets a second attempt within days, and rarely enough that the review stays short. Open the same saved filter on a fixed weekday, so the size of the list becomes a trend you can follow. Book a Demo → Start Free Trial --- URL: https://capaone.com/blog/endpoint-management-kpis-leadership/ Published: 2026-10-20 Summary: Five endpoint management KPIs leadership can act on, how to define them, and how CapaOne brings the data behind them into one console. ← All articles Blog ## Endpoint Management KPIs: The Few Numbers Leadership Can Use Leadership doesn't need forty charts about the fleet. It needs five numbers it can trust, counted the same way every quarter. By CapaOne Support · October 20, 2026 Endpoint management KPIs are the few numbers about your device fleet that leadership can make a decision on: how much of the fleet IT can actually see, how exposed it is, and whether that exposure is shrinking. Most IT teams collect far more data than that. The problem is rarely a lack of numbers. It is that the numbers reaching leadership change definition from one report to the next, so nobody can tell whether the fleet got better or the counting changed. ### Why Most Endpoint Management KPIs Never Reach Leadership Even a small IT team can end up working across several tools, each with its own dashboard. Operations reads the deployment console. Support reads the ticket system. Security reads the vulnerability scanner. Each view is accurate on its own terms, and each one counts the fleet differently. When a manager asks a simple question — how many of our laptops are up to date? — three teams can give three answers, all defensible. Leadership then hears a number that moves for reasons that have nothing to do with the fleet. After a few rounds of that, the numbers stop carrying weight, and decisions about budget and risk fall back on gut feeling. The fix is not a bigger report. It is a smaller one, built on numbers that hold still when nothing in the fleet has changed. ### Five Endpoint Management KPIs Leadership Can Act On A useful KPI is a single number that can go up or down between two reports, and it points to an action IT can take. These five cover the questions that come up most: can we see the fleet, is it patched, is it protected, how exposed is it, and is the rest of the stack current. #### 1. Agent Coverage: The Share of the Fleet That Still Reports In Every other number depends on this one. An endpoint that has gone quiet for weeks keeps its old state in the inventory, and it keeps counting toward every percentage you report. Count the endpoints that checked in within the last 30 days, and divide by the endpoints IT expects to manage — every device in scope, minus the ones IT has already retired or deliberately pulled from service. Dividing by the raw inventory would hide the very problem this KPI exists to find. If the share falls, every figure below it rests on devices IT can no longer see — the problem behind stale devices. #### 2. Endpoints Missing High-Risk Windows Updates Count the endpoints missing at least one Windows update that fixes a known CVE or carries a Microsoft Security Response Center (MSRC) severity rating of Critical or Important. Use the security severity rating, not the update classification: Microsoft also labels some non-security bug fixes as “critical updates”. Leave the total count of available updates out. It rises every month and tells leadership nothing about risk. A short count of seriously exposed endpoints does. #### 3. Endpoints Without Baseline Protection Three checks cover the basics: antivirus running with current definitions, the boot drive encrypted, and the firewall active. Count the endpoints that fail at least one of the three checks. A lost laptop with an unencrypted drive is a different conversation with leadership than one where IT can prove the drive stayed encrypted. #### 4. Vulnerability Exposure A list of every open CVE is a technical artifact, not a KPI, and even a top-five list cannot go up or down. Report one fleet-wide, severity-weighted exposure score instead, so that a few critical flaws count for more than many minor ones. Then show the five most severe vulnerabilities detected. The score tells leadership whether exposure is moving; the five tell IT where to act. If the same five appear quarter after quarter, that is a finding in its own right. #### 5. Application Patch Compliance This is an operational number about updates, not a regulatory one. Operating system updates follow a monthly rhythm. Third-party applications do not, and they drift quietly. Report the share of application patches that are up to date, and count anything available, pending, in progress, or failed as not current. Report driver compliance next to it as a supporting number, but keep the two apart: driver compliance only counts endpoints with supported hardware, so the denominators differ, and a combined figure would not hold up to a second look. When the number falls short, Application Manager, part of the CapaOne Endpoint Management Platform, closes the gap by keeping third-party applications current. #### The Five KPIs at a Glance KPI | How to count it | What leadership can decide on it | Agent coverage | Endpoints checked in within 30 days ÷ endpoints IT expects to manage | Whether the rest of the report holds, and where the inventory needs cleanup | High-risk Windows updates | Endpoints missing an update tied to a known CVE or with an MSRC rating of Critical or Important | Whether patching keeps pace with risk, or the team needs more capacity | Baseline protection | Endpoints failing antivirus, boot-drive encryption, or firewall checks | Which protection gaps to close first | Vulnerability exposure | One severity-weighted exposure score for the fleet, with the five most severe CVEs alongside | Whether risk is falling, and which vulnerabilities get an owner and a deadline | Application patch compliance | Share of application patches up to date, with driver compliance alongside | Whether patching covers the whole stack, not only the operating system | Each of these can go deeper when a specific risk calls for it. Privilege is the clearest example: the metrics worth tracking after a role change give leadership a separate view of who holds admin rights and why. ### Keep the Numbers the Same Across Operations, Support, and Security Five good KPIs still fail if each team calculates them differently. Three rules keep them stable. One source of data. Pull every KPI from the same platform, not from five consoles stitched together in a spreadsheet. When operations, support, and security look at the same data, a disagreement about the number becomes a discussion about the fleet. IT at Holbæk Municipality works this way: around 30 IT employees across digitalization, operations, and support use the same system and the same dashboard, and with it the same terminology. One definition per number. Agree once what counts as “reporting in”, which updates count as high-risk, and which devices are in scope. Write the definitions down and keep them next to the report. One point in the cycle. Take each quarterly snapshot at the same point in the patch cycle — for example, the same number of business days after Microsoft’s monthly security release. A snapshot two days after release and one three weeks after can differ sharply while the team performs exactly the same. Keep every earlier snapshot, so leadership sees direction over time and IT can show exactly what changed. Illustration with example numbers, not measured data: the same fleet and the same team, measured 2 and 21 days after the monthly security release. ### Where CapaOne Shows Each Number CapaOne, the Danish-built endpoint management platform, brings the data behind all five KPIs into one console. It runs as a complete platform on its own. No single built-in report produces the five numbers exactly as defined here, but each one has a clear place to read it: - Agent coverage: filter the Windows endpoint list on last check-in to find the endpoints that went quiet. - High-risk Windows updates: Security Monitor rates each endpoint’s Windows updates as Poor when a missing update has a linked CVE or an MSRC rating of Critical or Important. - Baseline protection: Security Monitor checks antivirus, encryption, and firewall on every endpoint and rates each check Good, Fair, Poor, or None when it cannot collect the data. - Vulnerability exposure: the security dashboard shows Overall Exposure, a score from 0 to 10 that averages each endpoint’s severity-weighted CVE score, next to the most severe vulnerabilities detected. - Application patch compliance: the security overview shows the share of application patches that are up to date and, separately, driver compliance for endpoints with supported hardware. The built-in security report carries missing Windows updates, antivirus, encryption, firewall status, and the top five detected CVEs. It exports to Excel for leadership or CSV for further analysis, and CapaOne archives every export with its format, its date, and the person who ran it. That archive is the quarterly record: download last quarter’s export and compare it with this one. Record agent coverage, the exposure score, and the patch percentages at the same moment, so all five numbers come from the same snapshot. See how the pieces fit together on the reporting and monitoring page. ### What Changes When Leadership Gets the Same Numbers Every Quarter - Leadership sees five numbers instead of five dashboards, and each one comes with an action. - Operations, support, and security argue about the fleet, not about whose count is right. - A number that moves means the fleet moved, because the source, the definition, and the point in the cycle stayed the same. - IT can show progress over a year with snapshots that already exist, instead of rebuilding history before a board meeting. A short report that holds still earns more trust than a long one that changes shape every quarter. Book a demo of CapaOne Endpoint Management Platform to see the data behind the five KPIs on your own fleet. ### Frequently Asked Questions **Which Endpoint KPIs Should IT Report to Leadership?** Report a short set that leadership can act on: agent coverage, meaning how much of the fleet still reports in, how many endpoints miss high-risk Windows updates, how many lack basic protection such as antivirus, disk encryption or an active firewall, a fleet-wide vulnerability exposure score, and application patch compliance. Each number should come from the same source, with the same definition, every time, so the trend means something. **How Often Should IT Report Endpoint Metrics to Management?** Quarterly is a practical cadence for many leadership reports. It shows direction without reacting to daily noise, and IT can still escalate a single number between reports when it moves sharply. Take each snapshot at the same point in the patch cycle, such as the same number of business days after Microsoft's monthly security release, so each report compares like with like. **Why Do IT Teams Report Different Numbers for the Same Fleet?** Usually because each team counts from its own tool, at its own time, with its own definition of a managed device. Operations may count every device in the inventory, support only the ones that raised tickets, and security only the ones its scanner reached. One shared data source and one agreed definition per number remove most of the disagreement. Book a Demo → --- URL: https://capaone.com/blog/endpoint-performance-monitoring-guide/ Published: 2026-10-20 Summary: Endpoint performance monitoring that finds the Windows errors behind repeat tickets, so you fix the cause once. Free eBook from CapaOne. ← All whitepapers eBook ## Endpoint Performance Monitoring: Fix the Pattern, Not the Ticket How IT teams move from closing the same ticket twice to fixing the pattern behind it By Rikke Borup, CMO, CapaSystems · October 20, 2026 Endpoint performance monitoring finds the faults behind helpdesk tickets — often before users report them — and on Windows, the evidence usually exists already. Every device logs its crashes, application failures, errors, and warnings. Most IT teams never read those logs across the fleet, so they fix the same fault one ticket at a time. ### One Fault, Many Tickets Picture a typical week: three tickets about the same crashing application, handled by three technicians on three different days. Each technician closes a ticket. None of them sees the shared cause — one driver, update, or third-party program that breaks the same thing on every device that carries it. For an IT manager, that is where the cost hides. The team spends its time on the same problem again and again, and no one can show leadership that the endpoint estate is getting more stable. Performance covers many things, but crashes and errors are where performance problems turn into tickets. This eBook focuses there: how to read what Windows already records, across every endpoint, and act on the patterns it shows. The starting point is concrete. Windows records each application crash as Event ID 1000, naming the faulting application and the faulting module. The eBook’s worked example follows one such crash from the first ticket to a verified fix. ### What You Will Learn - Why ticket-by-ticket troubleshooting keeps recurring faults alive - Seven pitfalls that let the same fault come back — and what to do instead - A five-step framework, from fleet-wide baseline to proven fix - A worked example that follows one crash from the event log to a verified fix - A four-level maturity model that shows where your team stands today - How operations and support can share one picture of endpoint health ### From Customer Practice Holbæk Municipality runs around 5,500 PCs, and its operations and support teams work from the same dashboards in CapaOne Experience Monitor, part of the CapaOne Endpoint Management Platform. When one Windows error kept returning, the team watched how often it showed up across different PCs — and traced it to a single third-party program. ### How CapaOne Supports Endpoint Performance Monitoring CapaOne brings endpoint performance monitoring into the same cloud platform IT teams use to deploy, update, and secure their Windows endpoints. Experience Monitor collects the critical events, errors, and warnings from the Windows system and application logs, gives each endpoint a reliability score from 1 to 10, and lists the devices with the most events. In the event log, IT teams filter a recurring error by source and event ID, and up to three months of score history show whether a fix held. Alongside it, the CapaOne hardware inventory shows each device’s components, including battery information. ### Frequently Asked Questions #### What Is Endpoint Performance Monitoring? Endpoint performance monitoring tracks how every laptop and desktop in the organization behaves in daily use, measured on the device itself — from speed and resource use to crashes, application failures, and the errors and warnings Windows logs. Instead of waiting for users to report problems, IT teams see which devices struggle, how often, and why, and can fix a recurring cause once rather than one ticket at a time. #### What Should IT Teams Measure First? Start with stability across the whole fleet: how many devices log critical events, errors, and warnings, and which devices log the most. A single score per device makes the fleet comparable at a glance, and a severity split shows where to look first. Measuring every endpoint matters more than measuring many metrics on a few. #### How Can IT Find Which Application Causes Repeated Windows Errors Across Many Devices? Start with the crash events Windows already logs. Each application crash names the faulting application and the faulting module. Filter on that crash across all endpoints, search for the module name, and list every device that logged it — then check what those devices have in common. Treat the module as a lead to test, not as proof. #### How Do You Monitor Windows Event Log Errors Across All Endpoints? Collect the critical events, errors, and warnings from the Windows system and application logs on every endpoint into one view, instead of reading Event Viewer one device at a time. CapaOne Experience Monitor does this for Windows endpoints: it splits events by severity, shows how many endpoints each one affects, lists the devices with the most events, and lets IT teams filter by event ID, source, and description. #### How Does a Reliability Score Help Prioritize Devices? CapaOne Experience Monitor gives each Windows endpoint a reliability score from 1 to 10, grouped into Good, Fair, Poor, and Unacceptable. The score drops as errors grow in number and severity, so IT teams can open the Poor and Unacceptable groups first and follow the trend for up to three months. #### Which Operating Systems Does Experience Monitor Cover? Experience Monitor covers Windows endpoints. It reads the system and application events that Windows logs on each device and turns them into stability insights across the organization. #### Can Experience Monitor Run Without Microsoft Intune? Yes. Experience Monitor runs as part of CapaOne and needs no other management tool. Organizations that run Microsoft Intune can use the two side by side: Experience Monitor shows how endpoints behave, and IT teams can target fixes through the Entra ID groups they already use. --- URL: https://capaone.com/blog/stale-devices-endpoint-inventory-drift/ Published: 2026-10-15 Summary: Stale devices skew endpoint reports. Find devices that stopped checking in, sort them, and keep one record per machine with CapaOne. ← All articles Blog ## Stale Devices: When Your Endpoint Inventory Drifts From Reality A device that stops checking in still looks managed. That is exactly the problem. By CapaOne Support · October 15, 2026 In endpoint management, stale devices are endpoints that still sit in your inventory but have stopped checking in with the platform that manages them. They look managed, they count toward every report, and nobody has heard from them in weeks. The inventory describes a fleet that no longer quite exists — and the gap widens a little every month that nobody checks. No IT team decides to let the inventory drift. It happens one device at a time. A leaver hands in a laptop, and it goes into a drawer instead of back to IT. A meeting-room PC loses its network cable. An agent stops starting after an update. A machine leaves the building for repair and comes back weeks later. Each event is small and ordinary, and none of them sends an alert. ### Why Stale Devices Skew Your Reports An endpoint inventory records what has reported in, not what exists. As long as every device checks in, the two match. When devices go quiet, the inventory keeps their last known state, even though it may no longer be current. That breaks three things IT relies on. Coverage numbers. Patch and configuration reports divide by the number of devices in the inventory. A device that has not reported for two months still counts, carrying whatever state it had when it went quiet. The report can look better or worse than the fleet really is, and nobody can tell which. Exposure. A device that stops checking in can no longer reliably receive the updates and policy changes delivered through its management platform. If it genuinely sits unused in a drawer, the immediate exposure stays low. If someone still uses it — off the network, with an agent that no longer starts — it is the least protected machine you own, and the one your reports know least about. Audits. An auditor who asks for the list of managed endpoints expects that list to match the hardware. Every stale record becomes a question you answer by hand, usually the week before the audit. The software side of the inventory shares the weakness, because you can’t patch what you can’t see: a record stays only as current as the last time the device reported it. ### How to Find Devices Not Checked In for 30 Days Finding stale devices takes a fixed rule, not a one-off cleanup. Four steps keep the rule honest: - Pick one threshold and keep it. Thirty days is a practical starting point: long enough to cover a normal holiday, short enough to catch a lost laptop while someone still remembers who had it. Treat it as a review threshold, not proof that anyone has abandoned the device. Allow for longer absences, such as parental leave, before you treat a device as lost. - Use last check-in, not online status. Online or offline describes this moment. Last check-in describes the past month. A device can sit offline over a weekend and still be healthy; a device whose last check-in was in August needs a closer look. - Run the list on a schedule. The same day every month turns the list into a trend. A list that grows from five devices to twenty tells you something about your leaver process or the health of your agents. - Treat the list as a queue, not a delete list. Every device on it needs a decision, and the right decision depends on why it went quiet. The Windows endpoint list in CapaOne, filtered on last check-in. Endpoint names are blurred. ### What to Do With Each Device on the List Most stale devices fall into one of four groups, and each group needs a different action: - Still in use, agent not reporting. The riskiest group. Find the device, repair or reinstall the agent, and confirm that it checks in again. Until it does, assume the platform cannot keep it current. - Parked or forgotten. A laptop in a drawer, a spare in a cupboard, a leaver’s device that never came back. Recover the hardware and decide whether it returns to the pool or retires. - Rebuilt under a new identity. If a tool registered the rebuilt machine as a new record, the old record is a duplicate. Remove it so your reports count the machine once. - Retired. The hardware no longer exists. Remove the record and note the retirement in your asset register, so the next audit has an answer. The inventory tells you which device went quiet and when. Who last had it usually comes from your leaver process or your asset register, so keep both close to the list. Disable before you delete wherever your tools allow it. A false positive costs little to undo while the record still exists, and a lot once it disappears. ### How CapaOne Keeps One Machine as One Record The CapaOne Endpoint Management Platform shows when each Windows endpoint last checked in, next to its agent status, in the endpoint list. IT can filter that list — for example, on every endpoint that has not checked in for 30 days — and export the result to CSV for the asset register or the audit file. CapaOne keeps the filter in the page URL, so the monthly check can live in a single bookmark. CapaOne builds its reports from the latest inventory each endpoint has sent, and its documentation is explicit that endpoints that have not checked in recently may have stale data. That is why Last Check-in sits next to every endpoint. CapaOne also blocks deletion while an endpoint is online, so a cleanup cannot remove a device that is actively reporting. When a machine enrolls, CapaOne creates a hardware hash and identifies the machine by it. Each machine therefore exists as one record. That keeps the fleet count behind endpoint asset management tied to real hardware, and it means the reports you hand to management describe the fleet you actually run. ### Stale Devices With or Without Intune CapaOne works with Microsoft Intune, or entirely without it, and the stale-device routine works the same way in both setups. Organizations that run Intune have a cleanup feature of their own. Intune device cleanup rules hide devices that have not checked in for a set period between 30 and 270 days, and a preview lists the devices a rule affects. The rules hide records in Intune; they do not remove the devices from Microsoft Entra ID. Directory-side duplicates are a separate case. Microsoft’s guidance on stale devices in Entra ID lists duplicate device objects after an OS reinstall, reimage, or recovery as a common sign of stale devices, and recommends disabling a device for a grace period before deleting it. Inside CapaOne, the hardware hash keeps each machine as one record, whatever happens to its directory object. ### Make the Check a Monthly Habit A stale-device list that runs every month changes what the inventory is for. The coverage numbers describe the devices that actually report. The device most likely to miss updates shows up as a name on a list instead of as a surprise during an incident. And the audit question about managed endpoints has an answer that already exists. Start this month: pull every device that has not checked in for 30 days and sort it into the four groups. Book a demo of CapaOne Endpoint Management Platform to see the endpoint list and the 30-day filter, or start a free trial and run the check on your own fleet. ### Frequently Asked Questions **What Are Stale Devices?** In endpoint management, stale devices are endpoints that still appear in an inventory but have stopped checking in with the platform that manages them. They keep their last known state, so they count toward patch and coverage reports while nobody can see what they actually run. A fixed threshold, such as 30 days without a check-in, turns them into a list IT can work through. **How Do I Find Devices Not Checked In for 30 Days?** Filter the device inventory on last check-in rather than on online status, and set the cutoff at 30 days. In CapaOne, the Windows endpoint list shows when each endpoint last contacted the platform, and IT can filter on it and export the result to CSV. Run the same filter on the same day every month, so the list shows a trend rather than a snapshot. **Should IT Delete Stale Devices Right Away?** No. Sort each device first: still in use with an agent that stopped reporting, parked, rebuilt under a new identity, or retired. Only retired machines and true duplicates should lose their record, and disabling before deleting makes a false positive easy to undo. CapaOne only deletes an endpoint while it is offline, so a cleanup cannot remove a device that is actively reporting. **Why Is a Device That Stopped Checking In a Security Risk?** A device that stops checking in can no longer reliably receive the updates and policy changes delivered through its management platform. If nobody uses it, the risk stays small. If someone does — off the network, or with an agent that no longer starts — it becomes the least protected machine in the fleet and the one IT knows least about. Book a Demo → Start Free Trial --- URL: https://capaone.com/blog/elevation-on-shared-devices/ Published: 2026-10-13 Summary: CapaOne handles elevation on shared devices through the signed-in identity — without permanent or shared local administrator accounts. ← All articles Blog ## Elevation on Shared Devices: How to Avoid Shared Admin Accounts The machines with the most users often end up with the loosest privileges. It does not have to work that way. By CapaOne Support · October 13, 2026 Least-privilege projects assume one person per device. Almost every estate contains machines that break the assumption: the kiosk at reception, the PC in the lab, the terminal on the production line, the laptop that three people share across a shift rota. Elevation on shared devices rarely appears in the project plan, and the machines end up carrying the exception nobody wanted to write. ### The Shared Administrator Account Problem The exception usually takes the same form. Somebody creates a shared local administrator account “for the shared ones,” the credential circulates among the people who need it, and the machine drops out of the privilege model entirely. The devices with the most users end up with the loosest rights. ### Why Elevation on Shared Devices Looks Hard The difficulty feels structural. If a policy attaches to a person, and the machine has no single person, then the policy has nothing to attach to. That reasoning holds only as long as you treat the device as the unit of control. Meanwhile the shared machine collects every property you would rather avoid. A shared credential sits outside every joiner and leaver process, so nobody revokes it when the people who knew it move on. Shared devices also sit in the open — a reception desk, a workshop bench, a corridor — where anyone can reach a keyboard that holds standing administrative rights. And when an incident touches one of these machines, the audit trail names the shared account rather than a person, which turns a five-minute question into an investigation. None of that follows from sharing hardware. It follows from a workaround. ### The Machine Is Not the Unit of Control Identity is. When people sign in with Entra ID authentication, the person at the keyboard brings their own elevation scope with them, and the machine stops being the thing that decides. CapaOne Privilege Manager, part of the CapaOne Endpoint Management Platform, defines who can elevate what, where, and under which constraints — per user, group, device, or application. On a shared device, that first dimension does the work. The lab technician who signs in at eight and the service desk technician who signs in at four hold different scopes on the same hardware, because the policy follows the account rather than the asset tag. This is a different question from the one most privilege projects ask. A separate post covers privilege creep after a role change, where elevation drifts as someone’s job changes over time. Here the axis is space rather than time: the same person, several machines, and several people on each of them. Two design points matter more on shared devices than anywhere else. #### Configure the Settings per User Avoid relying on a single device-wide elevation scope. Combine the device context with user- or group-based policies, so different people hold different rights on the same endpoint. That combination is the requirement the whole approach rests on, and it is also what makes the model work: the moment the settings distinguish between users, the shared machine behaves like any other endpoint in your privilege model. #### Deny Rules Earn Their Keep Here Deny rules cover shells and unsigned installers. On a single-user laptop that protection is prudent. On a machine in a public corridor they are the difference between a scoped elevation and a general-purpose administrative console standing unattended. ### What Shared Devices Still Need From You Three practical considerations survive the change, and none of them argues against the model. Shared devices often sit on weaker networks — a production terminal on a congested segment, a kiosk on guest Wi-Fi. Decide deliberately how these machines should behave when the connection drops, rather than letting them inherit the setting you chose for laptops. Physical exposure deserves a shorter elevation window than you would set on a laptop that lives in someone’s bag. And the servers behind these workstations belong in the same conversation: Privilege Manager runs on Windows client and Windows Server, so the file server the lab PC talks to falls under the same model rather than a separate one. Privilege Manager works with Microsoft Intune, or entirely without it. The platform stands on its own and authenticates against Entra ID either way. ### Shared Device Privilege Checklist Work through this once per site, then once more after any change to who uses the machines. - Identify the shared endpoints. Kiosks, lab machines, production terminals, and workstations on a shift rota. Count them before you plan anything. - Find the shared administrator credentials. Look for local accounts that more than one person signs in with, and for passwords that live in a drawer or a note. - Scope elevation by user or Entra ID group. Decide which people need which rights, and let group membership carry the decision instead of a per-machine rule. - Add the device context on top. Shared machines can hold their own conditions alongside the identity scope — the two work together rather than replacing each other. - Pre-approve only what the work needs. Pre-approval works by executable name or app path, so keep the list to the tasks people actually run on that machine. - Set deny rules for high-risk tools. Shells and unsigned installers belong on that list, and each documented exception should name the work that requires it. - Shorten the elevation window. A machine in a public corridor deserves a tighter duration than a laptop that lives in someone’s bag. - Confirm an event traces to a person. Run one elevation, pull the log, and check that it names the individual rather than a shared account. If it does not, nothing else on this list matters. ### What You Get Back The shared administrator credential disappears, and with it the account that no offboarding process ever touched. The audit record changes character. Every elevation event carries the same set of fields — user, endpoint, executable name and app path, time, duration, outcome — and the whole record exports to CSV. On a shared device those fields answer the question that actually matters after an incident: not which machine, but which person. And the exception list gets shorter. Shared devices stop being the category you handle separately, which means removing standing local admin becomes a decision you can make for the whole estate rather than for most of it. ### Where to Start Count the machines in your estate that more than one person signs in to, and check how many of them still hold a local administrator account somebody created as a workaround. That number is usually higher than the team expects, and it is the clearest place to start, because each of those machines carries a credential outside every process you rely on everywhere else. Book a demo of CapaOne Endpoint Management Platform to see policy design for shared devices, or start a free trial and test the model on one shared endpoint. ### Frequently Asked Questions **How Does Elevation Work on a Device Several People Use?** Through the signed-in identity rather than the machine. When users authenticate with Entra ID, the person at the keyboard brings their own elevation scope to whatever device they sit down at, including devices they share with colleagues. **Can Two People Have Different Elevation Rights on the Same Computer?** Yes, provided you configure the settings per user rather than applying a single device-wide policy. A lab technician and a service desk technician can hold different scopes on the same terminal. **Do Shared Devices Need a Permanent Local Admin Account?** No, and that account is usually the weakest link in the estate. A shared credential sits outside every joiner and leaver process, so nobody revokes it when the people who knew it move on. **Does CapaOne Privilege Manager Run on Windows Server?** Yes. Privilege Manager runs on Windows client and Windows Server, so shared workstations and the servers behind them fall under the same privilege model. **What Should You Do About the Shared Admin Account You Already Have?** Treat it as the first item, not the last. Map who uses it and for which tasks, build the elevation policies that cover those tasks, and retire the credential once the policies carry the work. Book a Demo → Start Free Trial --- URL: https://capaone.com/blog/denmark-cyber-threat-level-high-endpoint-patch-status/ Published: 2026-10-01 Summary: Denmark's threat level for destructive cyberattacks is high. What IT managers should check on patch status, and where CapaOne fits. ← All articles Insights ## Denmark's Destructive Cyber Threat Level Is High: 5 Endpoint Questions SAMSIK lists client and software updates as a separate line in its advice. That line lands directly in endpoint operations. By Rikke Borup, CMO, CapaSystems · October 1, 2026 Denmark’s cyber threat level for destructive cyberattacks is now high, and the Danish Resilience Agency (SAMSIK) lists security updates twice in its advice: once for systems anyone can reach from the internet, and once for employees’ clients and software. The second line lands directly in endpoint operations. SAMSIK raised the level from medium to high on September 24, 2026, after sharpening its assessment within the medium level in June. The agency now considers it likely that Russia will attempt destructive cyberattacks against Denmark, and its threat assessment names wiper attacks and manipulation of operational technology as the forms these attacks most often take. For IT managers, the practical question is narrower than the headline: can the team show where its endpoints stand on that second line today? ### What the Higher Threat Level Means The assessment rests on three signals. Russia has become more willing to take risks, according to Denmark’s foreign intelligence service (FE). Denmark’s security service (PET) has observed concrete Russian planning and preparation of sabotage against Denmark. And destructive cyberattacks have already hit systems in European NATO countries within the past year. A wiper attack aims to delete or overwrite data until it becomes unavailable or impossible to restore. That is why SAMSIK’s advice includes offline backup of data and critical systems, and a test that the organization can restore from it. ### Why the Warning Reaches Beyond Critical Infrastructure The assessment names energy, water, and transport as examples of sectors where the threat from Russian state actors likely applies most, especially where operations depend on OT systems. It would be easy to read the change as a matter for utilities alone. SAMSIK says otherwise. Its main assessment states that the raised level applies across Danish society, though especially to organizations responsible for vital societal functions in critical infrastructure. It also assesses that pro-Russian hacker groups likely have relatively limited technical capabilities and therefore go opportunistically after systems with protection so weak that the attackers can find and enter them easily. One precision matters here. SAMSIK describes the threat from these groups as aimed particularly at equipment and systems with a low level of protection that attackers can reach directly from the internet. The broad reach is real, but the entry point the agency describes for these groups is not the employee laptop. ### What SAMSIK Recommends — and Which Part Sits on the Endpoint SAMSIK groups its guidance on protecting against destructive cyberattacks under three headings: prevent, detect, and handle attacks. The two update items sit side by side under prevention, with no ranking between them. The rest of the prevention list covers multifactor authentication on remote access, password hygiene, network segmentation, firewalls and access control, offline backup, and rehearsed incident response plans. Those controls matter, and most of them sit outside endpoint patching. The second update item is where endpoint teams carry direct operational responsibility. SAMSIK does not define software further. From an endpoint management perspective, the check should not stop at Windows itself: third-party applications, runtimes, browsers, and utilities all add to client exposure. Clients return in the agency’s advice on handling an attack. If an organization identifies a potentially destructive attack, such as a wiper, SAMSIK tells it to isolate affected clients and systems from the rest of the network. The employee laptop may not be where the opportunistic attacker enters, but the advice counts it among the machines an attack reaches. ### Five Questions to Answer This Week SAMSIK asks organizations to revisit their existing security measures now, because it may be too late to start work on countermeasures if the threat becomes more pronounced. For the endpoint share of that advice, five questions show where a team stands. #### Do We Know What Runs on Our Clients? A team cannot update software it does not know exists. That is the starting point for a live application inventory that closes the blind spot where exposure grows: Windows updates are easy to see centrally, while application versions usually are not. #### Are Third-Party Applications Current? Knowing the versions answers half the question. The other half is whether updates reach every endpoint without manual packaging, and whether the team can see which endpoints still lag behind. If each release still needs hand packaging, the backlog grows exactly when the threat level rises — the argument for automating Windows and app patching before the next warning. Drivers sit outside SAMSIK’s wording, but they belong to the same endpoint hygiene, because drivers that were right at deployment drift into crashes and support tickets over time. #### Which Gaps Close First? Few teams can patch everything at once, and a higher threat level makes the order matter more. SAMSIK does not rank its two update items. Its assessment describes the threat from pro-Russian groups as aimed particularly at poorly protected systems that attackers can reach from the internet, which argues for putting those first, with clients on the same list rather than after. Within the client fleet, known exploitation, such as a listing in CISA’s Known Exploited Vulnerabilities catalog, is a stronger signal than a CVSS score alone, and ranking by risk rather than working down a list that never clears keeps the effort on the flaws attackers exploit. #### What Happens to What We Cannot Patch? Some endpoints will not take this week’s update: a line-of-business application breaks, or a vendor fix has not shipped. For those machines, compensating controls hold the exposure at an accepted level until the permanent fix lands, and they stay temporary by design. #### Can We Show Where We Stand? When leadership asks what the higher threat level means for the organization, “we patch regularly” does not answer the question. The answer is a current view of patch status across the fleet: which endpoints run current versions, which still carry open exposure, and what the team closes next. ### Where CapaOne Endpoint Management Platform Fits CapaOne Security Monitor, part of the CapaOne Endpoint Management Platform, maps CVE risk across applications, drivers, and configurations to the endpoints it affects, and exports reports the team can hand to leadership or auditors. SAMSIK also asks organizations to close the vulnerabilities an attacker exploited before they restore from backup. Identifying the exploited flaw is incident-response work, but closing it across the fleet requires knowing which endpoints still carry it, and Security Monitor shows that. For third-party software, Application Manager automates patching across a curated catalog: it skips endpoints that already comply and remediates the ones that do not. Provision Manager keeps manufacturer-approved driver versions current after deployment. For application vulnerabilities, teams trigger updates directly from a Security Monitor finding, so remediation runs through the same platform that found the exposure, which is the approach behind finding every exposure and fixing what matters first. CapaOne addresses the visibility and third-party patching part of SAMSIK’s client advice. The rest of the list, from multifactor authentication and segmentation to backup and incident response, calls for other controls, and a credible response plan names them separately. ### A Higher Threat Level Is a Test of Visibility The change on September 24 did not change what good endpoint patching looks like. It raised the cost of any patching that has fallen behind. An organization that can answer the five questions quickly and from current data has operational visibility. One that has to assemble the answers by hand across several systems has a visibility problem, and the higher threat level makes that the more urgent gap to close. To see what that view looks like across your own fleet, book a demo of CapaOne Endpoint Management Platform. ### Frequently Asked Questions **What Does Denmark's High Cyber Threat Level Mean for IT Teams?** The level that rose is the threat level for destructive cyberattacks. SAMSIK, the Danish Resilience Agency, now considers it likely that Russia will attempt such attacks against Denmark, most often as wiper attacks or manipulation of operational technology. For IT teams, SAMSIK's guidance asks for security updates on internet-facing systems and on employees' clients and software, alongside multifactor authentication, network segmentation, and offline backup. **Does SAMSIK's Warning Apply to Organizations Outside Critical Infrastructure?** Yes. SAMSIK states that the raised level applies across Danish society, though especially to organizations responsible for vital societal functions in critical infrastructure such as energy, water, and transport. It also assesses that pro-Russian groups go opportunistically after poorly protected systems that attackers can reach from the internet. **How Should a Mid-Sized Organization Prioritize Patching After the Threat Level Rose?** Start with what attackers can reach and what they already exploit. SAMSIK's threat assessment describes pro-Russian groups as going after poorly protected systems they can reach directly from the internet, so those systems belong at the front of the queue. Within the client fleet, vulnerabilities with known exploitation, such as those in CISA's Known Exploited Vulnerabilities catalog, come ahead of the rest of the CVE list, and third-party applications belong in the same queue as the operating system, because SAMSIK names clients and software in the same update item. **Should IT Teams Patch Internet-Facing Systems or Employee Laptops First?** SAMSIK does not rank them. Its guidance lists security updates for internet-facing systems and for employees' clients and software as two separate prevention items, both part of the same list. Its threat assessment describes the threat from pro-Russian groups as aimed particularly at poorly protected systems that attackers can reach directly from the internet. **How Does CapaOne Help With Patching After the Threat Level Rose?** CapaOne Endpoint Management Platform addresses the visibility and third-party software part of SAMSIK's client advice. Security Monitor maps CVE risk across applications, drivers, and configurations to the endpoints they affect, Application Manager automates third-party patching, and Provision Manager keeps drivers current after deployment. SAMSIK's other recommendations, such as multifactor authentication, network segmentation, and backup, call for other controls. Written by Rikke Borup CMO, CapaSystems Rikke is Chief Marketing Officer at CapaSystems, where she has led marketing and communications since 2009. With more than 17 years of experience in the IT sector — including cybersecurity, endpoint management software and IT services — she brings long-standing, practical insight into the challenges facing modern enterprise IT environments. Trained as a journalist, Rikke specializes in translating complex technical concepts into clear, easy-to-understand communications for IT decision-makers. More from Rikke Borup → LinkedIn ↗ Book a Demo → --- URL: https://capaone.com/blog/endpoint-privilege-lifecycle-role-change/ Published: 2026-09-29 Summary: Role changes create privilege creep. CapaOne ties the endpoint privilege lifecycle to the Entra ID groups your organization already maintains. ← All articles Blog ## Endpoint Privilege Lifecycle: Privilege Creep After a Role Change Most privilege policies handle the day someone joins. Very few handle the day their job changes. By CapaOne Support · September 29, 2026 Organizations design endpoint privilege around the day someone joins. The onboarding checklist covers accounts, groups, applications, and the elevation policy that goes with the job. The endpoint privilege lifecycle gets real attention at exactly one moment — and then it stops. The day someone changes role gets no equivalent checklist. A developer moves into finance. A service desk technician joins the network team. A project manager takes over a department. Their access to files and applications follows a process, because someone notices when it breaks. Their ability to elevate on the endpoint follows nothing, because nothing breaks. The user keeps working. The old permissions stay. Over time this produces privilege creep: users accumulate permissions from previous roles and keep them long after the work that justified them ends. Every individual grant looked reasonable on the day someone made it. The accumulation never did. ### Where the Endpoint Privilege Lifecycle Breaks A role change produces no error message. That is the entire problem. Nobody disputes the governance principle, and our case study on insider threat covers what it costs when an organization ignores it: when a role changes, access should change with it. This post takes the next question. The principle does not enforce itself, and knowing that access should move tells you nothing about what makes it move. When someone loses access they still need, they open a ticket within the hour. When someone keeps access they no longer need, they never mention it — often they never notice. The gap closes only when a person goes looking for it, and most IT teams have no trigger telling them to look. Standing local admin rights turn creep into a permanent condition. Rights that never expire survive every reorganization, every internal move, and every promotion in the organization. Ten years of role changes leave behind a set of permissions that maps to nobody’s current job. Auditors find these accumulations easily, because the pattern shows up the same way every time: long-tenured employees hold the broadest privileges, and no document explains why. #### From Identity Governance to the Endpoint The standards bodies treat role change as its own trigger rather than a footnote to offboarding. CIS Safeguard 6.2 asks organizations to revoke access on role change, not only on termination, and the rationale behind CIS Control 6 names two causes directly: access that lingers as people move between roles, and local administrator rights on user laptops. That framing draws a clean line. Identity governance sets the rule — access follows the role. Endpoint privilege management has to carry the same rule down to the device, where elevation rights live and where nobody notices when they stop matching the job. Most organizations enforce the first half through their directory and leave the second half to memory. Removing standing admin narrows the problem. It does not close it. Time-bound elevation stops rights from lasting forever, but a policy that grants the wrong scope still grants the wrong scope every time someone triggers it. ### Group Membership as the Control Point The practical fix is structural. Scope elevation policies to groups rather than to people, and the role change becomes the moment your privilege model updates. CapaOne Privilege Manager, part of the CapaOne Endpoint Management Platform, defines who can elevate what, where, and under which constraints — per user, group, device, or application. Policies target Entra ID groups directly and respect the group structure you already maintain, so the identity system that already reflects someone’s job can also drive what they elevate on the endpoint. When elevation policies point at groups, changing someone’s group membership changes which policies apply to them. The directory carries the decision, so nobody rewrites a privilege rule for every internal move. Confirm the behavior against your own group structure before you rely on it, and design for the two cases below, which follow different rules. Removing standing admin is the starting point, not the destination — our solution page on endpoint privilege management covers that step. #### Per-User Exceptions Every exception you write for an individual attaches to that individual and outlives their job. These exceptions accumulate faster than teams expect, because each one solves a real problem on the day someone writes it. Record the reason next to every exception, and treat the absence of a reason as a signal to remove it. #### Pre-Approved Applications Privilege Manager lets you pre-approve applications by executable name or app path. That mechanism removes friction for routine work, and it describes a task rather than a person. A pre-approval that made sense for one team may make no sense once the person triggering it works somewhere else — so check pre-approvals against the roles that actually use them, not against the roles that requested them. ### Role Change Review Checklist Run this when someone moves, and run it across the affected teams after a reorganization. - Confirm the new group membership. Check that the person sits in the groups their new role requires, and that those groups carry the elevation policies you expect. - Remove the legacy group memberships. Adding the new groups without removing the old ones is the single most common cause of privilege creep. - Find the per-user exceptions that name them. These survive every group change. Read the reason you recorded, and delete the exception if the reason no longer applies. - Review the pre-approved applications their new policies allow. Ask whether the new role genuinely needs each one. - Check the elevation durations. A task that took twenty minutes in the old role may take two in the new one. Shorten the window where the work changed. - Read the last month of elevation activity. Elevations that fit the old job and not the new one tell you which policy to look at first. - Export the evidence. Privilege Manager captures user, endpoint, executable name and app path, time, duration, and outcome for every elevation event, and exports the record to CSV. Keep the export from before and after the move. - Set a follow-up. Book a second look thirty days later. New roles reveal requirements the first review misses, and unrecorded workarounds appear in that window. Steps 6 and 7 need evidence rather than memory. Filter the CSV export to the people who moved, sort by executable, and read it next to a list of their current groups. Anything triggered by an application their new role does not use marks a policy that has outlived its purpose. ### Metrics Worth Tracking The heading matters more than it looks. Governance arguments lose to budget arguments because they arrive without numbers, and every figure below comes out of data your team already holds. - Standing local admin accounts across the fleet. The headline number, and the one a board understands without translation. - Per-user elevation exceptions. A rising count tells you the group model needs work rather than more exceptions. - Age of the oldest per-user exception. An exception should cover a temporary need. This number shows whether yours do. - Share of elevation policies scoped to groups rather than individuals. Your best single indicator of whether privilege follows the organization. - Average elevation duration. Shorter windows mean tighter scope, and the trend matters more than the absolute figure. - Elevation events that fall outside the user’s current role. The direct measure of privilege creep, and the one that needs the CSV export. - Role changes reviewed within thirty days. Turns the checklist above into something you can report on. Track these quarterly rather than continuously. The point is the trend line, not the daily number, and a quarterly cadence survives contact with a busy team. Privilege Manager runs as a complete platform on its own, and it targets Entra ID groups whether or not you run Microsoft Intune alongside it. ### Where to Start Pick the last reorganization your organization completed and treat it as a test case. Pull the elevation log for the people involved, read it next to the groups they belong to now, and count the mismatches. That number tells you whether your privilege model follows your organization or lags behind it. A mature least-privilege model does not end at removing local admin rights. It holds when elevation permissions keep matching what people actually do, through every internal move the organization makes. Getting the first part right takes a project. Keeping the second part right takes a structure. Book a demo of CapaOne Endpoint Management Platform and we will walk through elevation policy design against your own group structure. ### Frequently Asked Questions **What Is Privilege Creep?** Privilege creep describes what happens when a user accumulates permissions from previous roles and keeps them after the work that justified them ends. Each individual grant looked reasonable at the time. The accumulation never did. **What Happens to Elevation Rights When an Employee Changes Role?** It depends on how you target the policy. Scope elevation policies to groups, and moving someone between groups changes which policies apply to them. Scope them to individual users, and the old permissions stay until someone edits them by hand. **Do Per-User Elevation Exceptions Follow a Role Change?** No. An exception you wrote for one person stays attached to that person, not to their job. Treat every per-user exception as an item you will need to revisit, and note why you created it. **How Can You Tell Which Elevation Policies a Role Change Left Behind?** Export the elevation log to CSV, filter it to the people who moved, and read it next to their current group membership. Elevation activity that matches nobody's present responsibilities points you at the policies worth reviewing first. **Does a Role Change Justify Granting Local Admin Rights Temporarily?** It rarely does. A new role needs specific applications and tasks, not full control of the device. Scope the policy to what the new job actually requires and set a duration on it. Book a Demo → --- URL: https://capaone.com/blog/recurring-endpoint-management-tasks-small-it-team/ Published: 2026-09-24 Summary: Recurring endpoint management tasks consume the week in small IT teams. CapaOne moves the repetition to the platform so people handle exceptions. ← All articles Blog ## Recurring Endpoint Management Tasks: Where a Small IT Team's Week Goes Why the work that never finishes costs more than the work that does. By Rikke Borup, CMO, CapaSystems · September 24, 2026 Recurring endpoint management tasks — application updates, driver checks, privilege requests, audit evidence — consume most of the available hours in a small IT department, and they consume them again the following week. They never appear in a project plan, they rarely fail loudly enough to escalate, and they resist the two things a stretched team most wants to do: delegate them, or finish them. Ask an IT manager in a 300-person organization what the team worked on last week, and the answer rarely sounds like a plan. Applications needed updates. A batch of laptops needed drivers. Someone needed local admin rights for an installer, and someone else needed the same rights removed again. Someone had to assemble a report for an audit. None of it surprised anyone, and none of it ended. ### Where the Week Actually Goes The work that fills a small IT team’s week has a particular shape. It repeats on a rhythm nobody chose — vendors set it, and they are speeding up. Chrome moved from a four-week to a two-week major release cadence in September 2026, doubling the number of milestones an IT team has to absorb and verify. Hardware vendors release driver packages when they release them. Patch Tuesday arrives whether or not the team has capacity that month, and the vendor sets its size too, as June 2026 Patch Tuesday showed. The rhythm is external, it produces the same outcome every time it runs, and it happens whether or not anything else is happening. That shape matters, because it decides what you can do about it. Project work responds to prioritization — you can move it, split it, or stop it. Maintenance does not. Skipping a week of application updates does not remove the work; it moves it into next week and adds exposure while it waits. The volume also grows in a way that headcount does not. Every new application carries its own update cadence. Every new hardware model carries its own driver set. Every new compliance requirement carries its own evidence. A team that comfortably handled 300 endpoints meets a different problem at 700, even though no individual task became harder. One slice of that workload has hard numbers behind it. The Verizon 2026 Data Breach Investigations Report found that the median organization had 16 critical vulnerabilities on CISA’s Known Exploited Vulnerabilities list to patch in 2025, up from 11 the year before, while the median time to full remediation rose from 32 days to 43 days. Verizon points to the growing volume as what tipped the scales, while noting that remediation performance itself also slipped. ### Why Recurring Endpoint Management Tasks Resist Delegation The obvious answer to too much recurring work is to hand it to someone else. In a team of five to twenty people, that answer runs into three walls. The work spreads across roles. Patching sits with one person, provisioning with another, privilege requests with the service desk. Nobody owns the total, so nobody sees it as one workload. It is hard to hand over. A task that lives in someone’s routine — the check they run on Monday, the thing they remember to verify after a vendor release — has no written form. Handing it over means writing it down first, and writing it down is itself work that never reaches the top of the list. It looks small until you count it. The cadences in real setups are tighter than most teams estimate. One CapaOne customer runs third-party updates every hour and driver updates each evening at 18:00; another checks drivers and applications twice a day, at 10:00 and 14:00; a third updates third-party software twice daily and checks drivers three times a week. Done by hand, each of those is a standing appointment competing with everything else for the same hours. The result is a team that is busy without being able to say what it is busy with. That makes capacity conversations with leadership difficult, because the honest answer — that the work is real but diffuse — sounds like an excuse. ### What Changes When the Platform Owns the Repetition The alternative is not to work faster. It is to move the repetition off people and into a system that runs it on a schedule and reports what happened. Whether that actually returns hours depends on two things, and both are easy to get wrong. The workflows have to run without scripts. Otherwise the automation becomes code one person maintains on the side, and the team has traded a recurring task for a dependency on a colleague. And they have to run in one place. Otherwise each role still sees only its own slice, and nobody can answer how large the recurring workload is. The CapaOne Endpoint Management Platform meets both conditions. Third-party applications update on a cadence the team sets once through Application Manager. Drivers check themselves through Provision Manager, which also builds a device from bare metal when one arrives new or refuses to boot. Elevation stops being an errand, because Privilege Manager grants rights for a defined task and duration and takes them back without anyone remembering to. CapaOne works alongside Microsoft Intune, or entirely without it. ### What a Smaller IT Team Notices First The first change is not a number. It is that the Monday list gets shorter, and the items that remain are the ones that needed a person. Routine updates stop demanding the same manual attention, because the predictable path runs and reports itself. Ishøj Municipality manages more than 2,500 devices and states plainly that manual handling could not have kept pace with browser release frequency alone. Device builds stop blocking, because a machine can be rebuilt without someone carrying a USB key to it. Privilege requests stop interrupting, because the policy answers most of them. And audit preparation stops being a project, because the evidence accumulates while operations run. The scale of that shift is visible in the numbers one customer reported. When Vordingborg Køkkenet first implemented CapaOne, the dashboard showed more than 1,000 missing updates across roughly 200 endpoints. The daily number now sits consistently at zero — not because anyone works harder, but because the routine no longer runs through a person. What remains is exception handling — and exception handling is what a five-to-twenty person team is actually good at. Unified endpoint automation is not about removing people from the work. It is about making sure the work they do is the part that needs judgment. ### The Question Worth Asking One question separates a capacity problem from a staffing problem: how much of last week’s work will appear again next week? Open last week’s list and mark everything that repeats. Skip the tickets — tickets are the visible part, and most of them are exceptions. Mark the scheduled work: the update runs, the driver checks, the elevation requests, the reports nobody asked for but everybody expects. Then multiply each one by how often it runs in a year. The arithmetic is unforgiving. A thirty-minute review of an application update, run three times a week across 48 working weeks, costs 72 hours a year. That is one workflow out of a dozen. The task looks like thirty minutes; the year sees nearly two working weeks. One recurring task, priced by the year. The arithmetic is the argument: thirty minutes is what the task looks like, 72 hours is what the year sees. That annual number is the one worth taking to leadership, because it describes a system rather than a shortage. You solve a shortage with headcount. You solve a system once. Endpoint management built for mid-market teams starts from that arithmetic — from the assumption that the team is small and the device count is not. The fastest way to find out how much of that list the platform would take over is to watch it run on your own devices. Book a demo of the CapaOne Endpoint Management Platform — and bring the list. ### Frequently Asked Questions **Which Endpoint Tasks Should a Small IT Team Automate First?** Start with the tasks that repeat on a fixed rhythm and produce the same outcome every time: third-party application updates, driver checks, and the reporting that proves both happened. Automate the predictable path, then keep people responsible for the exceptions — compatibility problems, staged rollouts, rollbacks, and anything touching a business-critical application still needs judgment. **What Happens to Recurring Endpoint Work When Someone Leaves?** It depends on where the work lives. Tasks that run as scheduled workflows inside a platform survive a departure, because the next person inherits a system they can read. Tasks that live in one person's routine leave with them, and the gap usually shows up as a missed update rather than as an obvious hole. **Why Does Recurring IT Work Keep Growing?** Each new application, hardware model, and compliance requirement adds its own maintenance rhythm. Headcount grows in steps; maintenance grows with every addition. A team that handled the load at 300 endpoints meets a different problem at 700, even though nothing about the work changed. **How Do You Show Leadership Where IT Capacity Goes?** Measure the work that repeats, not the tickets that arrive. Count how often a task runs, how long it takes, and how often it fails. That turns a request for headcount into a description of a system, which is a conversation leadership can act on. Written by Rikke Borup CMO, CapaSystems Rikke is Chief Marketing Officer at CapaSystems, where she has led marketing and communications since 2009. With more than 17 years of experience in the IT sector — including cybersecurity, endpoint management software and IT services — she brings long-standing, practical insight into the challenges facing modern enterprise IT environments. Trained as a journalist, Rikke specializes in translating complex technical concepts into clear, easy-to-understand communications for IT decision-makers. More from Rikke Borup → LinkedIn ↗ Book a Demo → --- URL: https://capaone.com/blog/compensating-controls-unpatched-vulnerabilities/ Published: 2026-09-22 Summary: When no patch exists, compensating controls for unpatched vulnerabilities hold the risk down. How CapaOne supports that work. ← All articles Blog ## Compensating Controls for Unpatched Vulnerabilities on Endpoints Mitigation is not remediation — what an IT team does while the fix is out of reach By CapaOne Support · September 22, 2026 Somewhere in your estate sits a machine that will not take this week’s patch, and it will still sit there next month. Compensating controls for unpatched vulnerabilities are the measures an IT team puts in place while that stays true. They do not close the weakness. They make it harder to reach or less useful to an attacker, and they hold the exposure at a level the organization accepts until a permanent fix lands. The word that carries the weight is temporary. A compensating control stands in for the remediation you cannot apply yet. It never replaces it. Most guidance on endpoint vulnerability management assumes the patch exists and the only question concerns speed. Endpoint estates rarely behave that way, and the team still owns the risk on every machine that falls outside the assumption. ### Why Some Vulnerabilities Stay Open Three situations account for most of the endpoints that stay exposed after a scan. The vendor has not shipped a fix. The advisory is public, proof-of-concept code circulates, and the release notes say nothing. Nothing the IT team installs will help. The patch exists, but it breaks something. A case-management system depends on the exact runtime version the update replaces. The application owner tests it, an export function fails, and the rollout stops. The vulnerable version stays in production because the alternative is a department that cannot work. The device cannot take the update. A machine that drives production equipment and runs an operating system past its support window. An endpoint inside a change freeze. A laptop that connects for twenty minutes a week, never long enough to finish an install. ### Mitigation Is Not Remediation A scanner reports state, not judgment. After a compensating control goes in, the CVE still appears on the report, because the vulnerable build still sits on disk. Nothing about the control changes that line. What changes is the answer to a different question: can anyone reach this, and what happens if they do. That produces three states, and a report that does not separate them misleads whoever reads it. Vulnerable and exposed. The weakness sits there and nothing stands between it and an attacker. Vulnerable but mitigated. The weakness sits there, a named control interrupts the path, and someone owns what remains. Remediated. The weakness is gone — through a patch, an upgrade, a configuration change, a replacement, or retirement of the machine. Most teams track the first state and the third. The middle one is where the next six weeks of work actually live. A compensating control does not change what the scanner reports. It changes what an attacker can reach. The formal vocabulary is stricter than daily use. NIST describes a compensating control as one an organization puts in place instead of a control a baseline requires, giving equivalent or comparable protection. Endpoint teams use the phrase more loosely, for any temporary measure that buys time. Both senses demand the same discipline: write down what the control substitutes for, and what it leaves behind. ### A Practical Workflow for Compensating Controls for Unpatched Vulnerabilities Four steps, and the order does most of the work. #### Find the Exact Population A control that covers the whole estate costs more than it should and hides what it protects. A control that covers only the machines running the vulnerable build stays proportionate, and the team lifts it the moment that group no longer needs it. So the first question is not which control to apply. It is how many endpoints carry the affected build, and which ones. A CVE on a dashboard says the estate has a problem. Forty machine names say what the problem costs to contain. #### Work Out What the Exploit Needs Many vulnerabilities depend on preconditions you can name: a service reachable from the network, a feature nobody turned off, a file type that reaches a vulnerable parser, an account holding rights it never needed. Where the advisory documents those conditions, removing one of them cuts the exposure without touching the software. The Outlook Reading Pane attack vector shows the file-type case: the vulnerable Word rendering code ran as soon as Outlook previewed a malicious document. Where it does not, assume less. Some weaknesses need very little, and an advisory written for a dozen product versions rarely says which of its conditions apply to the build you run. #### Choose a Control That Interrupts That Path The useful control breaks the specific chain. It is not automatically the one that deploys fastest. The common options, roughly in the order they apply on endpoints: - Restrict who can reach the service — a firewall rule, segmentation, or removing the network path entirely. - Turn the vulnerable feature off, or reconfigure it out of the exploitable state. - Remove standing local admin rights, where the exploit or what follows it needs elevation — as with the relayed credential hash in CVE-2026-32202. - Control what executes — allowlisting, or deny rules for the script hosts and installers that exploits chain through. - Raise monitoring on the affected machines, so a failed attempt reads as something other than noise. - Isolate or retire the device, when nothing else lowers the risk far enough. Several of these sit outside endpoint tooling, and some belong to the network team. That is part of the point: the control follows the exploit path, not the org chart. #### Name the Residual Risk and the Exit Whatever the control leaves behind is residual risk, and it needs an owner and a decision — accept it for a stated period, strengthen the control, or take the machine out of service. Then write the exit condition next to the control, and make it a trigger rather than a date. This comes off when the vendor ships build 4.2, or when these forty endpoints report the fixed version. A control carrying only a review date turns into permanent configuration that nobody can explain, and six months later someone removes it during an unrelated cleanup because the reason no longer appears anywhere. ### How CapaOne Supports Compensating Controls for Unpatched Vulnerabilities CapaOne covers the endpoint side of this work: the population, the privilege layer, and the closing of the loop. Segmentation and network filtering stay where they already live. CapaOne Security Monitor, part of the CapaOne Endpoint Management Platform, maps CVEs to the endpoints that carry them and turns scope, severity and impact into a risk score. That answers step one. It also reports the security configuration each endpoint runs with — antivirus protection, disk encryption, firewall status, operating system update status, local administrator exposure and pending reboots. Two of those fields bear on this particular decision: firewall status and local administrator exposure. The rest describe posture rather than the exploit path, and keeping the difference straight matters the moment someone asks why a control went on one group of machines and not another. Privilege Manager handles the privilege step. It removes standing local admin rights and grants policy-based, time-limited elevation instead, and policy deny rules cover shells and unsigned installers. Application Manager closes the loop. Once the vendor ships a version that installs cleanly, affected endpoints move through the configured update workflow on policy, version posture shows which machines landed on the fixed build, and the control comes off on the trigger the team wrote down. The gain is not a shorter CVE list. The scanner reports what it reports. What changes is the middle state: a defensible account of which endpoints sit exposed, which sit mitigated and by what, and which have moved to remediated. That account is what an auditor, an insurer or a board actually asks for. Compensating controls belong in the same workflow as patching, not in a spreadsheet beside it. Book a demo of CapaOne Endpoint Management Platform to see the CVE-to-endpoint mapping and the posture fields on a real estate. ### Frequently Asked Questions **What Is a Compensating Control in Endpoint Security?** The term carries two senses. Formally, NIST describes a compensating control as one an organization puts in place instead of a control required by a baseline, giving equivalent or comparable protection. In everyday endpoint work the term covers something looser: a temporary measure that lowers the likelihood or impact of exploitation while a fix stays out of reach. Either way it leaves the vulnerability in place, so a permanent fix — a patch, an upgrade, a configuration change, a replacement, or retirement of the machine — remains the target. **What Should an IT Team Do When a Patch Breaks a Business Application?** Keep the older version running, and put a named control around it. Work out which precondition the exploit depends on, remove that one if you can reach it, and limit what the affected machines can execute. Track the exact endpoints that still carry the vulnerable build. Then work the application owner and the vendor toward a version that installs cleanly. **How Long Should a Compensating Control Stay in Place?** Until a permanent fix lands, and not by default beyond it. The fix does not have to be a patch: an upgrade, a configuration change, replacing the software, or retiring the machine all end the need for the control. Write the trigger next to the control when you put it in, because a control with only a review date turns into permanent configuration nobody can explain. **Can an Unpatched Vulnerability Count as Mitigated?** Yes, when the control materially lowers the risk and the team can show how. That means recording the affected endpoints, the control itself, the residual risk, the owner, and the trigger for review. An owner and a date on their own do not make a risk managed. Permanent remediation stays the target state. Book a Demo → --- URL: https://capaone.com/blog/ios-27-software-update-management/ Published: 2026-09-17 Summary: iOS 27 software update management moves to Apple's declarative model. What changes, and what to verify in CapaOne. ← All articles Blog ## What iOS 27 Software Update Management Changes for Your Apple Fleet Nothing fails loudly. That is what makes this one worth checking. By CapaOne Support · September 17, 2026 Nothing on the device announces it. No prompt, no re-enrollment, no ticket. But iOS 27 software update management no longer runs on the commands behind most existing policies, and the fleet that followed your rules last week may not follow them this week. Apple released iOS 27 on September 14, 2026, and removed the legacy MDM commands that management platforms used to discover, schedule, and track OS updates. The device stays enrolled and stays managed. What stops is the part that tells it when to update — and because nothing fails loudly, the gap shows up weeks later, when someone notices a fleet that has quietly been updating on its users’ schedule instead of yours. ### What iOS 27 Software Update Management Changes Traditional MDM works as an exchange. The management service sends a command, the device acknowledges it, and the service polls to confirm the setting took effect. Every setting costs a round trip, and a device that sits offline drifts until it checks in again. Declarative device management works alongside that rather than replacing it. Apple added it to the existing MDM architecture: the service sends the intended state as a set of declarations, the device evaluates them locally, and it reports status changes back as they happen. Both models run on the same enrollment, and a fleet can use each where it fits. What iOS 27 removes is narrower than a protocol change. The commands and queries that platforms used to schedule updates, read available versions, and delay releases no longer answer. Where a declarative configuration and a legacy policy target the same setting, the declarative configuration takes effect. Apple sets this out in its deployment documentation, which now treats declarative software update management as the way to configure and enforce updates. ### What to Verify Before More Devices Update #### Your Update Policies Open the software update policies covering your Apple devices and confirm they use the declarative type. Check the target versions, the deferral windows, and whether your console still reports installed and available versions. A policy built on the old command model does not error — it simply stops governing anything, and the device reports healthy while running whatever version its user accepted. #### Your Existing Devices The devices move themselves. A device that updates to iOS 27 lands on the declarative model, and so does a device you enroll on iOS 27. Below that version, you move a device across from its endpoint page in CapaOne when you are ready. Your configurations do not follow. The policies you built under the legacy model stay where they are, and the declarative side starts empty until you recreate them. That is the gap: the device arrives on the new model and finds nothing governing it. #### A Small Group First Put a handful of devices on iOS 27 and confirm your policies behave the way you expect before the rest of the fleet follows. A small pilot shows you whether update discovery, deferral, and enforcement still work the way your reporting claims they do. Neither of these is reason to hold devices back. The declarative model enforces more consistently than the commands it replaces. The risk sits in the policies, not in the devices. ### How CapaOne Manages Apple Devices Through the Change For IT teams, the goal is not to run two update architectures in two workflows. It is to keep visibility over OS versions, update policy, and compliance while the fleet moves. Mobile Manager, part of the CapaOne Endpoint Management Platform, manages iOS, iPadOS, and Android devices from one console, across both the legacy and declarative models. Devices you have moved to DDM keep their update control on iOS 27, and newly enrolled devices run under DDM from the start. For teams running a mixed fleet, that means the change happens per device rather than as a migration project. Some devices sit on iOS 26 and earlier, some move to 27, and both keep reporting into the same mobile device management console with the same compliance view. The work that remains is the work that was always there: knowing which policies govern which devices, and confirming that they still do. Book a demo to see how Mobile Manager handles Apple devices across both models, or start a trial and check your own fleet. ### Frequently Asked Questions **What Does iOS 27 Software Update Management Change?** Apple released iOS 27 on September 14, 2026, and removed the legacy MDM commands that management platforms used to discover, schedule, and track OS updates. Those workflows now run through declarative software update management. The device stays enrolled and stays managed, but an update policy built on the old command model stops taking effect. **Does Updating to iOS 27 Enable Declarative Device Management on Its Own?** Not by itself. Declarative device management sits inside Apple's existing MDM architecture rather than replacing it, and the management service decides when a device uses it. What iOS 27 changes is narrower: the legacy update commands no longer answer, so update workflows need the declarative model. In CapaOne, devices on iOS 27 move to the declarative model on their own, whether you enroll them there or they update into it. Devices below iOS 27 move when you request it from the endpoint page. Your configurations do not travel with them. **What Happens to Software Update Policies on iOS 27?** Legacy update commands and queries no longer answer on iOS 27. Where a declarative configuration and a legacy policy target the same setting, the declarative configuration takes effect and the legacy policy goes unused. An update policy that still uses the old model leaves the device outside your update control. **How Do Mixed Apple Fleets Work During the Transition?** Devices on earlier OS versions can still use the legacy update workflows, while iOS 27 devices need declarative software update management. Both models run side by side on the same enrollment, so a fleet moves device by device rather than all at once. Book a Demo → Start Free Trial --- URL: https://capaone.com/blog/endpoint-management-consolidation-trade-offs/ Published: 2026-09-15 Summary: Every consolidation case comes from someone selling consolidation. Here are the endpoint management consolidation trade-offs, from CapaOne. ← All articles Blog ## Endpoint Management Consolidation Trade-Offs: What You Give Up Consolidation costs you something real. You should know what, before you decide it is worth paying. By Rikke Borup, CMO, CapaSystems · September 15, 2026 Every argument for consolidating endpoint management comes from someone who sells consolidation. This one included. That does not make the argument wrong, but it does mean the endpoint management consolidation trade-offs rarely appear in the material — and a decision this size deserves both sides. So here is the other side. Three things you give up, written by a vendor who would rather you decided with the full picture than discovered the cost afterwards. ### Three Endpoint Management Consolidation Trade-Offs Each one is real. None of them is a reason to keep five consoles — they are the price you should know you are paying. #### You Give Up Depth in a Single Discipline A specialist tool will often go deeper in the one discipline it serves. Its roadmap serves one audience, its support team answers one kind of question, and its edge cases reflect years of solving that specific problem for people who care about nothing else. A platform module covers the same discipline as part of a whole. For most organizations that trade works out, because most requirements sit well inside what a platform handles. It stops working when one discipline in your estate carries an unusual requirement — a regulatory constraint on a specific workflow, a hardware dependency nobody else has, an integration your business genuinely runs on. Check that first, in the one or two areas where your environment differs from everyone else’s. If a specialist tool earns its place there, keep it and consolidate around it. #### You Give Up Commercial Spread Several vendors mean several relationships to manage, several invoices, and several renewal negotiations. They also mean that a disappointing roadmap in one place affects one part of your estate. You can replace one tool without touching the others. One platform reverses that. The administrative burden drops, and so does your ability to move in pieces. You take on one roadmap, one support relationship, and one commercial dependency across a larger share of your operations. Weigh that honestly against the burden you remove, and ask what your exit looks like before you sign rather than after. #### You Give Up the Migration Itself Consolidation is not free, and the cost lands on the team you were trying to relieve. Someone rebuilds policies that already worked. Someone re-tests deployment packages that already ran fine. Someone learns a new console while the old one still runs. For a period, your team operates both. Any vendor promising otherwise is describing a demo, not a rollout. The right question is not whether migration costs you — it is whether the cost runs to days or to quarters, and what the vendor does to keep it at the shorter end. ### When Consolidation Still Wins The case for consolidating does not rest on any single tool being better. It rests on what happens between the tools. Separate tools produce separate inventories, and separate inventories disagree. Patch status lives in one console, vulnerability findings in another, privilege events in a third. Answering a question that crosses two of them turns into manual work, and answering an auditor who crosses all three turns into a project. Every additional agent adds something to install, update, and troubleshoot on every endpoint. Those seams cost real hours, and unlike a missing feature they cost them every week. Consolidation wins when the seams cost you more than the depth you give up. For a lean mid-market IT team covering a few hundred to a few thousand endpoints, those seams can become disproportionately expensive, because the two sides of the trade scale differently. Manual reconciliation grows with the estate: every additional endpoint, console, and agent adds to it. Specialist depth does not scale the same way, because a narrow feature serves the same narrow set of cases whether you run five hundred devices or five thousand. Which side wins depends on your estate, and you can measure both. ### When You Should Not Consolidate Endpoint Management Four situations argue for keeping a specialist tool, and none of them makes your estate immature. A workflow that the business genuinely runs on, where the specialist tool does something no platform module matches. A regulatory or contractual requirement that names a specific capability. A tool with almost no overlap with the rest of your stack, which means consolidating it removes a console without removing a seam. And a migration whose risk outweighs the operational gain — a discipline mid-audit, or a team already absorbing another change. Recognizing these keeps the rest of the decision honest. Consolidating around a specialist tool works. Consolidating for its own sake does not. ### How the Platform Handles the Honest Version The CapaOne Endpoint Management Platform runs six products that share one console, one inventory, and one set of groups — patching, provisioning, privileges, mobile, monitoring, and vulnerability insight in the same place. Application Manager, Privilege Manager, Provision Manager, Mobile Manager, Experience Monitor, and Security Monitor each cover a discipline, and they share the same foundation rather than integrating across one. That design answers the migration trade-off directly. You turn on what you need today and add the rest when you are ready, with nothing to re-install or re-architect in between. Consolidation becomes a sequence rather than a single event, which means you can start where the seams hurt most and leave a specialist tool in place where it genuinely earns its keep. CapaOne runs as a complete platform on its own. If you already run Microsoft Intune, the two divide the work rather than duplicate it. ### The Test Worth Running Take each tool in your estate and answer four questions about it. The answers sort your stack faster than any feature comparison. - What does it do that nothing else you own can do? Not what it does well — what it does only. Most teams find this list shorter than expected, and it tells you where real depth lives. - How much of its data already exists somewhere else? Overlapping inventories are the clearest signal that a tool costs you reconciliation rather than capability. - How often does the team move data out of it by hand? Count the exports, the copy-paste into a report, the cross-checks against another console. Every one of those is a seam with an hourly cost. - What would moving off it actually take? Policies, packages, integrations, and retraining. A tool nobody can leave is a dependency whether you consolidate or not. Three outcomes follow. A tool with unique, business-critical capability and low overlap you keep, and you consolidate around it. A tool with heavy overlap and frequent manual handoffs you replace first, because it costs you every week. Everything in between you schedule for later, once the first two moves prove out. Then count the questions you cannot answer without opening more than one console. Patch coverage against known vulnerabilities. Which elevation happened on the device that failed. Whether the drivers on a hardware model correlate with its crash rate. That number is your seam cost, and it is the figure to put next to whatever depth you would give up. Both answers are defensible. Only the version where nobody checks is not. Book a demo of CapaOne Endpoint Management Platform and bring both lists — the conversation is more useful when we know what you would be giving up. ### Frequently Asked Questions **What Do You Actually Lose by Consolidating Endpoint Management?** Three things, in most cases. Depth in any single discipline where a dedicated tool goes further than a platform module. Commercial spread, because one vendor relationship replaces several. And the migration effort itself, which lands on the team you were trying to relieve. **Is Consolidation Always the Right Answer?** No. When one discipline carries an unusual requirement that only a specialist tool meets, keeping that tool and consolidating around it beats forcing everything into one place. **How Do You Decide Whether Consolidation Pays Off?** List what each tool does that nothing else in your estate does. If the list is short, the effort of running separate consoles costs you more than the depth you would give up. **Do You Have to Consolidate Everything at Once?** No. Consolidation works product by product. Start with the discipline where the gaps between your tools cause the most manual work, and leave the rest until you are ready. Written by Rikke Borup CMO, CapaSystems Rikke is Chief Marketing Officer at CapaSystems, where she has led marketing and communications since 2009. With more than 17 years of experience in the IT sector — including cybersecurity, endpoint management software and IT services — she brings long-standing, practical insight into the challenges facing modern enterprise IT environments. Trained as a journalist, Rikke specializes in translating complex technical concepts into clear, easy-to-understand communications for IT decision-makers. More from Rikke Borup → LinkedIn ↗ Book a Demo → --- URL: https://capaone.com/blog/capasystems-user-group-october-2026/ Published: 2026-09-14 Summary: CapaSystems User Group meets on 21 October. A customer describes converting packages on the way from CapaInstaller to CapaOne. ← All articles Events ## CapaSystems User Group Returns in October: Automation in Practice A customer, a consultant and a roadmap — one day on what automation delivers once it meets a real estate. By Rikke Borup, CMO, CapaSystems · September 14, 2026 A migration plan holds until the first package refuses to install. What happens after that depends on details nobody wrote down — and those details are what people actually talk about at CapaSystems User Group. The autumn meeting runs on 21 October, and the theme is automation. Four talks, four people who have already put something into production. Including the parts that took longer than the plan said. ### Why Kim Byrresen’s Talk Deserves the Trip Kim Byrresen works as a sysadmin at Vordingborg Køkkenet. He has moved his estate from CapaInstaller to CapaOne, and he walks through what that took — above all what happened to the existing application packages, and which steps his team automated on the way across. Technology is rarely what stops a migration. The package that depended on a local path stops it, or the prerequisite check that only mattered on one hardware model, or the one application that refused to behave until the rollout had already slipped a week. Kim does that work himself. Nothing sits between you and the person who solved it. He stays for the breaks, which matters more than the talk if you face the same move. ### AI, the Market, and the Roadmap Mark Bønnelykke Rasmussen, Consultant, opens with From Prompt to Production: When AI Meets CapaOne and CapaInstaller. Where AI already carries weight in daily operations, and where it still does not. Simon Højlund, Vice President Sales, brings What’s Happening Out There? — what IT teams raise with us right now. The session runs as a conversation, so the room steers it. Dennis Busk Nyehuus, Chief Services Officer, closes with Product Roadmap & Tech Talk: what arrives next, and when. He takes questions on the spot rather than parking them. We are adding a couple of items to the program and will announce them once they hold up. ### What to Know Before CapaSystems User Group Wednesday 21 October 2026, 10:00 to 15:00, at CapaSystems, Roskildevej 342C, 2630 Taastrup. Lunch comes with the day, and so does time between the talks to compare notes with people who run the same problems you do. Attendance costs nothing. Membership is not a requirement — every CapaSystems customer can join. Seats go to whoever registers first, and we run the day in Danish. Register for CapaSystems User Group The full listing sits on the event page. Working with someone who handles deployment or packaging? Send it their way. Anything we should know before you arrive, dietary or otherwise? cug@capasystems.com reaches us. ### Frequently Asked Questions **Who Can Attend CapaSystems User Group in October 2026?** The meeting on 21 October welcomes all CapaSystems customers, whether or not you belong to the user group. You register in advance, and we hold a limited number of seats. **What Language Does CapaSystems User Group Run In?** The day runs in Danish at CapaSystems in Taastrup, Denmark. The talks, the questions, and the conversations during the breaks all happen in Danish. **What Does It Cost to Attend CapaSystems User Group?** Attendance costs nothing. Lunch is part of the day, and you only register in advance so we know how many people to expect. **Can I Bring a Colleague to CapaSystems User Group?** Yes. Your colleague registers separately, so we know the headcount for lunch and can keep track of the remaining seats. The program suits anyone who works with deployment, packaging or endpoint automation. Written by Rikke Borup CMO, CapaSystems Rikke is Chief Marketing Officer at CapaSystems, where she has led marketing and communications since 2009. With more than 17 years of experience in the IT sector — including cybersecurity, endpoint management software and IT services — she brings long-standing, practical insight into the challenges facing modern enterprise IT environments. Trained as a journalist, Rikke specializes in translating complex technical concepts into clear, easy-to-understand communications for IT decision-makers. More from Rikke Borup → LinkedIn ↗ Book a Demo → --- URL: https://capaone.com/blog/least-privilege-framework-controls/ Published: 2026-09-08 Summary: ISO 27001 A.8.2 and CIS Controls 5, 6 and 8 converge. How CapaOne maps least privilege controls to each named requirement. ← All articles Blog ## Least Privilege Controls: Mapping the Practice to ISO 27001 and CIS Four named requirements, one set of least privilege controls — and where the mapping stops being clean. By Rikke Borup, CMO, CapaSystems · September 8, 2026 Four named requirements across two widely used frameworks push organizations toward the same thing: tighter control over who holds privileged access, how a grant happens, and what record it leaves. Removing standing local admin and replacing it with policy-based elevation is one practical way to implement that on endpoints — a pattern, not a quotation from the controls themselves. That distinction is the whole point of this piece. The controls overlap, but they are not interchangeable, and a mapping that treats them as one requirement will not survive a conversation with an assessor. Knowing which control an auditor will name matters for a practical reason. It determines which evidence an assessor requests — and a mapping made in advance turns that request into a lookup rather than a project. ### What Each Control Actually Says ISO 27001:2022 Annex A 8.2, Privileged Access Rights, states that an organization should restrict and manage the allocation and use of privileged access rights. In the 2013 revision the equivalent control was A.9.2.3, which is why older mapping documents point at a different reference for the same idea. The CIS Critical Security Controls split the same territory across three, and each is broader than the part endpoint privilege management touches. Safeguard 5.4, under Control 5 (Account Management), restricts administrator privileges to dedicated administrator accounts, with routine work done from a non-privileged account. Note what it prescribes: separate accounts. Zero standing admin with just-in-time elevation serves the same objective — routine activity stays non-privileged — but it is a different implementation, not the one the safeguard describes. Control 6 (Access Control Management) covers the granting and revoking processes, multi-factor authentication for administrative access, centralized access control, and role-based access. Endpoint elevation policy speaks to the granting and revoking parts and to role-based scoping. It does not speak to the rest. Control 8 (Audit Log Management) covers an entire logging program: collection, storage, time synchronization, centralization, retention, and review. Elevation records are one input to that program. Read together, three operational questions run underneath all four references: who holds rights, how a grant happens, and what record it leaves. A tool that answers one and not the others leaves a gap that shows up the moment someone asks for evidence — but answering all three is not the same as satisfying the controls, and the difference is worth stating plainly. ### Mapping Least Privilege Controls to the Requirement #### Restricting Allocation CapaOne Privilege Manager, part of the CapaOne Endpoint Management Platform, removes standing local admin and issues elevation by policy, for a defined scope and duration. That speaks directly to the allocation half of A.8.2, which asks organizations to restrict and manage how they allocate and use privileged rights. Against Safeguard 5.4 the relationship is supportive rather than one-to-one: routine user activity stays non-privileged, which is the objective, but 5.4 explicitly describes dedicated administrator accounts, and this is a different route to the same end. The verification property matters as much as the control itself. An enforced baseline holds continuously and an assessor can test it on the spot, which is a different kind of evidence from a document asserting that the same thing is true. #### Governing the Grant Policy-based elevation against Entra ID groups means grants follow a rule that exists before the request, not a decision made under pressure. Deny rules cover the inverse case — the tools nobody should raise regardless of who asks. Against Control 6 this supports the access-granting and access-revoking practices and the role-based scoping, since policies target groups you already maintain. Centralized access control and multi-factor authentication for administrative access sit elsewhere in your stack; the control asks for those too. A break-glass path handles what no policy anticipated, and it stays deliberately narrow. Both frameworks expect exceptions to exist; what they do not tolerate is exceptions without a trail. #### Recording the Use Each elevation records the user, the endpoint, the executable name and application path, the time, the duration, and the outcome, and those records export for review. That supplies the accountability A.8.2 expects, and it contributes privileged-access events to the broader audit-log practice Control 8 asks for. It does not replace the rest of that practice — collection across other assets, centralization, retention periods, and scheduled review remain yours to run. Which field answers which question — and which one the policy set answers rather than the log — is the subject of our post on privileged access audit evidence. ### Where the Mapping Stops Being Clean Three caveats, because a mapping presented as complete is the kind of claim that fails under questioning. Tooling covers enforcement and evidence, not process. Documented authorization and periodic review remain organizational responsibilities, and no platform supplies them. Whether the reviewer should be independent of the grantor is a separate governance question — a segregation-of-duties argument rather than something these four references settle. Scope is narrower than every control named here. A.8.2 covers privileged access across infrastructure, applications, and data. Control 6 covers enterprise access management. Control 8 covers logging across all assets. Endpoint privilege management addresses the endpoint — a substantial part of each control surface, and nowhere near the whole of any of them. Certification is an organizational outcome, not a product feature. Tooling supports alignment with these controls and produces the evidence an assessor asks for. It cannot deliver a certification, and any vendor implying otherwise is describing something they do not control. ### What Changes in Practice Teams that map their privilege practice to named controls before an assessment tend to find the assessment uneventful, for a reason that has little to do with the mapping document. The exercise forces a decision about who reviews what, and that decision is what an assessor is really testing. Our endpoint privilege management overview sets out how the same evidence supports NIS2 access-control expectations, and our post on privileged access governance covers who owns the practice once least privilege becomes the default. For the operational side — what to decide first and in what order to roll it out — see just-in-time elevation in practice. CapaOne is Danish-built and EU-hosted, with no transfer of endpoint data to US jurisdiction, which matters when an assessor asks where the evidence itself resides. Our security and compliance page covers that alongside patch and configuration reporting. See how the record maps to your own control set — book a demo of the CapaOne Endpoint Management Platform. ### Frequently Asked Questions **Which ISO 27001 Control Covers Privileged Access?** Annex A 8.2, Privileged Access Rights, in the 2022 revision. It requires organizations to restrict and manage the allocation and use of privileged access rights. In the 2013 version the equivalent was A.9.2.3, so mappings written before the revision use the older reference. **Which CIS Controls Apply to Local Administrator Rights?** Safeguard 5.4 under Control 5 restricts administrator privileges to dedicated administrator accounts, with routine work done from a non-privileged account. Control 6 covers access granting and revoking, multi-factor authentication for administrative access, centralized control, and role-based access. Control 8 governs the broader audit-log practice that privileged-access records contribute to — it is not specifically a privilege-logging control. **Does Removing Local Admin Satisfy These Controls on Its Own?** No. Removing standing rights speaks to the allocation half, and against CIS Safeguard 5.4 it supports the objective rather than matching the wording, since 5.4 describes dedicated administrator accounts. The frameworks also expect a documented authorization process, a record of each use, and periodic review. Tooling delivers enforcement and record; process and review remain yours to define. **How Do You Prove Least Privilege Controls to an Auditor?** By demonstrating the baseline and the exceptions together. An endpoint estate with no standing local admin is directly testable, and a complete elevation record accounts for every departure from it. CapaOne Privilege Manager enforces that baseline and records the managed elevations, so both halves come out of daily operation rather than a reporting exercise. Written by Rikke Borup CMO, CapaSystems Rikke is Chief Marketing Officer at CapaSystems, where she has led marketing and communications since 2009. With more than 17 years of experience in the IT sector — including cybersecurity, endpoint management software and IT services — she brings long-standing, practical insight into the challenges facing modern enterprise IT environments. Trained as a journalist, Rikke specializes in translating complex technical concepts into clear, easy-to-understand communications for IT decision-makers. More from Rikke Borup → LinkedIn ↗ Book a Demo → --- URL: https://capaone.com/blog/elevation-logs-as-audit-evidence/ Published: 2026-09-01 Summary: A privileged access audit asks four questions. CapaOne Privilege Manager records the fields that answer three of them. ← All articles Blog ## Privileged Access Audit Evidence: What to Record and Why Design the record before the review starts — and know which question the log answers, and which one the policy does. By CapaOne Support · September 1, 2026 A privileged access audit usually needs to establish four things: who held administrative rights, which rule granted them, for how long, and what the elevation covered. Elevation logging answers three of them directly. The fourth — which rule — comes from your policy set, and knowing that split before the audit starts saves a fortnight of looking in the wrong place. Organizations that designed their elevation record around those questions answer in an afternoon. Organizations that kept logs for troubleshooting spend a fortnight reconstructing an answer from data that was never meant to carry it. The distinction is not how much you log. It is whether the fields you capture line up with the questions an assessor asks. This is a design decision, and it is far cheaper to make before the first audit than after. ### What a Privileged Access Audit Actually Asks For The questions are narrower than the anxiety around them suggests. #### “Who Has Administrative Rights?” For managed endpoints, the cleanest baseline is zero standing local administrator rights. That baseline is verifiable — an assessor can check it directly rather than take a list on trust. Privileged identities elsewhere in the organization are a separate conversation; this one is about the endpoint. This is also the answer that ages well: a list of admin accounts goes stale the week after anyone produces it, while an enforced baseline stays true continuously. Where standing rights remain, the exceptions need names, owners, and a documented reason. An unexplained exception is worse than a large number of explained ones. #### “How Was Access Granted?” Here the assessor is checking whether grants follow a rule or a mood. CapaOne Privilege Manager, part of the CapaOne Endpoint Management Platform, applies elevation by policy against a defined scope, so the answer is a policy rather than a recollection. Worth being precise about where that answer lives. The policy set documents which rule permits which action; the log records that an elevation happened and what it covered. Evidence for this question comes from both, and an assessor asking to see the rule wants the configuration, not the log file. Break-glass grants form a separate, smaller set — and because they are the exception, they are the set that gets the closest look. #### “For How Long?” Time-bound access is the mechanism that makes least privilege real rather than aspirational, so the record has to carry the bound as well as the grant. If it shows that an elevation happened but not when it ended, you cannot demonstrate the control even when it exists. #### “What Did the Elevation Cover?” Each elevation records the user, the endpoint, the executable name and application path, the time, the duration, and the outcome. How completely that answers the question depends on which kind of elevation you granted. For process elevation the record is exact: one named executable at one path, raised and dropped. For session elevation it describes a time-bound window of administrative scope rather than a list of everything done inside it. Both are defensible — they answer at different resolutions, and it is worth knowing which resolution your own policies produce before someone asks. ### What Elevation Logging Captures, and Why Each Field Earns Its Place Every field maps to one of the four questions. The user and endpoint answer who and where. The executable name and application path answer what — and the path carries weight here, because two binaries sharing a name in different locations are not the same thing to an assessor or an attacker. Time and duration answer the question most records miss. The outcome closes the loop by showing whether the action succeeded. Those records export for review, which is what turns them from telemetry into evidence. An assessor can of course walk through a console with you, but an export travels: you can sample it, archive it, hold it against last year’s, and hand it over without giving anyone access to the platform itself. That is the record’s job, and it is a narrower one than governance. Who owns the elevation practice, who signs off on policy, and how the board sees it are separate questions, covered in our post on privileged access governance. The field design here is what any of that rests on. Pair the record with fleet-level exposure data from CapaOne Security Monitor when the audit reaches configuration and patch posture, since privileged access is rarely reviewed in isolation. ### Turning a Log Into Something You Can Hand Over Three habits separate a usable record from an archive. Decide the retention period deliberately. Whatever your information security policy states, the log must match it. Auditors compare the two, and a mismatch reads as a control that exists on paper only. Review on a cadence, and leave a trace of the review. Monthly for break-glass usage and quarterly for policy exceptions is a reasonable starting point rather than a requirement — set the rhythm that matches your own risk picture. The review matters less for what it finds than for proving that someone looks. Unreviewed break-glass usage stops functioning as an exception and starts functioning as a second, quieter way in — a point we made in our post on just-in-time elevation in practice. Separate the reviewer from the grantor. Independent review strengthens separation of duties, and it matters most for break-glass and manually approved elevations — the cases where one person’s judgment stood in for a rule. This matters most where the service desk authorizes elevations directly — our post on service desk elevation without sharing the local admin password covers why a credential-based approval leaves a thinner trail than a policy-based one. For organizations running Microsoft Entra ID, policies target existing groups, so the identity structure you already maintain and document becomes the structure your evidence refers to. CapaOne runs as a complete platform on its own, and for teams with Microsoft Intune in place it operates alongside existing compliance and configuration policies without duplicating them. Audits go smoothly for a duller reason than most people expect. Not because the controls are numerous, but because the day-to-day work already emits the evidence — nobody assembles anything, because someone chose the fields with the question in mind. Our endpoint privilege management overview sets out where that fits in a wider endpoint strategy, and our security and compliance page covers how the evidence trail sits alongside patch and configuration reporting. See what the record looks like against your own estate — book a demo of the CapaOne Endpoint Management Platform and we will walk an export through with you. ### Frequently Asked Questions **What Should an Elevation Log Contain for an Audit?** Enough to answer who, on what machine, using which binary, for how long, and with what outcome. CapaOne Privilege Manager records the user, the endpoint, the executable name and application path, the time, the duration, and the result of each elevation. A log missing the duration cannot demonstrate a time bound on the access, which is usually the point the auditor checks. **How Do You Prove Least Privilege Rather Than Just Claim It?** By showing the absence of standing rights and the presence of a complete record. CapaOne Privilege Manager removes standing local admin, so the baseline is verifiable, and logs every elevation, so the exceptions are traceable. A policy document states an intention; the two together demonstrate the practice. **How Long Should You Keep Elevation Records?** Long enough to cover your own audit cycle and any incident investigation window — which in most organizations means the period their information security policy already specifies. Set it deliberately rather than inheriting a default, and make sure the log matches what the policy says, because an auditor will compare the two. **Who Reviews Elevation Logs, and How Often?** Someone who is not the person granting elevations, on a schedule you can evidence. Monthly review of break-glass usage and quarterly review of policy exceptions is a reasonable starting cadence. What matters to an auditor is that the review happened, produced a decision, and left a trace. Book a Demo → --- URL: https://capaone.com/blog/service-desk-elevation-without-admin-credentials/ Published: 2026-08-25 Summary: A local admin password authorizes a person, not an action. CapaOne Privilege Manager removes the need to use one for routine elevation. ← All articles Blog ## Service Desk Elevation Without Sharing the Local Admin Password Rotating the password secures the credential. It does not record which decision the technician made. By CapaOne Support · August 25, 2026 Service desk elevation becomes an urgent question as soon as an organization removes local administrator rights, and it always takes the same form: what happens when someone genuinely needs to install something at half past four on a Friday. The honest answer in most organizations is that a technician types a shared local admin password, and everyone agrees not to think about it too hard. The password is not the problem. It is a symptom of a missing mechanism — the ability to authorize one specific action on one specific machine for a short period, without handing anyone a set of keys. ### Why the Shared Local Admin Password Survives Every Policy That Bans It It survives because it works, and because the alternatives on offer are usually worse for the person doing the job. #### The Scope Is the Whole Machine A local administrator password grants everything on that machine, not the one thing the user needed. The technician who types it is not making a decision about a driver installation; they are granting unrestricted local control and hoping the situation stays as described. #### It Records No Decision A credential authorizes a person to act. It does not capture which action the technician approved, under which rule, or how long the elevated window should have lasted. Where the workflow goes further and adds the user to the local Administrators group, the privilege has no end date at all — it lasts until someone remembers to reverse it. #### Attribution Stops at the Account Some attribution usually exists — a managed credential logs each retrieval, and individual admin accounts identify the technician. What is missing is the chain: which person, on which device, requested which action, approved by whom, for how long, with what outcome. When something goes wrong three weeks later, the investigation starts from an account rather than a decision. A credential that works on more than one machine is also worth something to an attacker who obtains it — the same reasoning that makes removing the local admin close the opening EDR killers rely on. #### What About Windows LAPS? It is the obvious objection, and it deserves a straight answer. Windows LAPS gives each device a unique local administrator password, rotates it on a schedule or after use, and restricts retrieval to authorized staff. That closes the reuse problem properly — one compromised machine no longer hands an attacker the rest of the fleet. What it does not do is decide anything. Credential management and elevation approval solve different problems. If the service desk still retrieves a local admin password to close ordinary tickets, the credential is secure and the workflow has not moved — you have protected the key without reducing how often someone reaches for it. ### What Service Desk Elevation Looks Like Instead CapaOne Privilege Manager, part of the CapaOne Endpoint Management Platform, lets a supporter authorize a scoped, time-bound elevation without exposing local admin accounts to anyone. The technician approves an action rather than surrendering a credential. Three things change in the daily work. The action traces to a person. The record shows the user, the endpoint, the executable name and application path, the time, the duration, and the outcome. Compare that with a shared credential, where the log names an account that belongs to everyone and therefore to nobody. Nothing lingers. The elevation expires on its own. Nobody has to remember to reverse anything, which matters because the step people forget is always the last one. No credential changes hands. The supporter authorizes without exposing a local admin account, so there is no password to type in front of a user. ### Watch Which Requests Keep Coming Back The most useful thing about routing elevation through a supporter is not the control. It is the data. A request that arrives once is an exception. The same request arriving every week is a policy gap wearing a costume — the task belongs in a rule, and each of those tickets existed only because it was not there. Reviewing recurring requests monthly is the cheapest policy tuning available, and it shrinks the queue rather than managing it. Some categories disappear entirely rather than getting approved faster. Where routine installs and updates drive the volume, CapaOne Application Manager deploys them silently by policy, so the elevation request never arises in the first place. An approval you never have to give is better than a fast one. The direction of travel is a service desk that grants fewer elevations over time, not one that grants them more efficiently. If the number is flat after three months, the policies are not learning from the queue. For teams already running Microsoft Intune, CapaOne operates alongside existing compliance and configuration policies, and it works equally well as a complete platform on its own. Our endpoint privilege management overview sets out where supporter-authorized elevation fits in a wider endpoint strategy, and our post on just-in-time elevation in practice covers the decisions to make before the first policy goes live. Try it against a real ticket — book a demo, or start a free trial and approve the first elevation yourself. ### Frequently Asked Questions **How Can Support Staff Grant Admin Rights Without Sharing a Password?** By authorizing an elevation rather than handing over an account. CapaOne Privilege Manager lets a supporter approve a scoped, time-bound elevation on a specific machine without exposing local admin credentials to anyone. The record captures the user, the endpoint, the executable, and the duration, so the action stays traceable to a person rather than to a shared account. **Does Windows LAPS Solve the Service Desk Elevation Problem?** Partly, and it solves a different part than endpoint privilege management does. Windows LAPS gives each device a unique local administrator password, rotates it on a schedule or after use, and restricts who can retrieve it — which closes the credential-reuse problem. It does not record which action a technician approved, under which rule, or for how long. CapaOne Privilege Manager addresses that second half by removing the need to reach for the credential during routine work. **What Happens to Elevation Requests When Nobody From Support Is Available?** Most should never reach a person. Routine tasks belong in a policy that approves them automatically, so the request never becomes a ticket. Supporter approval is for the cases policy does not cover, which should be a small and shrinking set. **Does the User Need to Wait for Approval Every Time?** No, and if they do, the policy needs work. Repeated approvals for the same task signal that a rule should cover it instead. Watch which requests recur — they are telling you what the policy is missing. Book a Demo → --- URL: https://capaone.com/blog/just-in-time-elevation-in-practice/ Published: 2026-08-19 Summary: Removing standing local admin takes four decisions, not one. How CapaOne Privilege Manager handles scope, denials, duration, and audit evidence. ← All articles Blog ## Just-in-Time Elevation in Practice: Four Decisions and Four Phases The four decisions to make first, the four phases to roll out in, and the evidence they leave behind. By CapaOne Support · August 19, 2026 Removing standing local admin rights is not a single change. Just-in-time elevation replaces it with four decisions, taken in this order: which tasks elevate automatically, which tools the policy denies outright, how long an elevation lasts, and who can grant one when no policy covers the case. Teams that settle all four before touching a single endpoint spend their first month tuning policies. Teams that settle one and discover the rest under pressure spend it answering tickets. The mechanics are well understood by now. Removing standing local admin closes an escalation path an attacker can use after compromising an endpoint, which is why removing the local admin closes the opening that EDR killers rely on. The operational shape of the transition gets far less attention: which decisions come first, which order the rollout runs in, and what evidence you hold at the end of it. ### Four Decisions Before You Turn on Just-in-Time Elevation Every one of these has a default answer that looks reasonable and creates work later. #### Process Elevation or Session Elevation CapaOne Privilege Manager, part of the CapaOne Endpoint Management Platform, supports both, and the distinction matters more than it first appears. Process elevation raises privileges for one named executable, identified by name and file path, and drops them the moment the process closes. Session elevation grants broader administrative scope for a defined period. Process elevation covers the overwhelming majority of routine work — a specific installer, a specific configuration utility, a specific driver package. Reach for session elevation only where the task genuinely spans multiple tools, and give it the shortest duration that lets the work finish. The common mistake runs the other way: teams grant sessions because sessions generate fewer questions, and six months later the session has quietly become the standing admin right they set out to remove. #### What to Deny by Default Elevation policy decides what users can raise. Deny rules decide what they cannot raise at all, regardless of who asks. Privilege Manager supports deny rules for shells and unsigned installers, with explicit policy exceptions where a controlled case exists. Write these first, before the allow rules. A deny list written on day one is a security decision. The same list written in month three, after an incident, is a reaction — and it will be harder to defend to the people whose workflow it interrupts. #### How Long an Elevation Should Last Set a short duration with automatic revocation, then watch which durations run to their limit. An elevation that consistently runs to its limit is telling you the underlying task should be a policy rather than a request. An elevation granted for an hour and used for ninety seconds is telling you the limit is too generous. This is the number worth revisiting monthly. It is also the one nobody thinks to look at, because nothing breaks when it is wrong. #### Who Approves What No Policy Covers Some cases will not fit any policy, and the fourth decision is who handles them. Privilege Manager includes break-glass controls for exactly this, and support staff can authorize a scoped, time-bound elevation without exposing local admin credentials to anyone. Two things make break-glass work: it stays rare, and someone reviews every use. A break-glass path in weekly use is not an exception mechanism. It is a policy gap with a friendlier name. ### The Four Phases of the Rollout Initial configuration goes quickly. The rollout does not, and it should not — Privilege Manager expects a phased sequence, and the gap between those two speeds is where most projects lose momentum. #### Phase One: Remove the Standing Admin Take the standing local admin rights away first, before a single elevation policy exists. Teams that reverse this order write policies against an estate where nobody needs them yet, then discover in phase three which ones they actually needed. #### Phase Two: Standard Policies on Test Endpoints Apply your baseline policies to a small set of endpoints and let them run. This is where the deny rules earn their place, and where you find out whether your duration limits match how people actually work. Pair this phase with CapaOne Application Manager if routine installs and updates drive your ticket volume. Applications deployed silently by policy never generate an elevation request in the first place, which removes an entire category of the work you are about to redesign. #### Phase Three: Scale Department by Department Departments differ more than anyone predicts. The finance team and the engineering team will not need the same exceptions, and finding that out on one department costs a conversation, while finding it out fleet-wide costs a week. One case sits outside the pattern: laptops that leave the network. Policies can allow cached decisions for low-risk tasks with strict durations, and the platform queues log entries for synchronization when the endpoint comes back online. Decide deliberately which tasks qualify as low-risk rather than letting the default decide for you — a user on a train will find this setting before IT does. #### Phase Four: Operationalize with Reporting The rollout ends when the reporting starts. Reviewing which policies fire, which durations run to their limit, and how often anyone reaches for the break-glass path turns the deployment into an operating rhythm rather than a project with an end date. ### What You Can Show an Auditor Afterwards Each elevation records the user, the endpoint, the executable name and application path, the time, the duration, and the outcome. Those records export for review, which turns least privilege from a stated intention into something you can demonstrate on request. That evidence supports NIS2-aligned access governance: it lets you show consistent privilege controls and a traceable record of every escalation, which is the mapping our endpoint privilege management overview sets out in full. Our security and compliance page covers how the evidence trail fits alongside patch and configuration reporting from CapaOne Security Monitor. For organizations running Microsoft Entra ID, policies target existing groups directly, so the structure you already maintain becomes the structure that governs elevation. CapaOne runs as a complete platform on its own, and for teams with Microsoft Intune in place, it operates alongside existing compliance and configuration policies without duplicating them. Least privilege stopped being a maturity milestone somewhere in the last two years and became the baseline auditors measure you against — a shift we examined in more detail in our post on privileged access governance. The organizations that handle it well are not the ones with the strictest policies. They are the ones that decided what to deny, how long to allow, and who can override, before the first endpoint changed. See how elevation behaves in a live environment — book a demo, or start a free trial and run the first policy against your own endpoints. ### Frequently Asked Questions **How Long Should a Just-in-Time Elevation Last?** Short enough that it expires before anyone forgets it. CapaOne Privilege Manager applies elevation to a defined scope for a defined duration and revokes it automatically when the time is up. Most routine tasks finish inside a few minutes; a session that needs an hour is a signal to check whether the task belongs in a policy instead. **What Should You Deny by Default After Removing Local Admin?** Start with shells and unsigned installers. CapaOne Privilege Manager supports deny rules that block these outright and require an explicit policy exception for controlled use, which keeps the two most common escalation paths closed while your standard policies take shape. **How Does Elevation Work When the Laptop Is Offline?** Policies can allow cached decisions for low-risk tasks with strict durations, so an engineer on a plane is not blocked. CapaOne Privilege Manager queues the log entries and syncs them when the endpoint reconnects, so the audit trail stays complete. **What Are the Phases of a Least-Privilege Rollout?** Initial configuration goes quickly; the rollout should not. CapaOne Privilege Manager expects four phases: remove standing local admin, apply standard policies to test endpoints, scale department by department, then operationalize with reporting. The pace depends on how many exceptions your estate turns out to have, not on the tooling. Book a Demo → --- URL: https://capaone.com/blog/endpoint-management-attack-surface/ Published: 2026-08-10 Summary: Your endpoint management attack surface starts with architecture. CapaOne is cloud-native — no customer-hosted management server. ← All articles Insights ## Endpoint Management Attack Surface: Why Architecture Decides Exposure Your endpoint management attack surface may start with the privileged server managing your devices — not with the devices themselves. By Rikke Borup, CMO, CapaSystems · August 10, 2026 Endpoint management platforms are privileged infrastructure. Architecture determines where that privilege lives, who is responsible for securing it, and which exposures an organization has to operate itself. Compromise the management plane, and an attacker gains a path to privileged actions across the managed fleet — which makes the endpoint management attack surface an architecture question, and architecture decisions are expensive to reverse. Most vendor comparisons never ask where the management platform itself runs. It belongs near the top of the list. ### Where the Endpoint Management Attack Surface Sits Endpoint management platforms concentrate privilege by design. To push software, change configuration, and reach devices remotely, the platform needs authority over every endpoint it manages. That authority is the product. It is also what makes the platform worth attacking. The architectural variable is not whether that privilege exists. It is who operates it. When an organization hosts the management server itself, three responsibilities transfer along with it: - The organization exposes the service and owns its hardening - The organization patches it, on its own timeline and capacity - The organization carries availability and breach response for the control plane Each responsibility is manageable alone. Together they place a privileged, internet-reachable service inside the estate it governs, maintained by the same team already stretched across everything else. That last responsibility is where the argument stops being theoretical. Vulnerability exploitation is now the leading initial access vector in the 2026 Verizon Data Breach Investigations Report, accounting for 31% of breaches. Across the same study period, organizations fully remediated only 26% of the vulnerabilities listed in CISA’s Known Exploited Vulnerabilities catalog, taking a median of 43 days to close the ones they did fix (pp. 10, 17). A self-hosted management server inherits that timeline. #### A Pattern Worth Reading Management, access, and remote administration tools appear repeatedly in CISA’s Known Exploited Vulnerabilities catalog. The recurring shape is consistent: a privileged service, reachable from the internet, maintained by the organization that depends on it, becomes a route into the environment it was bought to protect. For a CIO or head of IT, the useful question is not which vendor patched fastest. It is whether the architecture requires the organization to run that service at all. ### What Cloud-Native Architecture Changes CapaOne runs cloud-native. There is no customer-hosted privileged management server for your IT team to expose, harden, maintain, and patch. Endpoints connect outward to the CapaOne Endpoint Management Platform, which is EU-hosted and Danish-built, with no transfer of endpoint data to US jurisdiction. This is worth stating precisely, because the overclaim sits close by. Cloud-native architecture does not make endpoint management risk-free. A privileged control plane still exists, management agents still run with privilege on the devices they manage, and any management platform remains a high-value target. What changes is narrower and concrete: the control plane is operated by the vendor rather than the customer, and the exposure, hardening, patch lifecycle, and availability of that plane move with it. You remove a class of exposure. You do not remove the category. Hosting model and jurisdiction belong in the same conversation, because both are fixed at selection time. Our guide to choosing a European endpoint management platform sets out the criteria in full. ### Questions to Ask an Endpoint Management Vendor Architecture is difficult to assess from a feature matrix. These questions surface it directly, and they apply to any vendor under evaluation: - Where does the management control plane run, and who operates it? - Does the architecture require any server on our own infrastructure? - Who is responsible for patching and hardening the control plane, and on what schedule? - What privileges does the endpoint agent hold, and how are they scoped? - How is administrative access to the platform authenticated and segmented? - Where is endpoint data stored, and under which jurisdiction? - Which subprocessors can access endpoint data? - What administrative actions are logged, and for how long are those logs retained? - Who owns detection and response if the control plane itself is compromised? The answers rarely appear in a datasheet. They are worth asking before a shortlist, not after. Comparing several cloud-based platforms side by side on these exact criteria is a faster way to get them than working through each vendor alone. ### Seeing Exposure Across the Fleet Moving the control plane addresses one exposure. The rest of the fleet still drifts. Security Monitor gives a single near-live view of vulnerability and configuration posture across every managed endpoint. It maps CVEs to the endpoints actually affected, prioritizes by exploitability and impact rather than severity score alone, flags where a device has drifted from its secure baseline, and triggers remediation through integrated update actions. Exportable reports turn that posture into audit evidence. Standalone, CapaOne manages the full fleet from one console — application management, privilege control, provisioning, mobile devices, and exposure visibility in a single platform. Organizations already running Microsoft Intune keep it: CapaOne works with Intune, or entirely without it, adding third-party breadth, EU hosting, and one operational view across the estate. The operational result is fewer moving parts to defend. One control plane the organization does not operate, one console for fleet-wide exposure, and one platform under European jurisdiction supporting a NIS2-aligned posture. ### Architecture Is a Procurement Question Security reviews of endpoint management tools tend to focus on what the platform can do to devices. The stronger question runs the other way: what does the platform add to the environment simply by existing in it? An organization that answers that question during vendor selection makes a decision it can live with for years. One that answers it during an incident is answering too late. Book a demo of CapaOne Endpoint Management Platform. ### Frequently Asked Questions **What Is the Endpoint Management Attack Surface?** The endpoint management attack surface is the exposure created by the management platform itself, not by the devices it manages. Every management platform runs a privileged control plane with authority over enrolled endpoints, which makes it a high-value target. The architectural question is where that control plane runs and who carries responsibility for securing it. **Is Cloud-Based Endpoint Management More Secure Than On-Premises?** Cloud-native architecture moves the privileged control plane out of the customer network, so the customer no longer operates, hardens, or patches it. That removes one class of exposure rather than the category. Any management platform is a high-value target, and management agents run with privilege on the devices they manage. The difference is who operates the control plane and who carries the responsibility. **What Should European IT Teams Look for in an Endpoint Management Platform?** Four criteria carry most of the weight: where the management control plane runs and who operates it, who is responsible for patching and hardening it, how the platform surfaces configuration drift and vulnerability exposure across the fleet, and whether it manages the full estate standalone rather than only extending another tool. Data residency and jurisdiction belong in the same review, because both are fixed at selection time. **Does CapaOne Run Any Server on Customer Infrastructure?** No. CapaOne runs entirely as a cloud service, so organizations operate no CapaOne management server on their own infrastructure. Endpoints connect outward to the platform, which is EU-hosted and Danish-built. There is no customer-hosted management server for the IT team to expose, harden, maintain, or patch. **Does CapaOne Work Without Microsoft Intune?** CapaOne works with Microsoft Intune, or entirely without it. Standalone, CapaOne manages the full fleet from a single console, covering application management, privilege control, provisioning, mobile devices, and exposure visibility. Organizations already running Intune keep it and gain third-party breadth, EU hosting, and one operational view across the fleet. Written by Rikke Borup CMO, CapaSystems Rikke is Chief Marketing Officer at CapaSystems, where she has led marketing and communications since 2009. With more than 17 years of experience in the IT sector — including cybersecurity, endpoint management software and IT services — she brings long-standing, practical insight into the challenges facing modern enterprise IT environments. Trained as a journalist, Rikke specializes in translating complex technical concepts into clear, easy-to-understand communications for IT decision-makers. More from Rikke Borup → LinkedIn ↗ Book a Demo → --- URL: https://capaone.com/blog/windows-hotpatch-baseline-eligibility/ Published: 2026-07-31 Summary: Windows hotpatch baseline eligibility slipped in 2026. CapaOne shows which devices lag on Windows updates or wait on a pending restart. ← All articles Blog ## Windows Hotpatch Baseline Eligibility: Don't Miss the Secure Boot Rollout Two restart-required baselines in two months — and the Secure Boot certificate rollout riding on the second. Here is what to verify across the fleet. By CapaOne Support · July 31, 2026 Windows hotpatch baseline eligibility was planned to cost four restarts in 2026. By mid-July, it had already cost four. Microsoft’s hotpatch release notes list baselines in January and April, an additional restart-required baseline on June 9, and the planned baseline on July 14 — with October still to come. Devices must be on the latest baseline to keep receiving restart-free hotpatch updates, and July’s baseline carries something more: a wider automatic rollout of the new Secure Boot certificates. That is the quiet risk in restart-free servicing. Hotpatch packages are scoped to security updates and install silently. Everything else — cumulative fixes, new features, and the Secure Boot certificate rollout — travels with the baselines that still require a restart. When the calendar itself slips, as it did in June, the assumption that “we restart four times a year and we’re covered” stops holding. IT teams need to see which devices are current, which fell out of the cadence, and which received the new certificates. ### How Windows Hotpatch Baseline Eligibility Works #### The Baseline Calendar Slipped in 2026 The model is simple on paper: baseline months (planned for January, April, July, and October) deliver cumulative updates that require a restart, and the months in between deliver restart-free hotpatch security updates. Eligibility rests on staying current — a device that is not on the latest baseline falls back to standard cumulative updates, with restarts, until it catches up. What 2026 has shown is that the calendar is a plan, not a promise: June 9 brought an unplanned baseline, and July 14 followed with the scheduled one. Two consecutive restart months in a model built to keep restarts to a minimum. #### July’s Baseline Carries the Secure Boot Rollout The July baseline (KB5101650) widens the pool of devices eligible to automatically receive the 2023 Secure Boot certificates — the replacements for certificates that began expiring in June 2026. The rollout is automatic, and devices that have not yet received the new certificates continue to start and continue to update. But automatic and staged also means uneven: at any given moment, some devices in a fleet have the new certificates and some do not. The question is not whether Microsoft’s mechanism works. The question is whether you can document where it has landed — and which devices are drifting behind the baselines that carry it. ### How CapaOne Keeps Invisible Updates in Compliance CapaOne does not deploy Windows OS updates — the hotpatch rollout itself belongs to Microsoft’s tooling. What CapaOne delivers is the fleet-wide view that decides whether the restart-free model actually lands safely. #### See Which Devices Are Behind on Baseline Security Monitor surfaces configuration drift and exposure across the fleet, so IT can see which endpoints run behind on baseline — and where the fleet’s actual state has drifted from the intended one. The principle is the same one we described in Endpoint Configuration Drift — The Exposure Patching Doesn’t Close: a fleet can look patched and still stand open when its real state slides away from the plan. #### Watch Reliability After Silent Updates Experience Monitor tracks reliability and performance after updates install, so regressions surface before users report them. When updates no longer announce themselves, reliability data is how IT confirms that the silent model works — and catches the cases where it doesn’t. Both run on the CapaOne Endpoint Management Platform — standalone, or alongside a Microsoft-managed update flow. For the third-party side of the same story, see what hotpatch doesn’t patch. ### What IT Teams Gain The operational payoff is concrete: - Baseline stragglers become visible while it still matters — before the next hotpatch month arrives and the fleet’s eligibility splits in two. - Compliance evidence emerges from daily operations: which devices follow the hotpatch cadence, which drifted, and what their exposure looks like. - Post-update regressions surface from reliability data instead of user tickets. Restart-free servicing is where Windows is heading, and it changes the discipline IT teams need: from scheduling restarts to verifying state. June and July made the case better than any calendar could — when the rhythm changes without warning, the teams that can see their fleet adapt in a day. When that verification runs continuously, compliance becomes the natural result of everyday IT operations, not a quarterly scramble. Book a demo of the CapaOne Endpoint Management Platform to see baseline and exposure state across your fleet. ### Frequently Asked Questions **What Is Windows Hotpatch Baseline Eligibility?** Windows hotpatch baseline eligibility means a device must run the latest baseline update to receive restart-free hotpatch security updates. Microsoft plans four baseline months per year — January, April, July, and October — but can add more: 2026 added an extra baseline on June 9. A device that is not on the latest baseline receives standard cumulative updates, with restarts, instead. **How Do the New Secure Boot Certificates Reach Windows Devices?** Through Windows quality updates. The July 14, 2026 baseline (KB5101650) widened the pool of devices eligible to automatically receive the 2023 Secure Boot certificates, which replace certificates that began expiring in June 2026. The rollout is automatic and staged, so timing varies across a fleet — and verifying where it has landed is the IT team's job. **What Happens if a Device Misses a Baseline Update?** The device loses hotpatch eligibility and receives the latest cumulative update, which requires a restart. During a later hotpatch month, an enrolled device that is behind receives both the latest baseline and the hotpatch. The catch-up is automatic, but the restart-free benefit — and a predictable fleet state — is lost in the meantime. **Does CapaOne Deploy Windows Hotpatch Updates?** No. Microsoft's tooling manages the hotpatch rollout itself. CapaOne provides the compliance and reliability layer: Security Monitor shows which devices run behind on baseline and where exposure builds, and Experience Monitor tracks reliability after updates install. Book a Demo → --- URL: https://capaone.com/blog/endpoint-application-inventory-patch-visibility/ Published: 2026-07-29 Summary: You can't patch what you can't see. CapaOne builds a live endpoint application inventory so IT teams find and close exposure fast. ← All articles Blog ## Endpoint Application Inventory: You Can't Patch What You Can't See Most IT teams patch the applications they know about. The exposure lives in the ones they've lost track of. By CapaOne Support · July 29, 2026 An accurate endpoint application inventory answers the one question most IT teams cannot: which application versions are running on every endpoint right now. Windows patch posture shows up in a single console. Application posture rarely does — and that blind spot is where exposure grows. The Verizon 2026 Data Breach Investigations Report marks a turning point: vulnerability exploitation became the leading initial-access vector for the first time in the report’s history, behind 31% of breaches — ahead of both stolen credentials and phishing. Remediation is not keeping pace. Organizations fully remediated only about a quarter of known-exploited vulnerabilities last year, and median remediation time stretched past six weeks. Vulnerabilities exploit software that is out of date — and on any given endpoint, most of that software is not the operating system but the applications running on top of it. Those are the versions IT teams see least clearly. ### Why Application Inventory Goes Stale The operating system gets a schedule. Applications rarely do. Most IT teams have a rough idea of what runs on their endpoints, but “rough” is exactly the problem — the applications an inventory misses are the ones no one is managing. The gap between what IT teams think is deployed and what is actually running widens every day it goes unwatched. Known, unpatched vulnerabilities remain a leading entry point for attackers, and the ENISA Threat Landscape points to the same pattern the DBIR does: the longer an exposure stays open, the more likely it becomes an incident. #### Version Drift Compounds Quietly Applications that miss one update cycle tend to miss the next. A device that is offline during a deployment window falls behind and stays behind. Over months, the estate splinters into a patchwork of versions — some current, some two releases old, some running installers no one remembers approving. A point-in-time scan captures none of this, because it goes stale the moment it finishes. By the time the spreadsheet is compiled, the estate has already moved. #### The Long Tail Nobody Schedules Browsers, PDF readers, and runtimes are the applications everyone names, and they matter. But the harder problem is the long tail: the line-of-business tools, industry-specific software, and utility applications that make up the bulk of most estates and rarely appear on a patch schedule. These are the applications IT teams lose track of first, and the ones attackers count on finding outdated. A software inventory that only covers the obvious names covers the smaller part of the risk. When Denmark’s threat level for destructive cyberattacks rose to high in September 2026, SAMSIK’s guidance listed employees’ clients and software as a separate update item, which is the part of the advice that lands on the endpoint team. ### Building a Live Endpoint Application Inventory Application visibility has to be continuous to be useful. Application Manager inventories what is installed across the fleet and reports real-time posture by application and endpoint — which versions are current, which are behind, and where. A lightweight endpoint agent records the applications installed on each device and the version each is running, and detects missing or outdated ones automatically, so the inventory reflects the estate as it is now, not as it was at the last audit. That single source of truth is what turns application management from guesswork into a controlled operation. Inventory is not the goal — it is the foundation. Every step downstream depends on knowing what is actually installed. #### From Inventory to Automated Remediation Discovery is only the first move. Once IT teams can see what is behind, Application Manager closes the gap: a maintained catalog keeps common enterprise applications current automatically, no-code packaging brings your own line-of-business and legacy applications — the ones no catalog covers — under the same control without scripting, and staged rollouts move updates from a test ring to production at a controlled pace. Endpoints that are already current are skipped; the ones that are behind are remediated. The work that used to mean tracking, packaging, and chasing each update by hand becomes a governed, repeatable process. #### One Inventory, Prioritized by Real Risk An accurate application inventory also makes vulnerability work meaningful. Security Monitor prioritizes CVE risk across the operating system, applications, and drivers on top of that live inventory, so IT teams remediate by exploitability and scope rather than in alphabetical order. One inventory replaces the routine of querying separate tools and stitching the answers together. CapaOne runs standalone. For teams that use Microsoft Intune, it reuses existing Entra ID groups and honors the current structure — it works with or without Intune, with the same discovery either way. ### What a Complete Application Inventory Delivers Continuous visibility changes the daily reality of endpoint operations. IT teams move from reactive catch-up to a posture they can prove: - A real answer to “which endpoints are exposed right now?” — surfaced in minutes, not reconstructed from stale scans. - Audit-ready evidence on demand — export patch status by application and endpoint as CSV, giving IT teams the documentation NIS2, ISO 27001, and SOC 2 reviews ask for, without manual record-keeping. - Targeted remediation — close the highest-risk exposure first, instead of blanket-updating an estate you cannot fully see. - Fewer tools — one platform absorbs the point solutions that used to handle discovery, patching, and reporting separately. The strategic point sits underneath all four. Patching, audit readiness, vulnerability management, and standardizing on approved versions all rest on the same foundation: knowing what is actually running. Application inventory is one layer of that foundation; endpoint asset management adds hardware, drivers, and configuration posture to the same live record. Get the inventory right and the rest becomes routine. Leave it to guesswork and every downstream process inherits the blind spot. CapaOne keeps that foundation live — GDPR-first and NIS2-aligned by design, Danish-built and EU-hosted, with endpoint and inventory data under European jurisdiction. Want to see your own estate clearly? Book a demo of the CapaOne Endpoint Management Platform to see continuous application discovery on real endpoints — or prefer to explore first? Start a free trial and inventory your own environment hands-on. ### Frequently Asked Questions **What Is Endpoint Application Inventory?** Endpoint application inventory is a continuously updated record of which applications — and which versions — run on every device across an organization. It goes beyond a one-time scan by tracking version drift, new installs, and applications that fall behind between update cycles. An accurate inventory is the foundation for patching, because IT teams cannot remediate exposure they cannot see. CapaOne builds this inventory automatically through Application Manager. **Why Can't IT Teams Patch Applications They Can't See?** Patching depends on knowing what is installed and which versions are current. When inventory relies on manual scans or spreadsheets, it goes stale the moment a device installs, updates, or misses an update cycle. Applications outside the operating system — browsers, runtimes, and line-of-business tools — drift quietly, and offline devices fall further behind. Without continuous discovery, the gap between what IT teams think is deployed and what is actually running keeps widening. **How Does CapaOne Discover Applications Across Every Endpoint?** A lightweight endpoint agent inventories what is installed across the fleet and reports real-time posture by application and endpoint. It detects missing or outdated applications automatically, skips endpoints that are already current, and remediates the ones that are not. Discovery runs continuously, so the inventory reflects the estate as it is now — not as it was at the last scan. **How Do I Get Audit Evidence of Application Versions Across Endpoints?** CapaOne reports patch status for every covered application and endpoint, and exports that evidence as CSV on demand. This gives IT teams the documentation that NIS2, ISO 27001, and SOC 2 reviews ask for, without manual record-keeping. CapaOne is Danish-built and EU-hosted, so endpoint and inventory data stays under European jurisdiction. Book a Demo → Start Free Trial --- URL: https://capaone.com/blog/automated-driver-management-fleet-stability/ Published: 2026-07-27 Summary: Drivers don't stay fixed after deployment. CapaOne's automated driver management keeps the whole Windows fleet current and stable. ← All articles Insights ## Automated Driver Management: Keeping Windows Fleets Stable After Deployment The driver that was perfect at deployment goes stale — and outdated drivers quietly turn into crashes, dropped Wi-Fi, and support tickets. By CapaOne Support · July 27, 2026 Automated driver management matters most in the weeks after a device ships, not the hour it’s deployed. A laptop can leave provisioning with exactly the right drivers and still bluescreen a month later — the vendor pushed a fix, a firmware update landed, a new model joined the fleet — and the driver that was perfect on day one is the problem by day forty. Getting the right drivers onto a new device is only the first step. Keeping them right across a changing fleet is the part most teams still do by hand. ### Why Drivers Don’t Stay Fixed Drivers aren’t set-and-forget. Every hardware vendor — Dell, HP, Lenovo, Microsoft — ships driver and firmware updates on its own schedule, for its own models, to fix bugs, close security holes, and keep hardware stable. Across a mixed fleet of a few hundred devices, that becomes a constant stream of updates that never lines up neatly. Skip them and stability slowly degrades: intermittent crashes, docking-station failures, and performance complaints that are hard to trace back to a driver. Chase them by hand and IT spends its week downloading vendor packs, testing them, and pushing updates model by model — the same manual toil that made driver management painful in the first place. Modern management moved to the cloud, but the vendor-driver lifecycle didn’t get simpler: it’s still per-OEM, per-model, and constant, whichever console you run it from. ### Automated Driver Management Across the Fleet CapaOne closes the loop in Provision Manager. It matches vendor-certified driver packs to each hardware model automatically — and keeps them current across the Windows fleet, not just at first boot. Automated doesn’t mean reckless: the newest driver isn’t always the safest, so updates roll out in stages through your existing Entra ID groups — validated on a pilot group before they reach everyone — with configurable user prompts and reboot deadlines so they land on your schedule instead of mid-task. The result is what the product is built for: a more stable fleet, with fewer driver-caused crashes and the tickets that follow them. In practice it fades into the background — as one IT administrator described the daily rhythm: “Every day at 10 a.m. and 2 p.m., CapaOne checks that all drivers and applications are up to date — and if they’re not, it’s handled automatically. Users don’t notice it, and I know everything is under control.” ### Where It Fits With Your Deployment and Intune Getting the right drivers onto a bare-metal device is the other half of the story — CapaOne handles that too, as part of cloud-native provisioning, so a new machine boots complete. From there, automated driver management keeps it that way. Run it standalone as your endpoint provisioning foundation, or alongside Microsoft Intune — with or without it. Intune isn’t empty here: its Windows driver update policies can approve, pause, and phase the drivers Microsoft publishes through Windows Update. What they leave out is the vendor-certified packs each OEM ships for its own models, the model-aware matching that puts the right pack on the right hardware, and driver provisioning on a bare-metal device — Microsoft’s own guidance notes driver updates aren’t supported during Autopilot. That is the layer CapaOne adds, as one workflow from bare metal through ongoing maintenance, on the Entra ID groups you already have. ### Drivers Are the Maintenance No One Schedules Deployment gets the attention because it’s visible — a new device, a clean image, a user up and running. Drivers are the opposite: invisible until one goes wrong, and then it’s a crash, a ticket, and a morning lost to troubleshooting. Automating the ongoing part is how a fleet stays stable without stealing IT’s week. Book a demo of the CapaOne platform to see automated driver management run across a fleet — or start a free trial and try it on your own devices. ### Frequently Asked Questions **What Is Automated Driver Management?** Automated driver management keeps vendor-certified drivers matched to each hardware model and current across the fleet — not just at deployment, but continuously as vendors release updates and new models arrive. Instead of downloading, testing, and pushing driver packs by hand, IT sets policy once and the platform handles the ongoing rollout. CapaOne runs it inside Provision Manager. **Why Do Drivers Cause Problems After a Device Is Deployed?** A driver that works on day one doesn't stay current. Vendors ship fixes and firmware updates on their own schedules, and new hardware models keep entering the fleet. Left unmanaged, outdated or mismatched drivers cause intermittent crashes, docking and Wi-Fi failures, and performance issues that are hard to trace — the kind of instability that generates support tickets long after deployment is done. **How Does CapaOne Keep Drivers Updated Across the Fleet?** Provision Manager rolls out driver updates as staged deployments through your existing Entra ID groups, on scheduled workflows, with configurable user prompts and reboot deadlines so updates land on your schedule instead of mid-task. It applies the correct vendor-certified pack for each detected hardware model, so a mixed fleet of different makes and models stays current without manual per-model work. **Does Automated Driver Management Improve Fleet Stability?** It can, when it's done in a controlled way. Consistent, vendor-certified drivers reduce the crashes, hardware failures, and performance complaints that outdated or mismatched drivers cause — but the newest driver isn't automatically the safest. The gain comes from keeping drivers current and rolling updates out in stages, validated on a pilot group before they reach the whole fleet, so a bad driver can't destabilize everything at once. Book a Demo → Start Free Trial --- URL: https://capaone.com/blog/endpoint-security-danish-public-sector/ Published: 2026-07-24 Summary: CapaOne strengthens endpoint security for the Danish public sector — patching, least-privilege, drift visibility in one EU-hosted platform. ← All articles Insights ## Endpoint Security for the Danish Public Sector: Three Basics Close Most Gaps The Danish public sector faces a real threat with teams stretched thin. But the gaps letting attackers in are the most basic — and the most fixable. By Rikke Borup, CMO, CapaSystems · July 24, 2026 For all the attention on sophisticated cyberattacks, the biggest threat to endpoint security for the Danish public sector is something far more ordinary — basic maintenance that never got finished. When Denmark’s national audit office reviewed state network equipment across 23 ministries, nearly all of it carried critical vulnerabilities — and 91 percent could have been fixed with updates that were already available. That review covered state equipment, but the pattern runs across the public sector: the danger is rarely exotic. It’s hygiene left undone. The pressure is sector-wide, and municipalities feel it most acutely. 57 percent of Danish public institutions were hit by a disruptive cyberattack in the past year, and 98 percent of municipal IT leaders say the threat now outstrips their resources. With teams that thin, the answer isn’t more tools to watch. It’s the few basics that close the most gaps — in one place. ### Why the Danish Public Sector Is Exposed The reasons are structural, not exotic. Public-sector organizations — municipalities most of all — run critical services and hold large volumes of sensitive citizen data, often on systems built up over many years and maintained by small teams. Years of underinvestment in IT security have left a backlog that is hard to close under new pressure. NIS2 has raised the bar, but the gap isn’t paperwork — it’s operational: unpatched software, standing administrator rights, and blind spots where no one can see how a device is actually configured. Those three openings are most of an organization’s real attack surface, and each maps to a basic almost any estate can get right. ### Improving Endpoint Security for the Danish Public Sector CapaOne consolidates those basics into one console — which matters most for a public-sector team that can’t run five separate tools. Patch what can already be patched: Application Manager keeps third-party and business applications updated automatically, closing the exact gap the auditor found. Remove the privileges attackers rely on: Privilege Manager removes standing local admin in favor of just-in-time elevation through existing Entra ID groups — “Standing local admin was our biggest unresolved risk. CapaOne removed it fleet-wide in a single afternoon,” as one Danish municipal IT team put it. See what’s drifting: Security Monitor surfaces exposure and configuration drift across the fleet, with audit-ready evidence — the documentation an auditor or oversight body asks for, produced as a by-product of daily operations rather than a separate project. Together they are the three fundamentals of endpoint cyber hygiene, in one platform instead of several. ### Danish-Built, EU-Hosted, With or Without Intune For a Danish public-sector buyer, where the data goes is part of the decision. CapaOne is Danish-built and EU-hosted, with no transfer of endpoint data to US jurisdiction — a GDPR-first, NIS2-aligned posture that fits public-sector procurement. Holbæk Kommune, which runs the platform across roughly 5,500 devices, put the procurement side simply: “EU hosting and GDPR alignment made the buying decision easy for us.” The platform runs standalone, or alongside Microsoft Intune — with or without it — targeting the Entra ID groups an organization already has. Ishøj Kommune runs it too. See how Holbæk uses it. ### The Gaps Are Old — Closing Them Isn’t Hard The most useful number in all of this is the auditor’s 91 percent — the share of critical vulnerabilities that could have been closed with updates that already existed. For a stretched public-sector IT team, that is good news: the exposure isn’t exotic, and the fix isn’t expensive tooling. It’s the basics, done consistently, in one place. Book a demo of the CapaOne platform to see how Danish public-sector teams run the three basics from a single EU-hosted console. ### Frequently Asked Questions **How Do You Improve Endpoint Security for the Danish Public Sector?** Start with the basics, done consistently: keep software patched, remove standing administrator rights, and maintain visibility into how devices are actually configured. Most public-sector breaches exploit gaps in those three areas, not exotic techniques. CapaOne consolidates all three in one EU-hosted platform, which suits the small teams most public organizations run. **Why Is the Danish Public Sector Being Targeted by Cyberattacks?** Public-sector organizations run critical services and hold large volumes of sensitive citizen data, often on older systems maintained by stretched teams. Danish figures show most public institutions have been hit and that IT leaders consider the threat larger than their resources. That combination of high value and thin capacity makes the sector an attractive target, with municipalities among the most exposed. **Is CapaOne EU-Hosted and GDPR-Aligned?** Yes. CapaOne is Danish-built and EU-hosted, with no transfer of endpoint data to US jurisdiction. It gives public-sector organizations a GDPR-first, NIS2-aligned posture and the audit-ready evidence procurement and oversight require. **Is Patching Enough to Secure a Public-Sector IT Estate?** Patching is essential but not sufficient. It is one of three basics, alongside removing standing admin rights and maintaining exposure visibility. That said, Denmark's national audit office found that most critical vulnerabilities on reviewed public-sector equipment could have been closed with updates that already existed — so consistent patching alone closes a large share of the risk. Written by Rikke Borup CMO, CapaSystems Rikke is Chief Marketing Officer at CapaSystems, where she has led marketing and communications since 2009. With more than 17 years of experience in the IT sector — including cybersecurity, endpoint management software and IT services — she brings long-standing, practical insight into the challenges facing modern enterprise IT environments. Trained as a journalist, Rikke specializes in translating complex technical concepts into clear, easy-to-understand communications for IT decision-makers. More from Rikke Borup → LinkedIn ↗ Book a Demo → --- URL: https://capaone.com/blog/endpoint-configuration-drift-patching-exposure/ Published: 2026-07-22 Summary: Patching closes only half your exposure. CapaOne Security Monitor surfaces endpoint configuration drift across the fleet. ← All articles Insights ## Endpoint Configuration Drift: The Exposure Patching Doesn't Close The largest Patch Tuesday ever landed in July. It also proved a patched fleet can still stand open — the other half of exposure is configuration. By CapaOne Support · July 22, 2026 You can patch every endpoint on the largest Patch Tuesday in history and still leave the fleet exposed — because endpoint configuration drift is the half of exposure a patch never touches. July 2026 brought that record: Microsoft shipped fixes for a record 570 CVEs, driven by a new AI vulnerability-discovery system. But the sharper lesson wasn’t the volume. It was how the exploited flaws were handled: not with a patch alone. When attackers began exploiting a SharePoint zero-day, CISA didn’t just tell teams to patch — it urged them to harden: enable additional request scanning, block external access to admin interfaces, rotate keys, and hunt for signs of intrusion, warning that a patch alone may not evict an attacker who is already inside. That advice was for on-premises servers, but the principle is universal. Exposure is patches plus configuration. And across the endpoint fleet, the configuration side is what most teams can’t see. ### Why Patching Only Closes Half the Exposure Patching answers one question: which known flaws are unremediated? It’s essential — and at that volume, deciding which to fix first is a discipline of its own. But even a perfectly patched, perfectly prioritized fleet can sit in an insecure state. Configuration drift is the gradual movement of devices away from a secure baseline, even when they are fully patched. A firewall switched off during troubleshooting and never re-enabled. Disk encryption disabled on a reimaged laptop. A Windows Update service paused “temporarily.” A local policy exception that outlived its reason. None of these is a missing patch, so patch reports show green while the device quietly stays part of your attack surface. Drift builds one small change at a time, and it stays exploitable long after the last update installed. ### Making Endpoint Configuration Drift Visible CapaOne Security Monitor surfaces the configuration side from one console. Alongside CVE exposure, it shows the signals that reveal drift — firewall state, encryption status, Windows Update posture — across every endpoint, so IT can see where devices have wandered from a secure baseline instead of assuming a green patch report means a hardened fleet. Security Monitor is a visibility and evidence layer, not a SIEM or an EDR — it doesn’t chase threats; it shows you where you’re exposed and lets you prove it. That evidence matters beyond operations. Modern frameworks increasingly expect organizations to show that controls stay effective over time — not merely that patches are installed. When an auditor or a cyber-insurer asks you to demonstrate hardening rather than assert it, Security Monitor exports audit-ready evidence on demand — what drifted, where, and when — in a GDPR-first, NIS2-aligned posture. ### One View of the Fleet, With or Without Intune Security Monitor covers the whole fleet on its own, in one console with no dependency on Intune. If you already patch through Intune or Windows Autopatch, CapaOne adds what they don’t cover: fleet-wide configuration and drift visibility, with or without Intune, targeting your existing Entra ID groups. The patch pipeline stays where it is; the configuration side becomes something you can finally see. ### Exposure Is Bigger Than Your Patch Queue AI-driven discovery means patch volumes will keep climbing — a month like July’s is a floor, not a ceiling. The teams that stay ahead won’t be the ones who patch fastest. They’ll be the ones who can also see where configuration has drifted, and prove they’ve closed it. Patching will always be half the job. The other half is visibility. Book a demo of the CapaOne platform and see where your own fleet has drifted from a secure baseline, not just which patches it’s missing. ### Frequently Asked Questions **What Is Endpoint Configuration Drift?** Endpoint configuration drift is what happens when devices gradually move away from a secure baseline — a firewall switched off, disk encryption disabled, a Windows Update service paused, a temporary exception never rolled back. Each change looks small, but together they open exposure that patching never touches, because a fully patched device can still sit in an insecure state. **Why Isn't Patching Enough to Secure Endpoints?** Patching removes known software flaws, but it does nothing about how a device is configured. Even July 2026's exploited SharePoint zero-day came with hardening guidance, not just a patch — a reminder that a fix alone doesn't always close the underlying exposure. Real security is patches plus configuration, and most teams can see the first but not the second. **How Does CapaOne Show Configuration Drift Across the Fleet?** CapaOne Security Monitor surfaces configuration and exposure signals across every endpoint from one console — firewall state, encryption status, Windows Update posture, and CVE exposure — so IT can see where devices have drifted from a secure baseline and export audit-ready evidence. It's a visibility and evidence layer, not a SIEM or an EDR. **Is Configuration Drift the Same as Missing Patches?** No. Missing patches are known vulnerabilities left unremediated; configuration drift is a device wandering from its secure baseline even when fully patched. They are two separate axes of exposure, and closing one leaves the other open — which is why fleet-wide visibility into both matters. Book a Demo → --- URL: https://capaone.com/blog/reduce-endpoint-management-costs-microsoft-365-price-rise/ Published: 2026-07-20 Summary: The Microsoft 365 price rise is a chance to reduce endpoint management costs — CapaOne unifies your point tools in one EU-hosted platform. ← All articles Insights ## Reduce Endpoint Management Costs After the Microsoft 365 Price Rise Microsoft folded more of Intune into E3 and E5 and raised the price. The real question isn't the license line — it's how many tools sit around it. By Rikke Borup, CMO, CapaSystems · July 20, 2026 The most effective way to reduce endpoint management costs after the July 1, 2026 Microsoft 365 price rise isn’t another tool — it’s fewer of them. If your Microsoft 365 bill climbed this month, the savings aren’t inside Microsoft; they’re in everything stacked around it. Microsoft raised Microsoft 365 E3 to $39 and E5 to $60 per user per month and folded the Intune Suite into E5, and part of it into E3, at no separate charge (Microsoft’s announcement). The license got more capable — which makes 2026 the moment to look past it and count the tools it still doesn’t replace. ### What the Bundle Covers — and What It Leaves Open The bundle is real value for teams that used to pay for these capabilities separately. But “included in the license” is not the same as “managed end to end,” and the difference is where cost quietly stays. For teams that bought these add-ons à la carte, the left column below genuinely consolidates a slice of spend. It’s the right column that decides your 2026 budget. Now in the bundle | Still a separate concern | Endpoint Privilege Management (E5) | Broad third-party and in-house app lifecycle | Cloud PKI (E5) | Driver lifecycle | Enterprise App Management — curated Windows catalog (E5) | Bare-metal OS deployment | Remote Help, Advanced Analytics, Plan 2 (E3) | Cross-platform coverage beyond Windows | Enterprise Application Management deploys and updates software from a curated catalog of prepackaged Windows apps — but that catalog, while expanding, doesn’t cover the full breadth of third-party and in-house applications a real estate runs; its auto-update offers no rollback or automated remediation, and it stops at Windows (Microsoft’s own documentation). Those applications are among the most exploited parts of the attack surface, yet they sit only partly inside the bundle. The license grew more capable — but drivers, provisioning, cross-platform coverage, and the long tail of applications stay separate contracts, separate agents, separate consoles, separate renewals. ### How to Reduce Endpoint Management Costs Without Adding Tools CapaOne closes those gaps from one console, so work that would otherwise mean separate tools, agents, and renewals runs on a single platform — and each open gap maps to one capability, not one more vendor. The third-party and in-house application lifecycle the catalog can’t reach runs through Application Manager, with no-code packaging, automated patching, and staged deployment across a broad portfolio. Privilege governance moves to Privilege Manager, which removes standing local admin in favor of time-bound, policy-based elevation through existing Entra ID groups, every event logged for audit. Provisioning and driver lifecycle sit in Provision Manager — cloud-native bare-metal OS deployment with no on-prem imaging infrastructure. One lightweight agent feeds all of it. The cost model is deliberately simple. CapaOne prices per endpoint — EUR 1 per endpoint, per month, per product — and Windows customers choose up to five products while paying for a maximum of three. That collapses a set of separately negotiated point-tool contracts into one predictable line item — a total cost of ownership you can put in front of a board, not a spreadsheet of renewals to reconcile. ### One Console, With or Without Intune CapaOne runs as a complete endpoint management platform on its own, with no dependency on Intune. For the many teams that already run Intune, the two divide the work cleanly: Intune keeps enrollment and compliance where they already sit, and CapaOne owns endpoint operations end to end — the third-party patching, driver lifecycle, and privilege control Intune does not cover natively — targeting your existing Entra ID groups with no rip-and-replace. The consolidation shows up in daily operations, not just the contract. Instead of juggling separate vendors, agents, and consoles, NIRAS runs its estate from one platform: “We manage 3,000 devices across 60 offices from one platform — without an army of admins.” The point solutions a single platform replaces also replace the context-switching and the separate audits that never appear on a license quote. ### The Real Cost Question for 2026 The July price rise is not really about $3 per seat. It is a prompt to ask a larger question: how many consoles, agents, contracts, and audits does it take to keep the estate secure — and how many of those could be one? Microsoft didn’t make endpoint management more expensive. It made redundant point tools much harder to justify. Book a demo of the CapaOne platform to see it run on your own estate, with or without Intune. ### Frequently Asked Questions **How Do You Reduce Endpoint Management Costs After the Microsoft 365 Price Rise?** Consolidate first. The most durable way to reduce endpoint management costs is to collapse separately licensed point tools — patching, privilege control, provisioning — into one platform with predictable per-endpoint pricing, rather than adding another tool on top of a bill that just went up. CapaOne unifies those operations in a single EU-hosted console. **Does the Microsoft 365 Bundle Cover Third-Party Application Patching?** Only in part. Enterprise Application Management deploys and updates apps from a curated catalog of prepackaged Windows apps, but that catalog does not cover the full breadth of third-party and in-house applications a typical estate runs, and it stops at Windows. Broad third-party and business-app coverage still needs a dedicated capability. **Can CapaOne Replace Point Tools Without Replacing Intune?** Yes. CapaOne runs as a complete endpoint management platform on its own, or works alongside Intune — the two divide the work cleanly. Intune keeps enrollment and compliance where they already sit, and CapaOne owns the third-party patching, driver lifecycle, and privilege control Intune does not cover natively, targeting your existing Entra ID groups with no rip-and-replace. **What Does CapaOne Cost per Endpoint?** CapaOne prices per endpoint: EUR 1 per endpoint, per month, per product. Windows customers can choose up to five products and pay for a maximum of three. That turns a set of separately negotiated point-tool contracts into one predictable line item, hosted entirely in the EU. Written by Rikke Borup CMO, CapaSystems Rikke is Chief Marketing Officer at CapaSystems, where she has led marketing and communications since 2009. With more than 17 years of experience in the IT sector — including cybersecurity, endpoint management software and IT services — she brings long-standing, practical insight into the challenges facing modern enterprise IT environments. Trained as a journalist, Rikke specializes in translating complex technical concepts into clear, easy-to-understand communications for IT decision-makers. More from Rikke Borup → LinkedIn ↗ Book a Demo → --- URL: https://capaone.com/blog/cloud-native-bare-metal-deployment/ Published: 2026-07-15 Summary: MDT is retired and Autopilot needs a working OS. CapaOne delivers cloud-native bare-metal deployment and recovery — no on-prem server. ← All articles Blog ## Cloud-Native Bare-Metal Deployment When MDT Is Gone Autopilot provisions from a working OS. When the disk is blank — new hardware, a wiped machine, a recovery — something still has to put Windows on bare metal. By CapaOne Support · July 15, 2026 Microsoft retired the Microsoft Deployment Toolkit on January 6, 2026, but bare-metal deployment did not retire with it. Cloud-native bare-metal deployment is what fills the gap: putting a full operating system onto an empty disk — a new machine, a wiped device, a recovery — entirely over the internet, rather than from a local PXE server or imaging share. For over twenty years MDT was how many IT teams did exactly that, from infrastructure they hosted themselves. Now the tool is gone, and the need is not. ### Why Autopilot Doesn’t Close the Bare-Metal Gap When Microsoft retired MDT, it pointed customers to Windows Autopilot for cloud deployment or Configuration Manager for on-premises OSD. Neither fully covers bare metal. Autopilot works from the Windows image a device already ships with from the factory — it applies configuration, policies, and apps, but it does not image an empty disk. Configuration Manager can image bare metal, but only with on-premises servers and boot media to maintain. That leaves a real set of everyday scenarios uncovered: custom hardware that arrives without your image, a machine wiped after a fault, a device reissued to a new user, or a full rebuild after ransomware. Each one starts from a blank disk, and each one is exactly where Autopilot expects a working OS to already exist. The timing sharpens it. Windows 10 reached end of support on October 14, 2025, and the resulting Windows 11 refresh is putting more new and repurposed hardware through IT teams than any migration in years — right as the tool many of them used for imaging disappeared. ### What Cloud-Native Bare-Metal Deployment Requires A modern replacement for MDT has to do more than copy an image to a disk. Five things make bare-metal deployment work without on-premises infrastructure: - Boot and image over the internet. A device with an empty disk should provision from anywhere, without a deployment server on the local network. - One gold image for the whole fleet. A single image, not a separate build per hardware model, keeps the process maintainable. - Drivers matched to the hardware automatically. The right vendor drivers get applied at deployment based on the model detected — no manual research. - First-time provisioning and recovery, both. The same path that stands up a new device also rebuilds a failed or repurposed one. - No on-premises footprint to maintain. No PXE server, no boot media library, no imaging share to keep patched. ### How CapaOne Provisions Bare Metal From the Cloud CapaOne closes that gap from one EU-hosted endpoint management platform, built cloud-native so there is no on-premises deployment server to stand up or secure. It works as a full MDT replacement on its own, and as the bare-metal layer underneath a modern setup. #### One Gold Image, the Right Drivers Automatically Provision Manager deploys a single gold image to bare-metal devices and orchestrates drivers at deployment time — applying vendor-certified, model-aware driver packs matched to the hardware it detects. One image works across different models, without manual driver research or a separate build per device. That is endpoint provisioning without the on-premises machinery it used to require. #### Provision and Recover From Anywhere Because the whole workflow runs over the internet, IT provisions a new device or rebuilds a wiped one from wherever it is — no USB round, no shipping a machine back to base. The same path handles first-time setup and recovery, so a rebuild follows the process your team already knows. For organizations running Autopilot, this fits alongside it rather than competing with it. Autopilot needs a working OS; Provision Manager provides one. CapaOne works with your Microsoft setup, or entirely without it — Autopilot takes new factory devices from the box, and Provision Manager covers the bare-metal deployment and recovery it was never designed for. ### Bare-Metal Recovery After a Failure or Ransomware Provisioning and recovery are the same problem seen at two different moments. A device that arrives blank and a device wiped by a fault or a ransomware attack both start from an empty disk — the only difference is whether you planned it. A bare-metal path matters most exactly when things go wrong. When an endpoint has to be rebuilt, Provision Manager reimages it from the cloud the same way it provisions a new one: one gold image, the right drivers for the hardware, no trip back to a deployment server. For a team recovering many machines after an incident, that turns rebuild from a bottleneck into a repeatable step — the device boots, pulls its image over the internet, and returns to a known-good state. ### What Changes for IT Run CapaOne standalone, and the deployment gap MDT left behind simply closes: one gold image, drivers handled automatically, new builds and recoveries from anywhere, and nothing on-premises to maintain. Instead of running deployment servers, updating boot images, and rebuilding driver libraries, IT maintains a single cloud workflow. The Windows 11 refresh becomes a repeatable process rather than a series of one-off rebuilds. The shift is from imaging as an on-site chore to provisioning as a cloud service. Your team stops maintaining servers and boot media, and starts rebuilding any device, anywhere, in the time it takes to boot it. See how CapaOne provisions Windows onto bare metal from anywhere — no PXE server, no imaging share, no on-premises deployment infrastructure. Book a demo to see it live — or start a free trial and provision a device yourself. ### Frequently Asked Questions **What Is Cloud-Native Bare-Metal Deployment?** Cloud-native bare-metal deployment installs a full operating system onto a device with an empty disk — new hardware, a wiped machine, or a recovery — over the internet, without an on-premises imaging server or boot media. It combines the OS image, drivers, and configuration in one cloud-driven workflow, so IT can provision and rebuild devices from anywhere. **What Replaces MDT for Bare-Metal Windows Deployment?** Microsoft retired the Microsoft Deployment Toolkit on January 6, 2026 and points customers to Windows Autopilot or Configuration Manager OSD. Autopilot provisions from a device's existing OS rather than imaging bare metal, and Configuration Manager needs on-premises infrastructure. A cloud-native provisioning platform such as CapaOne Provision Manager covers the bare-metal layer both leave open. **Does Autopilot Handle Bare-Metal Reimaging?** Not on its own. Autopilot applies configuration, policies, and apps to a device that already has a working Windows image from the factory. It does not image a blank disk, rebuild a failed machine, or reload the OS on repurposed hardware. Those bare-metal scenarios need a separate provisioning path. **How Does CapaOne Provision Devices From the Cloud?** CapaOne Provision Manager deploys a full Windows image to bare-metal devices over the internet — no on-premises deployment server and no manual USB round. It applies one gold image, matches vendor-certified drivers to the detected hardware automatically, and handles both first-time provisioning and recovery from anywhere. **How Does CapaOne Handle Drivers During Deployment?** Provision Manager orchestrates drivers at deployment time: it applies vendor-certified, model-aware driver packs matched to the hardware it detects, so a single gold image works across different device models without manual driver research or a separate image per model. Book a Demo → Start Free Trial --- URL: https://capaone.com/blog/privileged-access-governance/ Published: 2026-07-14 Summary: Least privilege is now default. CapaOne brings privileged access governance — elevation, logging, and drift visibility — across your fleet. ← All articles Blog ## Privileged Access Governance When Least Privilege Becomes Standard Elevation is now bundled into the license everyone owns. The unsolved part is governing it — with logging and drift control — across a mixed fleet. By Rikke Borup, CMO, CapaSystems · July 14, 2026 Privileged access governance has become the real endpoint security question of 2026. Removing standing local admin and granting just-in-time elevation is no longer the hard part — that capability is now widely available. The hard part is governing it: enforcing elevation consistently, logging every grant as audit evidence, and catching configuration drift across an entire mixed fleet. Standing local admin is still what ransomware and lateral movement feed on, and it rarely lives only on the devices a single tool happens to manage. ### Why Least Privilege Alone Doesn’t Close the Gap Least privilege has long been the baseline every security framework recommends, and the tooling to enforce it is now mainstream. As of July 1, 2026, Microsoft folded Endpoint Privilege Management into the Microsoft 365 E5 license — elevation that once required a paid add-on now ships with a subscription most enterprises already hold. The control itself is no longer the differentiator. Consistent governance across the whole estate is. The stakes sit in the gaps. Insider risk now costs organizations an average of $19.5 million a year, and negligent insiders — not malicious ones — drive the largest share at $10.3 million, up 17% year over year. Standing local admin is the mechanism underneath much of that: it is what privilege escalation exploits, and what lets an attacker move laterally once a single account is compromised. Elevation you cannot see or account for is exposure you cannot manage. In practice, the gap shows up as manual work. Teams export elevation logs from one tool, check local administrator group membership with another, and verify by hand that endpoint baselines still match policy — across a fleet where only some devices sit under a single management tool. A tool that only handles elevation still leaves the governance spread across tools. Governance that depends on stitching three exports together is governance that slips. ### What Privileged Access Governance Actually Requires Governance turns least privilege from a setting into a defensible practice. Five things have to hold across every endpoint, not a subset: - No standing local admin. Persistent local administrator rights are the underlying exposure; removing them is the starting point. - Policy-based, just-in-time elevation. Users elevate for a specific approved task, tied to their existing identity, then drop back down. - Full logging as audit evidence. Record every elevation, so an auditor sees who elevated what, when, and why. - Continuous drift detection. A hardened baseline that quietly slips reopens the risk you closed — you need to see it happen. - One consistent model across the fleet. Windows, and everything else, under the same privileged access controls — not governance on the managed subset and guesswork on the rest. ### How CapaOne Delivers Privileged Access Governance CapaOne puts that whole model in one endpoint management platform that is EU-hosted and Danish-built, with no transfer of endpoint data to US jurisdiction. #### Just-in-Time Elevation, No Standing Local Admin Privilege Manager removes standing local admin and grants policy-based, just-in-time elevation through your existing Entra ID groups. Users get exactly the elevation an approved task needs, tied to the identity they already have — no permanent admin accounts to inventory, and nothing standing for an attacker to inherit. It anchors a working endpoint privilege management practice without new identity plumbing. #### Logging and Drift Visibility for Audit Evidence Privilege Manager logs every elevation it grants, so the record an auditor asks for is already there. Security Monitor adds the other half: it shows which endpoints still carry standing local admin and where configurations have drifted from the secure baseline, so deviations surface before they become findings. Together they make least privilege continuously visible — not a claim, but a state you can see. ### Governance Is About Evidence, Not Just Control Control decides what should happen. Governance proves what did. That distinction is what an auditor, a cyber-insurer, or a board actually tests — not whether a least-privilege policy exists, but whether you can show it held, on every endpoint, over time. This is where privileged access governance meets security and compliance obligations directly. A NIS2-aligned posture is not a point-in-time statement; it is the continuous evidence that standing admin stays removed, that each elevation was authorized and logged, and that drift gets caught. CapaOne produces that evidence as a by-product of daily operation, so the answer to “prove it” is already on hand rather than assembled the week before a review. ### What Changes for IT and the Board Run CapaOne standalone, and privileged access governance covers the entire fleet from day one: no standing admin, elevation on request, every grant logged, drift in view — from one console instead of three exports. CapaOne works with Microsoft Intune, or entirely without it — if you already run Intune EPM on your Windows estate, CapaOne brings the same elevation, logging, and governance to the rest of the fleet. For IT, that means fewer tools to reconcile and less manual verification. For the board, least privilege stops being a policy on paper and becomes one fewer way for a careless moment to turn expensive. See how CapaOne removes standing admin rights, records every elevation, and continuously verifies least privilege across your fleet. Book a demo to see privileged access governance in one console. ### Frequently Asked Questions **What Is Privileged Access Governance?** Privileged access governance is the practice of controlling, recording, and continuously verifying how users gain elevated rights across every endpoint — not just granting just-in-time elevation, but logging each grant as audit evidence and detecting when devices drift from the least-privilege baseline. It turns least privilege from a setting into something an organization can prove. **Why Isn't Just-in-Time Elevation Enough on Its Own?** Just-in-time elevation removes standing admin rights, which is essential — but on its own it does not tell you who elevated what, prove it to an auditor, or catch a device that has drifted back to a risky configuration. Governance adds the logging, evidence, and continuous visibility that make least privilege defensible, and applies them across the whole fleet rather than a managed subset. **How Does CapaOne Govern Privileged Access Across Endpoints?** CapaOne removes standing local admin and grants policy-based, just-in-time elevation through existing Entra ID groups with Privilege Manager, logging every grant for governance. Security Monitor shows which endpoints still carry standing admin rights and where configurations have drifted. Both run in one EU-hosted console, so governance stays consistent across the entire fleet. **How Does Privileged Access Governance Help With Audits?** It replaces point-in-time assertions with continuous evidence. Because every elevation is logged and configuration drift is monitored, the record an auditor or cyber-insurer asks for already exists — showing that standing admin stays removed and that each elevation was authorized. That supports a NIS2-aligned posture without a scramble to assemble proof before a review. **Does CapaOne Work With Microsoft Intune EPM?** Yes. CapaOne works with Microsoft Intune, or entirely without it. If you already run Intune Endpoint Privilege Management on your Windows devices, CapaOne brings the same elevation, logging, and governance to the rest of your fleet from one EU-hosted console. Run standalone, and CapaOne governs privileged access across every endpoint on its own. Written by Rikke Borup CMO, CapaSystems Rikke is Chief Marketing Officer at CapaSystems, where she has led marketing and communications since 2009. With more than 17 years of experience in the IT sector — including cybersecurity, endpoint management software and IT services — she brings long-standing, practical insight into the challenges facing modern enterprise IT environments. Trained as a journalist, Rikke specializes in translating complex technical concepts into clear, easy-to-understand communications for IT decision-makers. More from Rikke Borup → LinkedIn ↗ Book a Demo → --- URL: https://capaone.com/blog/endpoint-vulnerability-prioritization/ Published: 2026-07-13 Summary: CVE volume broke list-based tracking. Endpoint vulnerability prioritization with CapaOne targets the flaws that actually reach your fleet. ← All articles Blog ## Endpoint Vulnerability Prioritization When You Can't Patch Everything June 2026 set another CVE record, and even NIST now triages instead of enriching every flaw. Prioritizing beats counting. By CapaOne Support · July 13, 2026 Endpoint vulnerability prioritization has become the dividing line between a manageable security workload and an impossible one. Published vulnerabilities now arrive faster than any team can review them, let alone patch them — June 2026 alone brought 7,454 new CVEs, a 14.5% jump over May and the highest monthly total of the year. The old reflex — work down the list until it clears — no longer holds, because the list never clears. What works instead is deciding which vulnerabilities actually reach your fleet, and starting there. ### Why Endpoint Vulnerability Prioritization Beats Counting The risk is no longer defined by the single critical flaw. It is defined by volume, and by the speed from disclosure to active exploitation. NIST has restructured the National Vulnerability Database around exactly this pressure: since April 2026 it enriches only vulnerabilities that meet defined risk criteria — those in CISA’s Known Exploited Vulnerabilities catalog, those in federal software, and those classed as critical — after CVE submissions rose 263% between 2020 and 2025. When the reference database of record triages by risk, counting every CVE stops being a strategy. The exploitation data points the same way. In the same DKCERT report, nine of the ten most-observed vulnerabilities in June already appeared in CISA’s Known Exploited Vulnerabilities catalog. Most published CVEs never reach that stage. The ones that do are the ones that deserve your team’s first hour. ### A Practical Framework for Endpoint Vulnerability Prioritization Risk-based vulnerability management turns an infinite list into an ordered one. Five steps put CVE prioritization on a repeatable footing: - Identify which endpoints are affected. Map each vulnerability to the devices in your own fleet. A flaw that touches nothing you run is not your problem this week. - Elevate known exploited vulnerabilities. Anything in CISA’s KEV catalog is already under active attack. These move to the front, ahead of higher-scoring flaws with no exploitation in the wild. - Weight internet-facing and privileged systems. Exposure and blast radius raise priority. A vulnerability on a public-facing or high-privilege host outranks the same flaw on an isolated one. - Patch third-party applications first. They hold the largest share of the surface and are the fastest to shrink, which removes many vulnerabilities before they ever need manual triage. - Monitor for configuration drift. A hardened baseline that slips quietly reopens risk you already closed. Continuous visibility keeps the shortlist short. ### Prioritize by Exposure, Not by List Length The framework needs two things working together: visibility into where you are actually exposed, and a way to shrink that exposure without manual effort. CapaOne delivers both from one EU-hosted endpoint management platform. #### See Which Endpoints Are Actually Exposed Instead of treating every published CVE equally, Security Monitor shows which vulnerabilities actually affect your managed endpoints, so IT teams focus remediation where exposure exists first. It surfaces the same signal for configuration drift, flagging where a device has slipped from its secure baseline. That turns an abstract global list into a concrete, fleet-specific picture — the input a working vulnerability management practice actually needs. #### Shrink the Third-Party Attack Surface Automatically The fastest way to cut the vulnerabilities that need manual prioritization is to remove outdated third-party applications automatically. Most of the CVE surface lives outside the operating system — in browsers, document readers, runtimes, and conferencing tools — and Application Manager keeps them packaged and patched without manual effort. Fewer outdated applications means a shorter list to triage in the first place. ### What Changes for Your IT Team Run standalone, and CapaOne covers the whole loop in one console: see fleet exposure, patch the third-party surface automatically, and act first on the vulnerabilities under active attack. CapaOne works with Microsoft Intune, or entirely without it — if Intune or Autopatch already handles your Windows updates, CapaOne adds automated third-party application patching and fleet-wide exposure visibility alongside it. The shift is one of posture. Your team stops measuring progress by how much of an infinite list it cleared, and starts measuring it by how quickly the flaws that matter get closed. That is a defensible answer for an auditor, and a saner week for the people doing the work. See how CapaOne helps IT teams identify exposed endpoints, prioritize the flaws under active attack, and automate third-party patching from one console. Book a demo to see it live. ### Frequently Asked Questions **What Is Endpoint Vulnerability Prioritization?** Endpoint vulnerability prioritization is the practice of ranking known vulnerabilities by real exposure — which of your endpoints are affected, and which flaws are under active attack — instead of trying to patch every published CVE. It replaces list length with risk, so IT teams act first on the vulnerabilities that actually reach their fleet. **Why Can't IT Teams Just Patch Every CVE?** Published CVEs now arrive faster than any team can review, let alone remediate. Even NIST moved the National Vulnerability Database to a risk-based model in 2026, enriching only the flaws that meet defined risk criteria. Chasing the full list does not scale; prioritizing by exposure and active exploitation does. **How Do You Prioritize Endpoint Vulnerabilities?** Start by identifying which endpoints a vulnerability actually affects, then elevate anything in CISA's Known Exploited Vulnerabilities catalog, since those flaws are already under attack. Give internet-facing and privileged systems higher weight, patch outdated third-party applications automatically to shrink the surface, and monitor for configuration drift so a hardened baseline stays hardened. **How Does CapaOne Help Prioritize Endpoint Vulnerabilities?** CapaOne pairs visibility with automated patching in one console. Security Monitor shows which vulnerabilities actually affect your managed endpoints, so IT can focus remediation where exposure exists first. Application Manager keeps third-party applications patched automatically, removing the largest part of the attack surface before it becomes a triage problem. **Does CapaOne Work With Microsoft Intune for Patching?** Yes. CapaOne works with Microsoft Intune, or entirely without it. If Intune or Autopatch already handles your Windows updates, CapaOne adds automated third-party application patching and fleet-wide exposure visibility alongside it. Run standalone, and CapaOne covers the full prioritize-and-patch loop on its own. Book a Demo → --- URL: https://capaone.com/blog/european-endpoint-management-platform-checklist/ Published: 2026-07-07 Summary: How to choose a European endpoint management platform: EU hosting, device coverage, automation, and audit-ready reporting. CapaOne. ← All articles Insights ## How to Choose a European Endpoint Management Platform Seven criteria that reveal whether a platform delivers real European control — or just a European address. By Rikke Borup, CMO, CapaSystems · July 7, 2026 A European endpoint management platform is only as sovereign as the criteria you buy it against. Most shortlists stop at the vendor’s headquarters and miss what decides the outcome: where the endpoint data lives, which devices the platform covers, how much it automates, and how easily it proves your security posture to an auditor. This guide sets out the seven criteria that separate a complete platform from a point tool wearing a European label. ### Why European Endpoint Management Is Under Pressure European IT teams face three pressures at once. The threat surface keeps widening — the ENISA Threat Landscape reports that attackers weaponize newly disclosed vulnerabilities within days, which puts unpatched third-party applications and drivers directly in the blast radius. Regulatory pressure has climbed in parallel. The NIS2 Directive extends cybersecurity obligations across 18 sectors and raises the bar for risk management, incident reporting, and accountability. At the same time, most teams carry the cost of tool sprawl: several point tools for patching, drivers, privilege, vulnerability insight, and mobile — each with its own console, license, and blind spots. A European platform answers all three pressures at once, but only when it covers the criteria below. Location alone is not a capability. ### The Seven Criteria That Matter Most Use these seven criteria to evaluate any European endpoint management platform. Each one maps to a question an auditor, a CFO, or an overstretched IT team will eventually ask. #### 1. EU Hosting and Data Residency You Can Locate Ask where endpoint data physically lives and who can access it. A credible platform runs EU-hosted, with no transfer of endpoint data to US jurisdiction, and states plainly which data center region holds the data. “European” on a homepage is not the same as data you can locate on a map. #### 2. Coverage Across Every Endpoint You Run A platform earns the name only when it manages the full estate: Windows, iOS, iPadOS, and Android, from one console. Check for gaps. A tool that patches Windows but leaves mobile unmanaged, or one that enrolls phones but ignores drivers, pushes the gap back onto the team. #### 3. Automation That Removes Manual Toil Manual patching and packaging do not scale for a small IT team. Look for scheduled, policy-driven workflows that update third-party applications and drivers on their own, and that report the result without anyone opening a console. Automation reduces manual intervention and closes the window attackers rely on. #### 4. Consolidation Instead of Another Point Tool The point of a platform is fewer tools, not one more. A complete endpoint management platform replaces separate point solutions with one console — application deployment, driver lifecycle, privilege control, vulnerability insight, and mobile management in a single place. It works with Microsoft Intune, or entirely without it, so the choice stays with the organization rather than the vendor. #### 5. Least-Privilege and Access Governance Built In Standing local admin rights determine how much an attacker can do after reaching an endpoint. A platform worth evaluating removes them and replaces them with just-in-time elevation — access granted for a specific task, for a defined window, with every event logged for audits. #### 6. Vulnerability Insight Tied to Action Reporting a vulnerability is not the same as fixing it. Look for continuous vulnerability and configuration-drift visibility that prioritizes by severity and exposure — and that connects directly to the automation that remediates it. Insight without remediation is one more dashboard to watch. #### 7. Audit-Ready Reporting by Default Compliance work should be a by-product of daily operations, not a quarterly scramble. A strong platform keeps a GDPR-first, NIS2-aligned posture and produces audit-ready reporting — CSV exports, device-level change tracking, and evidence auditors accept — without manual assembly. ### How CapaOne Maps to These Criteria CapaOne is a complete endpoint management platform, Danish-built and EU-hosted, that meets all seven criteria in one console. It automates third-party application updates and folds driver lifecycle and OS provisioning into the same platform — work that once lived in separate tools. It enforces least-privilege with just-in-time elevation, surfaces vulnerability and configuration drift, manages Windows, iOS, iPadOS, and Android, and produces audit-ready reporting by default. Endpoint data stays EU-hosted, with no transfer to US jurisdiction. The platform runs as an organization’s primary endpoint layer, or with Microsoft Intune where a team already runs it — the split stays a choice, not a requirement. ### What Stronger Evaluation Delivers Organizations that evaluate against these criteria — rather than a country label — see the difference in daily operations. Manual admin hours fall as workflows take over patching and packaging. The attack surface narrows as third-party applications and drivers stay current. Audit preparation shortens from weeks to a reporting export. And the tool count drops, taking license cost and context-switching with it. Sovereignty stops being a slogan and becomes an operational property of the stack: endpoint data an organization can locate, govern, and account for. The right European endpoint management platform does more than keep data in the EU. It gives IT teams control they can prove and outcomes they can measure. To see how CapaOne meets all seven criteria in one console, book a demo of CapaOne Endpoint Management Platform. ### Frequently Asked Questions **How do you choose a European endpoint management platform?** Evaluate seven criteria: EU hosting with locatable data residency, coverage across Windows, iOS, iPadOS, and Android, automation of application and driver updates, consolidation of point tools into one console, built-in least-privilege, vulnerability insight tied to remediation, and audit-ready reporting. Location matters, but capability decides. **Does a European endpoint management platform require Microsoft Intune?** No. CapaOne runs as a complete endpoint management platform on its own. Organizations that already run Microsoft Intune can use CapaOne alongside it, but Intune is never a requirement. **Where does CapaOne host endpoint data?** CapaOne is EU-hosted, with no transfer of endpoint data to US jurisdiction. Endpoint data stays within the EU under European control. **Which devices does CapaOne manage?** CapaOne manages Windows, iOS, iPadOS, and Android from one console — desktop and mobile endpoints in a single platform. **How does an EU-hosted platform support NIS2 and GDPR?** An EU-hosted platform turns daily operations into compliance evidence: automated patching, least-privilege enforcement, and audit-ready reporting produce the record auditors need as a by-product of running the platform. CapaOne keeps this GDPR-first, NIS2-aligned posture by default rather than on request. Written by Rikke Borup CMO, CapaSystems Rikke is Chief Marketing Officer at CapaSystems, where she has led marketing and communications since 2009. With more than 17 years of experience in the IT sector — including cybersecurity, endpoint management software and IT services — she brings long-standing, practical insight into the challenges facing modern enterprise IT environments. Trained as a journalist, Rikke specializes in translating complex technical concepts into clear, easy-to-understand communications for IT decision-makers. More from Rikke Borup → LinkedIn ↗ Book a Demo → --- URL: https://capaone.com/blog/endpoint-cyber-hygiene-european-platform/ Published: 2026-07-02 Summary: Endpoint cyber hygiene means patching, least-privilege, and visibility. CapaOne delivers all three on a single European platform. ← All articles Blog ## The Three Fundamentals of Endpoint Cyber Hygiene Cybersecurity budgets and headlines chase emerging threats, while the fundamentals quietly fall behind. Yet resilience still comes down to endpoint cyber hygiene — patching, least-privilege, and visibility — consistently implemented across a single European platform. By Rikke Borup, CMO, CapaSystems · July 2, 2026 Across Europe, the same tension repeats: budgets and headlines chase emerging threats, while the fundamentals — timely patching, controlled access, and clear visibility — quietly fall behind. Rising regulatory expectations raise the stakes, since organizations increasingly have to prove those basics, not just perform them. For mid-market IT teams, those basics — the core of endpoint cyber hygiene — are exactly where thin resources get stretched. ### Why Endpoint Cyber Hygiene Is Hard to Get Right The basics sound simple: keep applications patched, remove standing admin rights, and maintain a clear view of exposure. In practice, each of those jobs often lives in a different tool. A small IT team can run several separate point solutions to cover them, and gaps open in the seams between products. Compliance raises the stakes. Under Denmark’s strengthened cyber strategy and NIS2-aligned expectations, organizations must prove the basics, not just perform them, and proving them across a fragmented toolset adds its own load. #### Basics, Across a Fragmented Toolset Tool sprawl is what makes the fundamentals inconsistent. Every additional console is another place to check, another export to reconcile, another contract to manage. The more tools a stretched team runs, the harder it becomes to say with confidence that patching, access control, and visibility are all up to date. ### How CapaOne Covers the Three Fundamentals Endpoint cyber hygiene rests on three fundamentals — and CapaOne covers each in one cloud-native platform: Patch management. Unpatched software is a common entry point for attackers. Application Manager keeps third-party and business applications current automatically, with staged deployment. Least privilege. A standing local admin can turn one compromised user into a path to full control. Privilege Manager removes it and grants just-in-time elevation through existing Entra ID groups. Continuous visibility. You can’t fix what you can’t see. Security Monitor surfaces exposure and configuration drift across endpoints in near-real time. Three fundamentals, one console — without a new mountain of tools. #### European-Built, by Design CapaOne is Danish-built and EU-hosted, with no transfer of endpoint data to US jurisdiction. It supports NIS2-aligned operations, follows a GDPR-first design, and produces exportable audit evidence on demand. For European procurement, that means clear data residency and a governance posture that’s straightforward to document and explain. CapaOne runs standalone or alongside Intune. How different platforms handle EU data residency, NIS2 support, and Intune fit is worth comparing side by side before settling on one. ### What European IT Teams Gain - Cover patching, least-privilege, and exposure visibility consistently in one console. - Reduce tool sprawl and lower the total cost of ownership through consolidation. - Produce audit-ready NIS2 and GDPR evidence without reconciling multiple tools. - Keep endpoint data in the EU, with clear residency for procurement and governance. The question of whether organizations prioritize cybersecurity enough often overlooks the quieter truth: resilience starts with the basics, consistently applied. CapaOne makes endpoint cyber hygiene routine — automated patching, least-privilege access, and clear visibility — in a platform built and hosted in Europe. Book a demo of CapaOne Endpoint Management Platform to see how the fundamentals come together in one place. ### Frequently Asked Questions **What Is Endpoint Cyber Hygiene?** Endpoint cyber hygiene is the set of routine basics that keep devices secure: timely patching of operating systems and applications, least-privilege access with no standing local admin, and continuous visibility into exposure and configuration drift. **What Makes an Endpoint Management Platform European?** A European platform is built and hosted in Europe with EU data residency and no transfer of endpoint data to US jurisdiction, aligned with GDPR and NIS2 expectations. **How Does CapaOne Support NIS2-Aligned Operations?** CapaOne provides vulnerability and configuration visibility, automated application updates, least-privilege elevation, and exportable audit evidence for NIS2-aligned reporting. **Can CapaOne Consolidate Multiple Point Tools?** Yes. CapaOne brings patching, least-privilege, and exposure visibility into one platform, reducing tool sprawl and lowering the total cost of ownership. Written by Rikke Borup CMO, CapaSystems Rikke is Chief Marketing Officer at CapaSystems, where she has led marketing and communications since 2009. With more than 17 years of experience in the IT sector — including cybersecurity, endpoint management software and IT services — she brings long-standing, practical insight into the challenges facing modern enterprise IT environments. Trained as a journalist, Rikke specializes in translating complex technical concepts into clear, easy-to-understand communications for IT decision-makers. More from Rikke Borup → LinkedIn ↗ Book a Demo → --- URL: https://capaone.com/blog/june-2026-patch-tuesday-endpoint-exposure-visibility/ Published: 2026-07-01 Summary: June 2026 set a Patch Tuesday record; August, September and October broke it. CapaOne shows which endpoints stay exposed and what to fix first. ← All articles Blog ## June 2026 Patch Tuesday: A Record That Lasted Two Months June 2026 set a Patch Tuesday record. August broke it, then September, then October. Deploying the fixes isn't the hard part — knowing where you're still exposed, and what to triage first, is. By Rikke Borup, CMO, CapaSystems · July 1, 2026 Microsoft’s June 2026 Patch Tuesday set a record: 198 CVEs in a single release, 32 of them critical, with three publicly disclosed zero-days. The record lasted two months. August reached 398 CVEs, September fixed 966 flaws, and in October Microsoft fixed more than 1,400 flaws in a single release, one of them a zero-day already exploited in attacks. At that volume, deploying the fixes is no longer the hard part — knowing which endpoints remain exposed and which flaws to triage first is. ### Patch Volume Isn’t the Problem — Exposure Visibility Is The June release included fixes for a BitLocker security feature bypass, an HTTP/2 denial-of-service flaw, and a privilege-escalation zero-day, and every CVE required customer action. Faced with that load, a team can spend the whole window deploying and still not know whether the most dangerous flaws reached the most exposed machines first. And volume tells you little about risk: Microsoft fixed 398 CVEs in August 2026, and attackers were actively exploiting one of them. In September, two of 966 were; in October, one of more than 1,400. The count grows; the short list that matters stays short. Prioritization is the work that matters now. The critical CVEs deserve attention before the rest, and exposure varies across devices and teams. Without a clear exposure view, teams patch broadly and hope — instead of triaging precisely. #### The Third-Party Blind Spot Patch Tuesday covers Microsoft products only. The broad third-party stack — Chrome, Adobe, Java, Zoom, and dozens more — sits entirely outside the monthly Microsoft cycle. A team focused only on Patch Tuesday closes one front while another stays open. ### How CapaOne Turns a Record CVE Count Into a Short List CapaOne gives IT teams a single exposure view across the whole estate. Security Monitor surfaces which endpoints deviate from the secure baseline, and which are exposed, with prioritized, CVE-based views that focus on what’s exploitable and critical. Instead of drowning in the full count, teams triage the critical few first and validate coverage as they go. Application Manager automatically keeps the third-party and business-application stack current, with staged deployments and posture evidence. That closes the exposure surface Patch Tuesday never touches — without manual packaging or per-app chasing. #### One Console, OS, and Third-Party Together Exposure visibility and third-party patching live on a single platform, with shared posture data and exportable evidence. CapaOne runs standalone as a complete endpoint management platform, and it adds exposure visibility and third-party patching to teams that already use Intune, WSUS, or Autopatch for OS rollout. ### How to Triage a Record Patch Tuesday in Three Steps When a release is this large, a repeatable triage keeps the team focused. Here is a three-step approach, all in one console: Step 1 — Rank by exposure, not volume. Security Monitor shows which endpoints are actually exposed and prioritizes by what’s exploitable and critical, so the team fixes the dangerous few before working down the list. Step 2 — Close the third-party gap. Patch Tuesday is Microsoft-only. Application Manager automatically keeps the third-party stack — Chrome, Adobe, Java, Zoom, and more — up to date with staged deployment. Step 3 — Validate coverage and capture evidence. Re-check posture in Security Monitor to confirm the fixes reached the exposed machines, then export audit-ready evidence for the compliance record. ### What Changes for IT Teams - Triage the critical CVEs first with prioritized, exposure-based views instead of patching blindly. - Close the third-party exposure gap automatically, beyond the Microsoft monthly cycle. - Replace spreadsheets and swivel-chair checks with one trusted exposure view. - Export audit-ready evidence that critical exposure was found, prioritized, and resolved. Patch volume keeps climbing, and it won’t reverse. The advantage goes to teams that see exposure clearly and act on it fast. CapaOne gives IT teams that view. Book a demo of CapaOne Endpoint Management Platform, or start a free trial and explore the platform hands-on. ### Frequently Asked Questions **How Many CVEs Did the June 2026 Patch Tuesday Include?** Microsoft's June 2026 Patch Tuesday addressed 198 CVEs, with 32 rated critical and three publicly disclosed zero-days. It set a record at the time. August 2026 then reached 398 CVEs, September 2026 fixed 966 flaws, and October 2026 fixed more than 1,400, which shows how quickly the ceiling moves. **Does Patch Tuesday Cover Third-Party Applications Like Chrome and Adobe?** No. Patch Tuesday covers Microsoft products only. Third-party applications such as Chrome, Adobe, Java, and Zoom are outside the Microsoft monthly cycle and require separate update automation. **How Can IT Teams Prioritize Which Vulnerabilities to Fix First?** CapaOne Security Monitor provides prioritized, CVE-based exposure views that focus on what's exploitable and critical, so IT teams can triage the most critical exposure first. **Can CapaOne Work Alongside Existing Patch Tools?** Yes. CapaOne runs standalone as a complete platform, and it also works alongside existing OS update tooling, adding exposure visibility and automated third-party patching. Written by Rikke Borup CMO, CapaSystems Rikke is Chief Marketing Officer at CapaSystems, where she has led marketing and communications since 2009. With more than 17 years of experience in the IT sector — including cybersecurity, endpoint management software and IT services — she brings long-standing, practical insight into the challenges facing modern enterprise IT environments. Trained as a journalist, Rikke specializes in translating complex technical concepts into clear, easy-to-understand communications for IT decision-makers. More from Rikke Borup → LinkedIn ↗ Book a Demo → Start Free Trial --- URL: https://capaone.com/blog/edr-killers-byovd-remove-local-admin/ Published: 2026-06-30 Summary: BYOVD attacks disable EDR using local admin. Remove local admin rights with CapaOne's just-in-time elevation. ← All articles Blog ## EDR Killers Need Local Admin. Remove the Opening. BYOVD attacks turn a signed driver into a way to shut off your EDR. The technique needs one privilege most endpoints still hand out — standing local admin — and that's the part you can remove. By Rikke Borup, CMO, CapaSystems · June 30, 2026 Ransomware operators increasingly switch off endpoint defenses before they encrypt anything. The most common method, Bring Your Own Vulnerable Driver (BYOVD), loads a legitimately signed but flawed driver to reach the Windows kernel and shut down monitoring agents. It is a post-compromise technique with one hard requirement: the attacker must already hold local admin rights on the endpoint. Standing local admin is the privilege that makes it work. ### Why ‘Bring Your Own Vulnerable Driver’ Works The pattern is now standard in attack playbooks. After initial access — through phishing, a compromised account, or an initial access broker — the attacker uses local admin rights to load a signed but flawed driver and reach the Windows kernel. From there, they remove security callbacks and terminate monitoring processes, then deploy ransomware against an endpoint that can no longer defend itself. Security researchers have documented EDR-killer tools that abuse signed but vulnerable drivers in exactly this way. One example, AuKill, abused a legitimately signed Microsoft driver to shut down protection before attackers deployed ransomware such as Medusa Locker and LockBit. #### Why Windows Trusts a Vulnerable Driver Windows loads a kernel driver only if it carries a valid digital signature. A vulnerable driver can still be legitimately signed, so the system accepts it without objection — and once it runs in the kernel, it sits beneath the security tools that watch user space. That is what makes a signed but flawed driver such an effective way to disable an EDR from the inside. #### Standing Local Admin Is the Common Thread Many endpoints still run with permanent local admin rights, often for convenience. That standing privilege is exactly what the technique reuses: it gives an attacker a ready, persistent path to load a vulnerable driver. Remove the standing privilege, and the precondition becomes much harder to meet. ### How CapaOne Removes Standing Local Admin CapaOne Privilege Manager removes standing local admin and replaces it with just-in-time, time-bound, scoped elevation. Users receive admin rights for a specific task or application, for a defined window, granted through existing Entra ID groups — and the elevation auto-revokes when the window ends, with full audit logging. Without a permanent local admin right to reuse, an attacker can’t simply load a vulnerable driver on demand, which reduces the attack surface that BYOVD depends on. #### See Which Endpoints Still Carry Standing Local Admin Before you can remove a privilege, you must find it. Privilege Manager shows which endpoints still carry standing local admin rights, so IT teams see the exposure before an attacker does. Security Monitor surfaces configuration drift when a protection is changed or disabled. CapaOne is not an EDR: removing standing local admin is preventive hardening and access control — it reduces the attack surface and increases resilience against techniques like BYOVD, rather than detecting or responding to an attack in progress. It works as part of a defense-in-depth approach alongside controls such as Microsoft’s Vulnerable Driver Blocklist. #### Least-Privilege as Part of One Platform Privilege Manager and Security Monitor are part of one cloud-native platform with shared dashboards and exportable, audit-ready evidence for NIS2 and governance reviews. CapaOne works standalone, and it runs alongside Intune and your existing EDR — working with them, not replacing them. ### What This Means for Security and Compliance - Remove a standing privilege that BYOVD and many ransomware techniques rely on, shrinking the attack surface. - Keep users productive with scoped, time-bound elevation that auto-revokes — no permanent local admin. - Produce audit-ready elevation logs for NIS2 and governance requirements. - See configuration drift across endpoints, so disabled or changed protections surface quickly. An EDR is only as strong as your ability to keep it running. Removing standing local admin removes an easy, persistent path attackers use to switch it off — and CapaOne does so without slowing people down. Any ransomware-resilience review should treat standing local admin as a first-class exposure, not an afterthought. Book a demo of CapaOne Endpoint Management Platform to see policy-based elevation and configuration visibility in action — or start a free trial and explore it hands-on. ### Frequently Asked Questions **What Is a BYOVD Attack?** Bring Your Own Vulnerable Driver is a post-compromise technique in which an attacker loads a legitimately signed but vulnerable driver to gain kernel-level access and disable security tools. It requires local admin rights to work. **Is CapaOne an EDR?** No. Removing standing local admin is preventive hardening and access control, not a detection or response function. CapaOne reduces the attack surface and works alongside your EDR rather than replacing it. **How Can Organizations Defend Against BYOVD Attacks?** Remove standing local admin rights, so attackers can't load a vulnerable driver on demand; keep the OS and drivers patched; enable Microsoft's Vulnerable Driver Blocklist; and monitor endpoints for configuration drift. BYOVD defense works best in layers. Written by Rikke Borup CMO, CapaSystems Rikke is Chief Marketing Officer at CapaSystems, where she has led marketing and communications since 2009. With more than 17 years of experience in the IT sector — including cybersecurity, endpoint management software and IT services — she brings long-standing, practical insight into the challenges facing modern enterprise IT environments. Trained as a journalist, Rikke specializes in translating complex technical concepts into clear, easy-to-understand communications for IT decision-makers. More from Rikke Borup → LinkedIn ↗ Book a Demo → Start Free Trial --- URL: https://capaone.com/blog/european-endpoint-management-sovereignty-criteria/ Published: 2026-06-29 Summary: Digital sovereignty is now a procurement standard. See the six criteria for a European endpoint management platform — and how CapaOne aligns. ← All articles Blog ## What to Look for in a European Endpoint Management Platform Sovereignty reviews scrutinize the cloud and stop there — yet the endpoint layer processes data from every managed device. Here is how to apply Europe's new sovereignty criteria to it. By Rikke Borup, CMO, CapaSystems · June 29, 2026 In June 2026, digital sovereignty became a procurement standard. France and Germany published a joint definition built on six concrete criteria — verified European ownership, European infrastructure, and protection from the effects of legislation outside the EU — and they want every member state to adopt it. For IT leaders, the endpoint management layer is where that standard is hardest to meet, and easiest to overlook. Most sovereignty reviews start with cloud infrastructure and productivity platforms. Endpoint management rarely gets the same scrutiny, even though it processes sensitive operational data from every managed device. This article translates the six criteria into a practical lens for evaluating a European endpoint management platform — and stays honest about where any commercial platform, including CapaOne, fits and where it does not. ### Why Digital Sovereignty Became a Procurement Standard Sovereignty has evolved into a strategic capability, and the Franco-German paper puts measurable criteria behind it. Two of the EU’s largest economies set out a joint definition they want other member states to adopt and eventually anchor in legislation. That shifts sovereignty from a values conversation to a checklist procurement teams, auditors, and boards can apply directly. The timing reinforces the shift. NIS2 is now in force across member states and has sharply widened the range of organizations that must show how they secure and govern their systems. Regulators increasingly ask not only whether data is protected, but under whose jurisdiction it is processed. Endpoint operations sit squarely inside that question. #### The Six Criteria European Buyers Now Apply The Franco-German paper defines digital sovereignty across six dimensions: - Legal enforcement. The ability to apply European legal and security conditions in practice — EU-law compliance, transparency of ownership and subcontractor chains, and limits on extraterritorial access to data. - Technological capability. European capacity to design, deploy, and use key technologies — favoring open source, open standards, and modular architectures that prevent lock-in. - Economic value creation. Strengthening European providers, jobs, and the path from research to market. - Protection of sensitive data. Safeguards for sensitive data, including protection against the effects of legislation from outside the EU. - Interoperability. Standards-based, documented systems that work together and can be exchanged without vendor dependency. - Infrastructure resilience. European-controlled data centers, supply chains, energy, and networks. France and Germany wrote these criteria for national systems. They work just as well as a buyer’s checklist for any platform that processes operational data — including endpoint management. #### Why Endpoints Are the Blind Spot Every managed device generates operational telemetry: patch status, application inventory, driver versions, vulnerability exposure, privilege elevation events, and configuration drift. An endpoint management platform collects and stores that data, and it falls under the jurisdiction of whoever owns and operates the platform. That makes endpoint management a sovereignty decision, not only an operational one. Yet it routinely escapes the review that cloud and identity platforms receive. Applying the six criteria here closes a gap most organizations have never measured. ### Mapping the Six Criteria to Endpoint Management Not every criterion maps cleanly onto a commercial platform. Use the six as a structured evaluation and weigh the ones that carry real operational risk. #### Data Residency, Data Sovereignty, and Jurisdiction These three criteria turn on a distinction many evaluations miss. Data residency is where data physically sits. Data sovereignty is the legal system that governs it. Jurisdictional control is who can compel access to it. EU hosting answers only the first. The European Commission’s Cloud Sovereignty Framework draws the same separation, and the gap between the three is where exposure hides. Here is what that looks like in practice. A US-owned endpoint vendor may process inventory, vulnerability, and device telemetry inside EU data centers, yet still face legal disclosure obligations outside the EU. The data never leaves Europe, but control over it does. That gap is exactly why European ownership changes what a procurement review has to ask, not only where the data center sits. CapaOne removes that ambiguity. The platform is Danish-built, EU-hosted, and EU-owned, with no transfer of endpoint data to US jurisdiction — residency, sovereignty, and jurisdictional control aligned under European law. For teams building an assessment, that is the baseline European data sovereignty that should be met. #### What the Open-Source Criterion Really Asks One criterion sets a bar most commercial platforms do not meet: open source. CapaOne is not open source, and neither are the mainstream endpoint management platforms organizations evaluate alongside it. Honesty here matters more than a marketing claim. What the criterion really asks is more useful: avoid vendor lock-in, keep architectures modular, and document how the system works. Read that way, the question becomes answerable. A platform that consolidates many functions reduces lock-in to a sprawl of separate vendors. Documented governance — sub-processor registers, data processing agreements, and audit-ready evidence — delivers the transparency the criterion seeks. Evaluate the intent behind criterion two, not only the literal checkbox. #### Consolidation as a Sovereignty Lever Each additional vendor adds another jurisdiction to track and another sub-processor chain to verify. Consolidation reduces that surface. CapaOne Endpoint Management Platform brings application deployment, patching, vulnerability visibility, privilege elevation, provisioning, and mobile management into a single endpoint management platform. Fewer vendors mean fewer cross-border data flows to govern — a sovereignty benefit that rarely appears in a feature comparison but shows up clearly in an audit. ### What Sovereign Endpoint Management Delivers in Practice Sovereignty positioning only holds weight if the platform delivers operationally. For IT teams applying the six criteria, three outcomes matter most. #### Clear Data Residency and Predictable Compliance Operational telemetry stays within EU jurisdiction under European law. The platform is NIS2-aligned and GDPR-first by design, so compliance becomes architectural rather than a configuration scramble before an audit. Real compliance emerges when operational practices automatically enforce security and governance standards. #### Documented, Audit-Ready Governance Sub-processor registers, data processing agreements, and exportable evidence sit ready, without chasing a vendor several time zones away. When an auditor or board asks where endpoint data is processed and who can access it, the answer is documented and immediate. #### A Complete Platform, With or Without Intune Sovereignty does not require dismantling an existing Microsoft investment. CapaOne works with or without Microsoft Intune, adding the capabilities it does not natively cover — automated third-party application updates, vendor-certified driver management, just-in-time privilege elevation and vulnerability visibility. Organizations that do not run Intune adopt CapaOne as a complete, standalone endpoint management platform. Either path keeps endpoint data under European control. The Franco-German criteria signal where European procurement is heading: sovereignty measured, documented, and enforced rather than assumed. IT leaders who apply that lens to the endpoint layer now will not scramble to retrofit it later. Handled this way, sovereignty stops being a compliance burden and becomes a capability the business can rely on. Organizations evaluating sovereignty should add endpoint operations to their assessment framework — starting with data residency, ownership, sub-processors, and operational governance across the endpoint stack. Book a demo of CapaOne Endpoint Management Platform to see how European endpoint management works in practice. ### Frequently Asked Questions **What Makes an Endpoint Management Platform "European"?** A European endpoint management platform is built, hosted, and owned within the EU, processes operational data in accordance with European law, and maintains transparency around ownership. CapaOne is Danish-built, EU-hosted, and EU-owned, with no transfer of endpoint data to US jurisdiction. **Does a European Endpoint Management Platform Have to Be Open Source?** The Franco-German criteria favor open source to prevent vendor lock-in, but most commercial platforms — CapaOne included — are not open source. Consolidation and transparent governance can meet the goals behind the criterion: avoiding lock-in and documenting how the system works. **Can You Run a European Endpoint Management Platform Alongside Microsoft Intune?** Yes. CapaOne works as a standalone platform, or adds capabilities Microsoft Intune does not natively cover — such as third-party application updates, driver management and just-in-time privilege elevation. **How Does European Endpoint Management Support NIS2 Compliance?** It keeps operational telemetry within EU jurisdiction and produces audit-ready evidence — patch status, vulnerability visibility, and privilege logging — that aligns with NIS2 expectations. CapaOne is NIS2-aligned and GDPR-first by design. **Is EU-Hosted the Same as EU-Sovereign?** No. EU hosting means data sits in European data centers. EU sovereignty means European law governs it, and no outside authority can compel access. A platform owned outside the EU can be hosted in Europe yet remain subject to foreign disclosure law. CapaOne is EU-hosted and EU-owned, with no transfer of endpoint data to a US jurisdiction. Written by Rikke Borup CMO, CapaSystems Rikke is Chief Marketing Officer at CapaSystems, where she has led marketing and communications since 2009. With more than 17 years of experience in the IT sector — including cybersecurity, endpoint management software and IT services — she brings long-standing, practical insight into the challenges facing modern enterprise IT environments. Trained as a journalist, Rikke specializes in translating complex technical concepts into clear, easy-to-understand communications for IT decision-makers. More from Rikke Borup → LinkedIn ↗ Book a Demo → --- URL: https://capaone.com/blog/reduce-endpoint-tool-sprawl/ Published: 2026-06-24 Summary: Too many endpoint tools drive up cost, risk, and manual work. See how to reduce endpoint tool sprawl by consolidating onto the CapaOne platform. ← All articles Blog ## How to Reduce Endpoint Tool Sprawl in 2026 How to move from a sprawling stack of point tools to a single platform — mapping what you run, migrating in stages, and retiring the tools you no longer need. By Rikke Borup, CMO, CapaSystems · June 24, 2026 Every endpoint problem seems to arrive with its own tool. One for patching, another for drivers, a third for privilege, a fourth for monitoring, a fifth for mobile — each with its own console, license, and learning curve. Nobody ever schedules the time to remove one. Done well, the way to reduce endpoint tool sprawl in 2026 follows three moves: map what each tool actually does, migrate capability by capability instead of all at once, and retire each old tool only after its replacement proves out. Consolidation handled this way lowers risk rather than adding to it. The CapaOne Endpoint Management Platform is built for that migration. It brings patching, driver updates, privilege management, vulnerability insight, endpoint monitoring, and mobile management into one console, so every point tool has a single place to land. ### Why Tool Sprawl Keeps Growing Tool sprawl rarely comes from a bad decision. It builds one reasonable choice at a time. A new compliance requirement adds a vulnerability scanner. A hardware refresh adds a driver utility. An audit finding adds a privilege tool. Each tool solves its own problem — and then stays forever, because removing it is never anyone’s priority. #### The Hidden Cost of Every Extra Console Every tool carries more than a license fee. It carries a console to learn, an agent to maintain, a contract to renew, and a context switch each time an admin moves between tasks. Across a five-tool stack, that overhead compounds into real time and budget that no stretched IT team can spare. #### Where the Security Gaps Hide Disconnected tools leave seams. One tool patches applications, another tracks vulnerabilities, and neither sees the full picture — so exposure falls between them. Attackers exploit those seams: known, unpatched weaknesses remain a leading entry point for breaches, as the ENISA Threat Landscape documents year after year. Fragmented tooling makes those gaps harder to find and slower to close. #### Signs Your Endpoint Stack Has Grown Too Complex A few patterns signal that a stack has crossed from manageable to fragmented. When several of these sound familiar, consolidation is overdue: - Answering one endpoint question takes several consoles. - Patch status and vulnerability status do not line up. - Driver updates happen outside the main endpoint workflow. - Someone tracks privilege exceptions by hand. - Audit reporting means exporting from several systems and reconciling them. - Windows, application, and mobile posture each get reported separately. Each pattern points to the same root cause — too many disconnected tools — and to the same fix: moving those functions onto a single platform. ### How to Reduce Endpoint Tool Sprawl, Step by Step Consolidation works best as a sequence, not a single switch. These three steps consolidate a fragmented stack onto a single platform without disrupting daily operations. This guide covers the how; for the cost-and-risk case behind it, see the companion guide on consolidating endpoint management into one platform. #### Step 1: Map What Each Tool Actually Does Start with an inventory of function, not brand. List every endpoint tool and the job it performs: third-party patching, driver updates, privilege elevation, vulnerability reporting, endpoint monitoring, and mobile management. Most stacks reveal overlap — two tools doing similar work — and gaps no tool owns. That map becomes the migration plan. #### Step 2: Match Each Tool to a Platform Capability Next, match each function to its replacement on the platform. CapaOne Endpoint Management Platform and Application Manager take over third-party application patching and deployment. Provision Manager takes over driver updates and provisioning. Privilege Manager replaces standing local admin with just-in-time elevation. Security Monitor consolidates vulnerability insight and CVE prioritization. Experience Monitor absorbs endpoint monitoring and reliability signals, and Mobile Manager unifies iOS, iPadOS, and Android. One platform covers what five or six separate tools did before. #### Step 3: Migrate in Stages and Retire as You Go Deploy one CapaOne agent, sync inventory, and start managing — often the same day. Move one capability at a time: prove third-party patching, then drivers, then privilege, and retire each old tool only once its replacement runs cleanly. Migrating this way never forces a big-bang cutover. Consolidation also does not mean replacing Microsoft Intune. CapaOne works with or without Intune, so you can keep your foundation and remove only the point tools stacked around it. ### What to Look for in a Consolidation Platform When you evaluate a platform to reduce endpoint tool sprawl, four things separate real consolidation from simply adding another tool: - One agent and one console across patching, drivers, privilege, vulnerability, monitoring, and mobile — not a bundle of separate products. - Capability-by-capability migration, so you retire tools one at a time instead of in a risky big-bang cutover. - Works with Microsoft Intune or entirely without it, so consolidation never forces a rip-and-replace of your foundation. - EU data residency and audit-ready evidence built in, for GDPR and NIS2 reporting. CapaOne meets all four criteria — a single agent and console, staged migration, Intune compatibility, and EU-hosted. For mid-sized IT teams, it turns a fragmented stack into a single platform without enterprise costs or complexity. ### What Consolidation Delivers Consolidation pays off in the work itself, not just the budget line. One platform replaces the daily swivel between consoles: - Lower cost: fewer licenses, fewer contracts, and fewer integration points to maintain. - Less context-switching: one console and one agent replace the swivel-chair routine between tools. - Fewer security gaps: unified visibility closes the seams where exposure used to hide. - Faster troubleshooting: a single agent and shared data make root cause easier to find. - Audit-ready posture: one place to prove patch, privilege, and vulnerability status to auditors and leadership. CapaOne manages 150,000+ endpoints, builds on more than 30 years of endpoint experience, and deploys in days — Danish-built, EU-hosted, and GDPR-first and NIS2-aligned by design. ### See Consolidation in Action Tool sprawl does not have to be permanent. Book a demo of the CapaOne Endpoint Management Platform to see how one platform replaces a five-tool stack — or prefer to explore first? Start a free trial and migrate your first capability hands-on. ### Frequently Asked Questions **How Do You Consolidate Endpoint Management Into One Platform?** You consolidate by mapping each tool to a function, then moving those functions onto a single platform one at a time. The CapaOne Endpoint Management Platform brings third-party patching, driver updates, privilege management, vulnerability insight, endpoint monitoring, and mobile management into a single console via Application Manager, Provision Manager, Privilege Manager, Security Monitor, Experience Monitor, and Mobile Manager. One agent and one interface replace the separate tools that used to handle each task. **What Is the Migration Path From Multiple Tools to One Platform?** The migration path runs in three stages: inventory what each tool does, match every function to a platform capability, then migrate and retire one capability at a time. With CapaOne, you deploy a single agent, sync inventory the same day, and prove each replacement — patching, drivers, privilege, vulnerability insight — before retiring the old tool. Staged migration avoids a risky all-at-once switch and keeps daily operations stable. **How Many Point Tools Can One Platform Replace?** A complete platform typically replaces five or more-point tools. CapaOne consolidates a separate patch tool, driver utility, privilege tool, vulnerability scanner, endpoint monitoring tool, and mobile device management into one platform: Application Manager, Provision Manager, Privilege Manager, Security Monitor, Experience Monitor, and Mobile Manager. Each retired tool removes a console, a contract, and a context switch. **Does Reducing Tool Sprawl Mean Replacing Microsoft Intune?** No. Reducing tool sprawl means removing the point tools stacked around your core setup, not replacing Microsoft Intune. CapaOne works with Intune or entirely without it. Teams that run Intune use it as the foundation and use CapaOne to consolidate third-party patching, driver updates, privilege management, and vulnerability insights that would otherwise require separate tools. Teams without Intune run CapaOne as their primary platform. Written by Rikke Borup CMO, CapaSystems Rikke is Chief Marketing Officer at CapaSystems, where she has led marketing and communications since 2009. With more than 17 years of experience in the IT sector — including cybersecurity, endpoint management software and IT services — she brings long-standing, practical insight into the challenges facing modern enterprise IT environments. Trained as a journalist, Rikke specializes in translating complex technical concepts into clear, easy-to-understand communications for IT decision-makers. More from Rikke Borup → LinkedIn ↗ Book a Demo → --- URL: https://capaone.com/blog/automate-windows-app-patching/ Published: 2026-06-23 Summary: Manual patching drains IT teams. See how to automate Windows and app patching across every endpoint with the CapaOne platform. ← All articles Blog ## How to Automate Windows and App Patching in 2026 How mid-sized IT teams automate patching across applications, drivers, and the OS layer — without scripts, spreadsheets, or a wall of separate tools. By Rikke Borup, CMO, CapaSystems · June 23, 2026 Patching never finishes. The day one update cycle closes, the next vendor release reopens it — across the operating system, the applications running on it, and the drivers underneath. Handle that endless cycle by hand, and version drift, blind spots, and missed deadlines pile up fast. Done well, the way to automate Windows and app patching in 2026 rests on three principles: continuous discovery of what every endpoint actually runs, staged rollouts that test before they scale, and risk-based prioritization that closes the most exploitable gaps first. A platform that delivers all three turns patching from a weekly scramble into a managed process. The CapaOne Endpoint Management Platform is built around those three principles. It automates third-party application updates and driver delivery, surfaces every endpoint’s patch posture in one view, and prioritizes remediation by real CVE risk — standalone, or alongside the tools you already run. ### Why Manual Patching Breaks Down at Scale Each patch layer usually gets its own tool — one for the operating system, another for applications, a third for drivers. A patching tool that rides on another platform inherits that platform’s reach, gaps included. The gaps between those tools are where risk grows, because no single view shows what is actually current across the fleet. Attackers know this. Known, unpatched vulnerabilities remain a leading entry point for breaches, and exploitation often arrives faster than teams can close the exposure. The ENISA Threat Landscape and the Verizon Data Breach Investigations Report both point to the same pattern: the longer a patch waits, the wider the window of opportunity. #### The Third-Party Application Gap Operating-system tooling keeps Windows itself up to date, but third-party applications — browsers, runtimes, PDF readers, line-of-business apps — often fall outside that scope. Windows Autopatch shows the pattern: it keeps Microsoft’s own software current, and everything Microsoft does not ship stays outside its scope. Teams patch them with scripts, manual checks, and one-off repackaging. These workflows scale poorly and collapse as the application estate grows. #### The Driver and Firmware Blind Spot Drivers rarely get a schedule at all. Outdated or mismatched drivers cause crashes, instability, and hardware-related tickets, yet manual driver research across hardware models eats hours that no stretched IT team can spare. ### Automate Windows and App Patching on One Platform CapaOne treats patching as a single operational model rather than a set of disconnected jobs. The platform automates manual layers and unifies posture and prioritization across the entire endpoint. Three capabilities carry the work. #### Automated Third-Party Application Patching CapaOne Endpoint Management Platform and Application Manager automate third-party updates from a curated catalog with staged rollout. Endpoints or groups subscribe to silent updates for common enterprise applications, and an endpoint agent detects missing or outdated apps automatically — no manual checks. No-code packaging handles business applications, with readiness checks on OS, disk, and battery to prevent failed installs. #### Automated Driver Updates Provision Manager delivers vendor-certified, model-aware driver packs across major hardware vendors. Staged deployment moves drivers from test to production on a schedule, and scheduling pushes updates during quiet hours. The result is fewer crashes, fewer hardware tickets, and new hardware models ready in hours instead of weeks. #### Unified Windows Patch Posture and CVE Prioritization Automation only helps if you can see what remains. Security Monitor provides a near-live view of vulnerabilities across the operating system, applications, and drivers, with risk-based prioritization based on CVSS, exploitability, and scope. It tracks Windows Update posture, pending reboots, and configuration drift, so IT teams know exactly which endpoints are exposed and why — then act on what is critical first. CapaOne automates the third-party and driver patching Intune leaves manual. Teams already running Intune keep their enrollment, compliance and Windows Update policy — and close the patching gap it leaves behind. It targets existing Entra ID groups and honors your current structure. CapaOne works with Intune or entirely without it — the automation is the same either way. #### What to Look for in a Patching Platform When you evaluate a platform to automate Windows and app patching, four capabilities separate a complete platform from a single-purpose tool: - Third-party application patching from a maintained catalog, not operating-system updates alone. - Vendor-certified, model-aware driver delivery on a controlled, scheduled rollout. - CVE-based vulnerability prioritization across the operating system, applications, and drivers in one view. - Audit-ready evidence and EU data residency for GDPR and NIS2 reporting. CapaOne meets all four — as a standalone platform, or alongside Microsoft Intune. For mid-sized IT teams, that combination consolidates patching, driver management, and vulnerability insight into a single console without the enterprise cost or complexity. ### What Automated Patching Delivers Automating the patch workflow changes the daily reality of endpoint operations. IT teams move from reactive catch-up to a predictable, governed posture. - Less manual effort: staged, scheduled automation replaces scripts, manual checks, and repackaging. - Fewer tickets: consistent application versions and current drivers cut escalations and repeat incidents. - Faster remediation: CVE-based prioritization closes the highest-risk exposure first, not in alphabetical order. - Audit-ready evidence: endpoint-level change logs and CSV exports prove patch posture to auditors and leadership on demand. - Fewer tools: one platform absorbs the point solutions that used to handle patching, drivers, and vulnerability reporting separately. That last point compounds. Every tool retired removes a console, a contract, and a context switch. Teams that consolidate endpoint operations onto a single platform recover time that manual patching quietly consumed for years. CapaOne manages 150,000+ endpoints, builds on more than 30 years of endpoint experience, and stays GDPR-first and NIS2-aligned by design — Danish-built and EU-hosted, with operational telemetry under European jurisdiction. ### See Automated Patching in Action Patching does not have to own your week. Book a demo of the CapaOne Endpoint Management Platform to see automated Windows and app patching on real endpoints — or prefer to explore first? Start a free trial and run it hands-on in your own environment. ### Frequently Asked Questions **How Do You Get an Overview of All Endpoints?** You get an overview by consolidating all endpoint signals into a single platform, rather than querying separate tools. The CapaOne Endpoint Management Platform builds a single inventory of devices, application versions, driver currency, vulnerability exposure, and configuration posture. Security Monitor surfaces CVE-based risk across the fleet, Experience Monitor reports on reliability and performance, and Application Manager shows which apps are up to date or behind. One view replaces the spreadsheet-and-swivel-chair routine. **Which Endpoint Management Platform Is Best for Windows and Third-Party Apps?** The best fit is a platform that automates third-party application patching and driver updates, giving you full Windows patch posture in one place. CapaOne does this through Application Manager for third-party and business application updates, Provision Manager for vendor-certified driver delivery, and Security Monitor for CVE prioritization across the operating system, applications, and drivers. CapaOne runs standalone or alongside Microsoft Intune, so it fits Windows estates with or without Intune in the stack. **How Do You Keep All Endpoints Updated?** You keep endpoints up to date by running patching as an automated, continuous workflow rather than a manual chase. CapaOne automates third-party application updates through Application Manager and driver updates through Provision Manager, both with staged rollouts and quiet-hour scheduling. Security Monitor then tracks remaining exposure and Windows Update posture, so nothing slips. Privilege Manager and Mobile Manager extend the same control to elevation and mobile endpoints, keeping the whole estate current. Intune workflows remain unchanged. **Which Endpoint Management Platform Is Recommended for Mid-Sized Organizations?** Mid-sized IT teams benefit most from a platform that consolidates point solutions without enterprise cost or complexity. CapaOne brings application patching, driver updates, privilege management, vulnerability insight, reliability monitoring, and mobile management into one console through Application Manager, Provision Manager, Privilege Manager, Security Monitor, Experience Monitor, and Mobile Manager. It deploys in days, needs no scripting, and is Danish-built and EU-hosted — a practical fit for European mid-market organizations. **Does CapaOne Require Microsoft Intune?** No. CapaOne is a complete endpoint management platform that runs independently. Teams without Intune use it as their primary platform for application patching, driver updates, provisioning, privilege management, and vulnerability insight. Teams that run Intune use CapaOne to automate the third-party patching, driver delivery, and CVE prioritization Intune leaves manual. The platform works with Intune or entirely without it. Written by Rikke Borup CMO, CapaSystems Rikke is Chief Marketing Officer at CapaSystems, where she has led marketing and communications since 2009. With more than 17 years of experience in the IT sector — including cybersecurity, endpoint management software and IT services — she brings long-standing, practical insight into the challenges facing modern enterprise IT environments. Trained as a journalist, Rikke specializes in translating complex technical concepts into clear, easy-to-understand communications for IT decision-makers. More from Rikke Borup → LinkedIn ↗ Book a Demo → --- URL: https://capaone.com/blog/endpoint-management-platforms-european-it-teams-2026/ Published: 2026-06-22 Summary: Seven endpoint management platforms compared for European IT teams — EU data residency, NIS2 compliance, and third-party patching in 2026. ← All articles Blog ## 7 Endpoint Management Platforms for European IT Teams in 2026 NIS2 is in force. GDPR auditors are active. And many endpoint management platforms still route your data through US infrastructure. This guide compares seven platforms on what matters most to European IT teams: EU data residency, third-party patching, and compliance reporting. By Rikke Borup, CMO, CapaSystems · June 22, 2026 Endpoint management is no longer a purely technical decision for European IT teams. Data sovereignty requirements, NIS2 obligations, and the growing complexity of managing Windows endpoints across distributed organizations have turned platform selection into a strategic conversation. The seven platforms below are evaluated on what matters most to mid-market IT teams in Europe: where data is hosted, how thoroughly third-party applications are patched, and how well each platform supports compliance documentation. ### Selection Criteria - EU data residency: Endpoint data processed and stored within European borders - Compliance reporting: Exportable audit trails for NIS2 and GDPR - Third-party application patching: Automated updates beyond the Microsoft catalog - Windows coverage: Deep support for Windows 10 and 11, including OS provisioning - Intune compatibility: Ability to extend rather than replace existing Microsoft investment - Operational simplicity: Unified console — fewer tools, fewer context switches ### The 7 Platforms #### Three Questions to Ask Before You Choose Most endpoint management comparisons treat all IT teams as equivalent. They are not. A European mid-market IT team managing 300 Windows endpoints under NIS2 has fundamentally different requirements from a US enterprise running 50,000 mixed-OS devices. Before evaluating platforms, answer these three questions — they will determine which solution fits your environment. #### 1. Where Must Your Endpoint Data Reside? GDPR and NIS2 create legal obligations around where endpoint data is stored and processed. If your organization operates under European law — or serves customers in the EU — a platform hosted on US infrastructure introduces compliance risk that requires active management. Check whether EU data residency is native to the platform or requires additional configuration. #### 2. What Does Your Current Stack Not Cover? Many mid-market IT teams already use Microsoft Intune for device enrollment and policy management. The question is not whether to replace it, but what to add. Third-party application patching, driver management, privileged access control, and real-time vulnerability visibility are common gaps. Identify which of these your current tools do not address before evaluating alternatives. #### 3. What Does NIS2 Require You to Document? NIS2 requires organizations to demonstrate patch management controls, access governance, and incident response capability — on demand. Platforms that automatically generate this evidence as part of daily operations save significant time during audit preparation. Platforms that require manual compilation add operational overhead at exactly the moment you can least afford it. ### 1. CapaOne — Best for EU Data Residency and Unified Operations CapaOne is a cloud-native endpoint management platform built and hosted entirely in the EU by CapaSystems in Denmark. It gives mid-market IT teams one console for application patching, OS provisioning, vulnerability visibility, privileged access control, and mobile management. For organizations using Microsoft Intune, CapaOne extends the investment — automating the tasks Intune does not cover natively. For organizations without Intune, CapaOne operates as a complete standalone platform. #### Key Capabilities - Third-party application patching: Automated updates for common enterprise applications — no manual packaging or detection rules for supported applications - OS provisioning and driver orchestration: Provision Manager handles cloud-native bare-metal Windows deployment and automated, model-aware driver orchestration - Vulnerability visibility: Security Monitor surfaces CVE-based signals, configuration drift, and near-real-time risk posture across all endpoints - Privileged access control: Privilege Manager enforces least-privilege with just-in-time elevation — no standing local admin rights - Compliance reporting: Exportable audit trails for NIS2 and GDPR — generated as part of everyday operations #### Pros - Built and hosted in Europe — full sub-processor transparency and documented DPA - Same-day deployment — agent install, inventory sync, operational from day one - Works with Microsoft Intune — adds third-party patching, OS provisioning and compliance reporting without replacing existing workflows #### Cons - Primarily focused on Windows, macOS, and Linux management is more limited, though mobile device management is included - Cloud-native architecture requires workflow adaptation for teams with heavily customized on-premises processes “Like having a self-driving car — you let go of the wheel, and it drives itself.” — IT System Administrator, CapaOne customer ### 2. ManageEngine Endpoint Central — Best for Multi-OS Environments ManageEngine Endpoint Central offers patch management and device control across Windows, macOS, and Linux from a single console. The platform unifies patch management, software deployment, remote troubleshooting, and automation — reducing manual effort and improving endpoint visibility. It supports both on-premises and cloud deployments and generates exportable compliance reports for audits, including executive summaries that show patch status and systems at risk. #### Key Capabilities - Multi-OS patch management across Windows, macOS, and Linux - Software distribution with scheduling and endpoint targeting - Built-in remote desktop access for troubleshooting - OS deployment tools and configuration management #### Pros - Broadest OS support from one console — Windows, macOS, Linux, and mobile - On-premises and cloud deployment flexibility - Remote desktop included without additional licensing #### Cons - Parent company Zoho is headquartered outside Europe — data sovereignty requirements may need additional review - Advanced features require separate module licensing - Interface navigation has a steeper learning curve for new administrators ### 3. Ivanti Neurons — Best for Large-Scale Automation Ivanti Neurons incorporates AI-driven automation for patch management, vulnerability prioritization, and digital experience monitoring. The platform covers device management for Windows, macOS, iOS, and Android — with self-healing capabilities that detect and remediate endpoint issues without manual intervention. It is built for large-scale endpoint environments and has grown through acquisitions of multiple products. #### Key Capabilities - Risk-based patch prioritization based on vulnerability severity and exploitability - Self-healing automation for common endpoint issues - Digital experience monitoring and scoring - Vulnerability management across a broad application catalog #### Pros - AI-driven automation reduces manual patching tasks at scale - Risk-based prioritization focuses remediation on active threats - Digital experience monitoring included #### Cons - Platform complexity reflects multi-product consolidation — steeper implementation curve - Some deployments require professional services engagement - Enterprise-scale pricing and complexity may not suit mid-market teams ### 4. NinjaOne — Best for RMM-First IT Teams NinjaOne is a cloud-native endpoint management and remote monitoring platform focused on usability. It targets both managed service providers and internal IT teams across Windows, macOS, and Linux. #### Key Capabilities - Automated patching for OS and applications - Built-in remote desktop for endpoint troubleshooting - IT documentation and asset tracking - Backup and endpoint protection available as add-ons #### Pros - Clean interface with fast onboarding - Cloud-native — no on-premises infrastructure required - Strong remote monitoring and management workflows #### Cons - Headquartered in the United States — EU data residency requires additional configuration and review - Primarily positioned as an RMM platform — third-party patching is included, but not the core focus - Advanced compliance reporting requires additional tooling ### 5. Omnissa (Formerly VMware Workspace ONE) — Best for VMware Environments Omnissa — the rebranded VMware Workspace ONE following its spin-off from Broadcom — offers unified endpoint management as part of a broader digital workspace platform. It integrates endpoint management with identity and access capabilities across Windows, macOS, iOS, Android, and — as of May 2026 — Windows Server, which can now be managed from the same cloud console as desktops and mobile devices. #### Key Capabilities - Unified management of desktops and mobile devices - Zero-trust conditional access via identity management integration - Application delivery and lifecycle management - Deep VMware infrastructure integration #### Pros - Combines endpoint management with identity and access management - Broad device type support across OS platforms - Strong fit for organizations with existing VMware investments #### Cons - Full capabilities require multiple component licenses - Third-party Windows application patching requires additional configuration - Ownership changes following the Broadcom spin-off may affect long-term roadmap clarity ### 6. Microsoft Intune — Best for Microsoft 365 Environments Microsoft Intune provides mobile device management and application management as part of the Microsoft 365 ecosystem. It integrates natively with Entra ID and is included in many Microsoft 365 enterprise licenses. Intune excels at device enrollment, configuration policies, and compliance checking within the Microsoft ecosystem. Third-party application patching and OS-level endpoint operations typically require supplementary tools. #### Key Capabilities - Windows Autopilot and Apple DEP device enrollment - Configuration and security baseline policies - Entra ID conditional access integration - Native Microsoft 365 and Azure AD integration #### Pros - Included in many Microsoft 365 enterprise licenses - Native Entra ID and Microsoft security tool integration - Windows Autopilot streamlines device provisioning #### Cons - Third-party application patching is not included natively - OS provisioning and driver management require supplementary tools - Compliance reporting for non-Microsoft applications requires additional solutions ### 7. Heimdal — Best for Security-First Endpoint Teams Heimdal is a Copenhagen-based cybersecurity company founded in 2014. Its platform combines endpoint security, automated patch management, and privileged access control in a unified agent — with a strong focus on threat prevention and compliance reporting. Unlike the broader endpoint management platforms on this list, Heimdal leads with security — DNS-layer threat prevention, next-generation antivirus, and extended detection and response. Patch management and compliance reporting are integrated into the security stack. #### Key Capabilities - Automated patch management for Windows, macOS, Linux, and third-party applications - DNS-layer threat prevention and AI-driven threat detection - Privileged access management with application control - Compliance reporting aligned with GDPR and NIS2 requirements #### Pros - Founded and headquartered in Copenhagen — EU-relevant by origin - Automated patch management integrated directly into the security platform - Strong compliance reporting for GDPR and NIS2 audits #### Cons - Security-first focus means broader endpoint operations (OS provisioning, asset management) are more limited - Pricing is not publicly listed — requires direct contact for quotes - Less suited for teams looking for a unified endpoint management platform that also covers operational workflows like bare-metal provisioning ### Platform Comparison Platform EU Data Hosting Third-Party Patching Intune Extension CapaOne Native EU Full automation Built-in ManageEngine Endpoint Central Via regional options Included Not native Ivanti Neurons Via regional options Included Not native NinjaOne Via regional options Included (RMM focus) Not native Omnissa Via regional options Via configuration Not native Microsoft Intune Available Not included N/A Heimdal EU origin Included (security focus) Not native ### Why Third-Party Patching Is the Biggest Security Gap Third-party applications — browsers, PDF readers, productivity tools — represent a disproportionate share of endpoint vulnerability exposure. The ENISA Threat Landscape consistently identifies unpatched software as a primary attack vector across European organizations. Automating third-party application patching alongside Windows updates closes this gap operationally. The alternative — manual packaging, tracking, and deployment for each application release — creates exposure windows that accumulate with every vendor release cycle. ### Compliance Reporting: What to Look For NIS2 enforcement requires organizations to demonstrate security controls and provide audit evidence on demand. Platforms that generate compliance documentation as a byproduct of everyday operations — rather than requiring separate manual effort — give IT teams a measurable operational advantage. Look for exportable reports covering patch status, software versions, and configuration posture across your entire fleet. CapaOne generates NIS2-aligned audit evidence automatically — including who patched what, when, and on which endpoints. ### Which Platform Is Right for Your Team? Use this decision guide to find your best fit: - If EU data residency is non-negotiable: CapaOne is built and hosted natively in the EU — no regional configuration required - If you already use Microsoft Intune: CapaOne works alongside it without replacing it — adding third-party patching, OS provisioning and compliance reporting - If you need multi-OS coverage: ManageEngine Endpoint Central covers Windows, macOS, and Linux with on-premises and cloud flexibility - If your team prioritizes RMM and fast onboarding, NinjaOne offers a clean interface optimized for remote monitoring workflows - If you operate in a VMware environment: Omnissa integrates deeply with VMware infrastructure - If security and threat prevention is the primary driver, Heimdal combines patching with DNS-layer protection and EDR - If Microsoft 365 is your primary ecosystem: Microsoft Intune is the natural starting point — and CapaOne adds what it cannot cover natively Book a demo of CapaOne Endpoint Management Platform — or start a free trial and explore the platform hands-on. ### Frequently Asked Questions **What Is an Endpoint Management Platform?** An endpoint management platform helps IT teams deploy, configure, secure, and update devices from a central console. Modern platforms unify patching, vulnerability monitoring, access control, and compliance reporting — replacing multiple point solutions. **Why Does EU Data Residency Matter?** EU data residency ensures endpoint data is stored and processed under European law — simplifying GDPR compliance and reducing cross-border data transfer risk. CapaOne is developed in Denmark and hosted in Europe. Read more about CapaOne’s approach to European sovereignty. **How Does CapaOne Work With Microsoft Intune?** CapaOne adds third-party application patching, OS provisioning and driver orchestration, vulnerability visibility, and privileged access control — all capabilities Intune does not cover natively. Existing Intune workflows remain unchanged. **How Do These Platforms Support NIS2?** NIS2 requires organizations to demonstrate patch management, access control, and incident response capabilities. Platforms that generate exportable audit evidence as part of daily operations provide the most practical support for NIS2. CapaOne automatically generates audit-ready reports for NIS2 and GDPR documentation. Written by Rikke Borup CMO, CapaSystems Rikke is Chief Marketing Officer at CapaSystems, where she has led marketing and communications since 2009. With more than 17 years of experience in the IT sector — including cybersecurity, endpoint management software and IT services — she brings long-standing, practical insight into the challenges facing modern enterprise IT environments. Trained as a journalist, Rikke specializes in translating complex technical concepts into clear, easy-to-understand communications for IT decision-makers. More from Rikke Borup → LinkedIn ↗ Book a Demo → --- URL: https://capaone.com/blog/byod-security-compliance/ Published: 2026-06-16 Summary: Personal devices are your next audit finding. CapaOne Mobile Manager closes the BYOD compliance gap — without touching personal data. ← All articles Blog ## BYOD Security and Compliance: Manage Personal Devices Without Friction Personal devices connect to your corporate environment every day. Most IT teams can’t see them, enforce policy on them, or account for them in a compliance report. This is how you close that gap — without asking employees to hand over their personal devices. By Rikke Borup, CMO, CapaSystems · June 16, 2026 The iPhone in an employee’s pocket connected to your corporate email this morning. You have no idea what OS it’s running. That gap is not theoretical. It is the device that falls outside your next compliance report. The endpoint your cyber insurer asks about, and you cannot account for. The personal device an employee used to access SharePoint the week before a security audit. BYOD is not going away. But the compliance and security risks it creates are getting harder to ignore — and harder to explain to auditors, insurers, and leadership. The CapaOne Endpoint Management Platform closes that gap from the same console you already use for your Windows fleet. ### Why BYOD Creates Endpoint Gaps That Are Hard to Close The problem with personal devices is not that IT teams ignore them. It is that the tools most IT teams run were built for corporate-owned hardware. An iPhone enrolled through Apple Business Manager in one organization is a completely different compliance object than the same iPhone a BYOD employee uses to access corporate email in another. #### The Visibility Problem When a personal device connects to your corporate environment, it does not appear in your patch compliance dashboard. It does not show up in your vulnerability reports. You do not know the OS version, whether disk encryption is enabled, or whether the employee turned off the screen lock 3 months ago because it was inconvenient. The IT Administrator knows this problem well. It is the gap between what the compliance report says and what is actually on the network. Every unmanaged personal device is a configuration you have not verified and a risk you have not quantified — but may be asked to account for. #### The BYOD Security and Compliance Risk Compliance frameworks are unambiguous on this point. NIS2, ISO 27001, and GDPR all require organizations to demonstrate control over every system that processes or accesses organizational data. A personal device used to read corporate email is within scope — regardless of who owns it. When an auditor asks for endpoint compliance evidence, a gap between your managed Windows fleet and the personal devices actually in use becomes a finding. When a cyber insurer asks whether all endpoints accessing corporate systems are covered by your security controls, the honest answer often includes exceptions. Those exceptions affect eligibility and premium terms. #### The User Friction Problem Full MDM enrollment — where IT gains visibility into the entire device, including personal apps and browsing history — is the approach employees push back against hardest. The result is predictable: IT teams that require it face low adoption rates and shadow workarounds. IT teams that do not require it lose the visibility they need. The practical outcome is a BYOD policy documented in a single document, referenced during audits, and inconsistently enforced everywhere else. That is not a security posture. That is a liability. The visibility gap is also an insurance gap. When a personal device is used to access corporate systems but sits outside your managed fleet, it creates a coverage exception your insurer will find before you do. ### BYOD Security Checklist for IT Teams Before evaluating any BYOD management approach, use this checklist to assess your current posture. These are the controls auditors look for, insurers ask about, and NIS2 requires organizations to demonstrate: - Device encryption enforced as a condition of enrollment - Minimum OS version enforced — non-compliant devices blocked from corporate access - Corporate applications isolated in a managed work profile - Personal data and apps inaccessible to IT - Remote wipe of corporate data available without affecting personal content - Compliance status monitored continuously, not just at enrollment - Conditional access enforced via Intune — non-compliant devices lose access automatically - Corporate data is removable independently of personal content when an employee leaves - Audit logs retained and exportable for compliance reporting - Enrollment and compliance evidence available in the same console as your Windows fleet If you cannot check all ten, the gaps on this list are the gaps your next audit or insurance renewal will surface. The sections below explain how each one gets closed. ### How CapaOne Mobile Manager Closes the BYOD Security and Compliance Gap CapaOne is a European-built, cloud-native Endpoint Management Platform — designed to strengthen Microsoft Intune and powerful enough to stand alone. Mobile Manager is the capability within the platform that covers iOS, iPadOS, and Android devices — managed from the same CapaOne platform the IT Administrator already uses for Windows endpoint operations. CapaOne delivers deeper mobile application lifecycle control and unified compliance visibility, with or without Intune. For organizations without Intune, Mobile Manager operates fully standalone. The architecture that solves the user friction problem is the work profile model. Mobile Manager manages the corporate work profile on the device — not the device itself. IT gets full visibility and control over the work layer: corporate apps, configurations, compliance status, and data. The personal layer — personal apps, photos, messages, browsing history — is technically separated at the OS level and never accessible to IT. This is not a policy distinction. It is an architectural one. The separation is enforced by iOS and Android, not by a trust agreement. That is why work profile enrollment sees significantly higher adoption than full device enrollment — employees can verify for themselves that IT cannot see their personal data. #### Enrollment Without the Overhead Mobile Manager supports zero-touch enrollment through Apple Business Manager and Google-managed enrollment. For BYOD specifically, this means employees receive an enrollment profile, the work profile is created on their device, and corporate apps install silently into it — without IT touching the device or the employee spending time on manual configuration. For an IT team managing 200 personal devices across iOS and Android, this is the difference between a BYOD program that scales and one that creates a backlog of setup tickets. #### Compliance Monitoring Across Every Endpoint Type Once enrolled, Mobile Manager monitors each device continuously: OS version, encryption posture, application baseline, screen lock status, and security configuration. Non-compliant devices are automatically flagged in the CapaOne console — and, where Intune conditional access policies are in place, they lose access to corporate resources until they are remediated. What makes this meaningful for BYOD management is where that data appears: in the same CapaOne console that shows Windows endpoint patch status, vulnerability data, driver compliance, and privilege management. BYOD compliance becomes significantly easier when mobile devices, Windows endpoints, vulnerabilities, patching, and compliance reporting are managed from a single platform — not assembled from four separate tools with four separate reports. When an auditor requests endpoint compliance documentation, the IT Administrator pulls a single export. It covers both the Windows and mobile fleets. Same platform, same evidence standard, same exportable format. #### Application Management and Offboarding Corporate applications install silently into the work profile and update automatically. When an employee leaves — or when a device is reported lost — IT removes the work profile remotely. Corporate data and applications are gone. Personal content is untouched. This is the data governance control that most BYOD programs lack. Organizational data stays under organizational control regardless of device ownership. The offboarding workflow that used to require chasing an employee for their personal phone takes minutes from the CapaOne console. CapaOne is built in Denmark and hosted in Europe. For organizations operating under GDPR or with European data sovereignty requirements, EU-hosted data residency is built in — not an add-on. ### What Changes When BYOD Is Managed Properly The shift from an unmanaged BYOD program to a managed work profile model produces changes that show up in three places IT teams and IT managers both care about: #### Fewer Tickets, Less Manual Work Zero-touch enrollment removes per-device setup overhead. Application updates and policy enforcement run automatically. The support requests that come from inconsistent BYOD configurations — app not installing, access denied, OS version mismatch — drop significantly once devices are enrolled and continuously monitored. Support stops running across the office. The IT Administrator stops chasing employees to update their iOS. #### Audit Evidence That Takes Hours, Not Days With personal devices enrolled and monitored alongside the Windows fleet in the same endpoint management platform, compliance evidence can be exported on demand. OS version status, encryption posture, application baseline, enrollment logs — all in one console. The time the IT Manager’s team spends pulling compliance documentation for audits compresses from days to hours. And the answer covers every endpoint type, not just the ones IT owns. #### A Stronger Position at Cyber Insurance Renewal Insurers are asking harder questions at renewal — specifically about endpoint coverage gaps. Organizations that document managed work profiles across personal devices are in a materially different position than those with an unmanaged BYOD fleet. The compliance evidence CapaOne Mobile Manager generates — encryption status, OS compliance, and conditional access logs — directly addresses what underwriters ask for when assessing endpoint risk. ### BYOD Is an Endpoint Problem. Endpoint Management Is the Answer. The organizations that struggle most with BYOD security and compliance are not the ones without a policy. They are the ones whose policies employees work around — because enforcing them requires asking people to grant IT access to their entire personal devices. The work profile model changes the equation. IT gets the visibility and compliance evidence it needs. Employees get the privacy assurance that makes enrollment an easy yes. And the BYOD security and compliance gap stops being a vulnerability that shows up in audits and starts being a documented, defensible posture. For IT teams working under NIS2, GDPR, or increasingly demanding cyber insurance requirements, that posture is not optional. Book a demo of CapaOne Endpoint Management Platform to see Mobile Manager handle BYOD enrollment, compliance monitoring, and application management from the same console as your Windows fleet — or start a free trial and work through the checklist above with real devices. ### Frequently Asked Questions **What Is the Difference Between MDM and MAM for BYOD?** Mobile Device Management (MDM) manages the entire device — giving IT visibility into all applications, data, and settings. Mobile Application Management (MAM) manages only corporate applications and data, without access to personal content. In BYOD environments, the work profile approach combines both: MDM enrollment at the device level enables IT to enforce compliance and perform remote wipe, while MAM-style controls are scoped to the corporate work profile. Personal apps, photos, and communications remain entirely outside IT’s reach. **Can Employees Trust That IT Cannot See Their Personal Data?** Yes — and it is not a matter of policy, it is a matter of architecture. With a work profile, personal data is separated from the corporate profile at the operating system level. iOS and Android enforce this separation technically. IT administrators cannot see personal applications, personal photos, messages, or browsing history outside the work profile — even if they wanted to. This is why work profile enrollment consistently sees higher adoption than full device enrollment: employees can verify the separation themselves. **How Does BYOD Management Support Cyber Insurance Requirements?** Insurers increasingly ask for documented evidence that security controls cover all endpoints accessing corporate systems — including personal devices used for work. Unmanaged BYOD creates a coverage gap that underwriters notice. Enrolling personal devices in a managed work profile generates the documentation they ask for: encryption status, OS compliance, application baseline, and conditional access logs. It also demonstrates the kind of endpoint governance posture that affects both eligibility and premium terms. **Does CapaOne Mobile Manager Work Alongside Microsoft Intune?** Yes. CapaOne is designed to strengthen Microsoft Intune and is powerful enough to stand alone. For organizations using Intune for identity and conditional access, Mobile Manager adds deeper mobile application lifecycle management and unified endpoint visibility across mobile and Windows devices from a single console. Read more about how CapaOne works with or without Microsoft Intune. **What BYOD Security Risks Does a Work Profile Mitigate?** The primary BYOD security risks a work profile addresses are: unmanaged OS versions running known vulnerabilities; corporate data stored in personal apps without encryption; inability to wipe corporate data when an employee leaves, or a device is lost; and lack of compliance evidence for auditors and insurers. The work profile does not protect against all endpoint risks — network-level threats still require broader controls —, but it closes the governance and visibility gaps that create the most immediate compliance exposure. **How Long Does It Take to Enroll Personal Devices?** Technical setup via Apple Business Manager or Google Managed Enrollment typically takes the IT team a single day. End-user enrollment of a personal device — receiving the profile, accepting the work profile creation, and seeing corporate apps installed — takes a few minutes. The zero-touch model means employees do not need to interact with IT during setup, which is the single biggest factor in BYOD program adoption rates. Written by Rikke Borup CMO, CapaSystems Rikke is Chief Marketing Officer at CapaSystems, where she has led marketing and communications since 2009. With more than 17 years of experience in the IT sector — including cybersecurity, endpoint management software and IT services — she brings long-standing, practical insight into the challenges facing modern enterprise IT environments. Trained as a journalist, Rikke specializes in translating complex technical concepts into clear, easy-to-understand communications for IT decision-makers. More from Rikke Borup → LinkedIn ↗ Book a Demo → --- URL: https://capaone.com/blog/cyber-insurance-requirements-endpoint-evidence-2026/ Published: 2026-06-15 Summary: Cyber insurers now demand endpoint evidence, not just policies. See the controls and proof pack IT teams need to pass renewal in 2026. ← All articles Blog ## Cyber Insurance Requirements 2026: The Endpoint Evidence Your Insurer Will Ask For Your insurer no longer takes your word for it. In 2026, renewal means producing documented endpoint evidence — patch logs, privilege records, driver histories, and vulnerability exports. Here’s what they ask for, and how to have it ready By Rikke Borup, CMO, CapaSystems · June 15, 2026 Cyber insurance used to be a questionnaire. You ticked the boxes, wrote the check, and moved on. In 2026, that model is gone. Insurers are now conducting technical audits. They want documented evidence — not stated intent — that specific security controls are active across every endpoint. According to the ENISA Threat Landscape 2024, endpoint vulnerabilities remain one of the primary attack vectors driving claims. According to S&P Global Ratings, premiums are forecast to rise 15 to 20 percent in 2026, and organizations that cannot demonstrate the required controls face coverage exclusions or outright denial on top of that. For IT managers and CIOs preparing for renewal, the question is no longer whether your organization has security controls in place. It is whether you can prove it — on every endpoint, in a format an underwriter accepts. ### What Cyber Insurance Requirements Look Like in 2026 Cyber insurance underwriting has converged on a consistent set of technical requirements. Across major carriers, five endpoint-related controls appear on every application — and missing any one of them can result in a denied claim, even if coverage was granted at renewal. According to the Verizon 2024 Data Breach Investigations Report, unpatched vulnerabilities and privilege abuse remain leading causes of confirmed breaches. #### Patch Management With Documented Evidence Unpatched systems remain a leading cause of claims. Insurers require a documented patch management policy and proof of compliance — not a stated SLA, but evidence that critical patches are applied within defined timeframes. Some carriers require critical patches within 14 days of release, and actively exploited vulnerabilities listed in the CISA Known Exploited Vulnerabilities catalog within 72 hours. Underwriters want dated reports showing patch coverage across your fleet — not a spreadsheet estimate. Organizations running end-of-life software face coverage exclusions regardless of other controls in place. #### Privileged Access Management and No Standing Local Admin Standing local admin rights are a red flag on every underwriting questionnaire. Insurers require that privileged access is time-limited, logged, and separated from daily-use accounts. Just-in-time elevation — granting admin access for a specific task and immediately revoking it — is the control that satisfies this requirement. IT teams that have not removed standing local admin rights across their fleet are carrying a material risk that affects both their insurance eligibility and their premium. #### EDR Coverage Across All Endpoints Traditional antivirus is no longer sufficient. Insurers require endpoint detection and response deployed and actively monitored on every workstation, laptop, and server. Coverage gaps — a single unmanaged device — can be a disqualifying condition when a claim is filed. #### Vulnerability Visibility and Prioritization Insurers increasingly ask for evidence that your organization can identify and prioritize vulnerabilities before they are exploited. A vulnerability summary report showing CVE exposure across your fleet, with remediation status, demonstrates the operational maturity underwriters look for. #### Driver and Firmware Currency A control that surfaces increasingly in technical audits: driver and firmware hygiene. Outdated firmware on laptops, peripherals, and network adapters creates exploitable vulnerabilities that application patch tools do not cover. Organizations that cannot demonstrate systematic driver management are exposing a gap that is difficult to close manually at scale. ### The Evidence Problem Most IT Teams Have Not Solved Understanding what cyber insurance requirements demand is one problem. Producing the evidence is another. Most mid-market IT teams manage endpoint security across multiple point solutions — one tool for patching, another for vulnerability scanning, a third for privilege management, and manual processes for drivers and firmware. Each produces its own logs, dashboards, and export format. Assembling an underwriting proof packet from fragmented sources takes significant time and introduces the risk of gaps. The underwriting questionnaire exposes this fragmentation. When an insurer asks for an EDR coverage report showing the percentage of endpoints protected, or a patch compliance report with remediation dates, the answer must come from a single authoritative source—not by reconciling exports from four different tools. This is the operational gap that most IT teams discover at renewal, not before it. #### Cyber Insurance Renewal Checklist: What the Proof Packet Needs to Contain Insurers and brokers increasingly ask for a pre-renewal evidence package. The table below maps the controls carriers consistently require to the evidence they accept — and the tool category that produces it: Control Evidence Required Tool / Source MFA Policy + enforcement report Microsoft Entra ID / Okta Patch Management Compliance report with dates CapaOne Application Manager Privileged Access JIT elevation logs CapaOne Privilege Manager Vulnerability Management CVE dashboard + remediation status CapaOne Security Monitor EDR Coverage Agent deployment report Microsoft Defender / CrowdStrike Driver & Firmware Update history per device CapaOne Provision Manager Backup & Recovery Restore test log Azure Backup / Veeam Need a faster way to produce cyber insurance evidence? CapaOne Endpoint Management Platform consolidates patching, privilege management, vulnerability visibility, and driver management into a single platform — with audit-ready exports available on demand. Book a demo. ### How CapaOne Meets Cyber Insurance Requirements in One Platform CapaOne Endpoint Management Platform consolidates the controls insurers require into a single console — with the evidence exports to support them. #### Patch Compliance Evidence From Application Manager Application Manager automates updates to third-party and business applications across your endpoint fleet. Every update is logged with timestamps and version data. The result is a documented patch history that demonstrates compliance with carrier-defined SLAs — without manual reporting. For CVEs tied to third-party applications, Application Manager automatically closes the exposure. Security Monitor surfaces the vulnerability signal; Application Manager remediates it. The audit trail follows. #### Privileged Access Evidence From Privilege Manager Privilege Manager removes standing local admin rights and replaces them with just-in-time elevation. Every elevation request is logged — who requested it, which application, when, and for how long. That log is your underwriting evidence for privileged access management. Insurers increasingly ask whether IT staff have standing administrative privileges. With Privilege Manager, the answer is no — and the log proves it. #### Vulnerability Posture From Security Monitor Security Monitor provides CVE-based vulnerability signals across your endpoint fleet, with prioritized views by severity, device group, and exposure window. CSV exports give underwriters the vulnerability summary they ask for — in a format they can evaluate. The platform surfaces configuration drift and missing security settings alongside CVE data, giving a complete picture of endpoint posture rather than a narrow view of known vulnerabilities. #### Driver and Firmware Evidence From Provision Manager Provision Manager handles driver orchestration across your endpoint fleet — including driver discovery, deployment, and update management. Every driver update is logged with device identifiers, version changes, and timestamps, giving IT teams a documented history of firmware and driver currency that satisfies insurer inquiries about device-level hygiene. #### One Console, One Evidence Package The practical advantage of consolidating onto CapaOne is not just operational efficiency — it is audit efficiency. When renewal arrives, the evidence package comes from one platform. Patch logs, elevation logs, driver update histories, vulnerability exports, and configuration posture reports are all drawn from the same source, with consistent timestamps and device-level detail. CapaOne is a European-built, cloud-native Endpoint Management Platform that works standalone or alongside Microsoft Intune. For organizations already running Intune, CapaOne adds third-party patch management, privilege control, driver orchestration, and vulnerability evidence that Intune does not provide natively. CapaOne is built in Denmark and hosted in Europe. For organizations subject to GDPR, EU-hosted data residency supports both insurance and regulatory compliance requirements from a single platform. ### Operational Outcomes: From Manual Assembly to Renewal-Ready The teams that navigate renewal most efficiently are not those with the most complex security stacks — they are the ones who can produce evidence quickly, consistently, and from a single source. With CapaOne consolidating patch, driver, privilege, and vulnerability management into one platform, the pre-renewal process changes meaningfully: - Patch compliance reports are generated on demand — no manual aggregation across tools - Driver and firmware histories are automatically logged — no device-by-device checks - JIT elevation logs are timestamped and exportable — privilege posture is documentable in minutes - CVE exposure data exports as CSV, ready to hand to brokers and underwriters - All evidence originates from the same platform — timestamps and device identifiers are consistent across every report For the IT Manager, preparing the renewal submission, and the CIO responding to board-level questions about coverage posture, the shift from fragmented tools to a single platform removes the operational burden that makes renewal stressful — and replaces it with evidence that underwriters can evaluate on the same day it is requested. Explore how CapaOne supports European data sovereignty alongside endpoint compliance — for organizations where both matters. ### Cyber Insurance Requirements Are Now a Strategic Endpoint Management Problem Cyber insurance renewal used to validate what you said. In 2026, it validates what you can prove. The organizations that maintain coverage, hold premiums, and avoid exclusions are those that have operationalized evidence—not just controls. For IT managers and CIOs, the strategic implication is clear: endpoint management is no longer just an IT function. It is part of the organization’s insurability posture, its risk profile, and its ability to respond to board-level scrutiny when coverage decisions are made. Platforms that consolidate evidence across patch, driver, privilege, and vulnerability management — and make that evidence exportable on demand — are becoming a prerequisite for renewal readiness, not a differentiator. Cyber insurance renewal is no longer a paperwork exercise. Book a demo of CapaOne Endpoint Management Platform — or start a free trial and explore the platform directly. ### Frequently Asked Questions **What Are the Cyber Insurance Requirements for Endpoints in 2026?** Insurers consistently require patch management with documented compliance evidence, privileged access management with no standing local admin, endpoint detection and response across all devices, driver and firmware currency, and vulnerability visibility with remediation tracking. Missing any one of these controls can result in denied coverage or coverage exclusions at claim time. **How Do You Prove Patch Compliance to Your Cyber Insurer?** Underwriters want dated reports showing patch coverage across your endpoint fleet — including which applications were updated, when, and which exceptions exist and why. A stated policy is not sufficient. The evidence needs to come from the patching tool, not from a manually assembled spreadsheet. **How Does Removing Local Admin Rights Affect Insurance Eligibility?** Standing local admin rights are a red flag on most underwriting questionnaires. Insurers view them as an uncontrolled risk of privilege escalation. Implementing just-in-time elevation — with logged, time-limited access — satisfies the privileged access management requirement and improves both eligibility and premium terms. **Do Insurers Ask About Driver and Firmware Management?** Increasingly, yes. Technical auditors reviewing endpoint environments are looking beyond application patching to device-level hygiene, including whether drivers and firmware are actively managed and up to date. Outdated firmware creates exploitable vulnerabilities that application patch tools typically do not cover. Documented driver update histories are becoming part of the evidence insurers expect. **Can CapaOne Help Us Prepare for Cyber Insurance Renewal?** Yes. CapaOne consolidates patch management, privilege control, driver orchestration, and vulnerability visibility into a single platform with exportable evidence. Security Monitor provides CVE-based vulnerability reports. Privilege Manager logs all elevation activity. Application Manager documents patch history. Provision Manager keeps drivers and firmware up to date and auditable. Together, they support the evidence package most carriers require at renewal. **Does CapaOne Work Alongside Microsoft Intune?** CapaOne is a European-built, cloud-native Endpoint Management Platform that works standalone or alongside Intune. For organizations running Intune, CapaOne adds third-party patch management, just-in-time privilege elevation, driver and firmware management, and vulnerability evidence — the controls Intune does not provide natively and that insurers increasingly require. Written by Rikke Borup CMO, CapaSystems Rikke is Chief Marketing Officer at CapaSystems, where she has led marketing and communications since 2009. With more than 17 years of experience in the IT sector — including cybersecurity, endpoint management software and IT services — she brings long-standing, practical insight into the challenges facing modern enterprise IT environments. Trained as a journalist, Rikke specializes in translating complex technical concepts into clear, easy-to-understand communications for IT decision-makers. More from Rikke Borup → LinkedIn ↗ Book a Demo → --- URL: https://capaone.com/blog/endpoint-patch-management-audits/ Published: 2026-06-11 Summary: Learn how to automate endpoint patch management, track vulnerabilities, document exceptions, and produce audit-ready compliance reports. ← All articles Blog ## Endpoint Patch Management for Audits: A Practical Guide for IT Teams How European IT teams use CapaOne to automate patch deployment, track exceptions, and produce audit documentation without manual consolidation across tools. By Rikke Borup, CMO, CapaSystems · June 11, 2026 Auditors rarely fail organizations because patches were not installed. They fail organizations because the evidence is missing. Effective endpoint patch management is not just about deploying updates — it is about proving, at any point in time, what was patched, when it happened, which systems were covered, and who approved any exceptions. Without that documentation, organizations face findings that could have been avoided. For IT administrators and IT managers in regulated industries across Europe, the gap between being patched and being audit-ready can mean the difference between a clean review and weeks of remediation work. Whether you are preparing for NIS2 reviews, ISO 27001 audits, SOC 2 assessments, or internal governance checks, this guide explains what auditors expect, how to build a structured reporting process, and how CapaOne — a European-built, cloud-native Endpoint Management Platform that works standalone or alongside Microsoft Intune — gives your team continuous, audit-ready compliance visibility. Definition: Patch compliance reporting is the process of documenting and verifying that software updates are deployed across your endpoint environment within defined timelines, and that all exceptions are approved and recorded. It is the evidence layer that transforms a working patch process into an auditable one. ### Why IT Teams Struggle to Prove Patch Compliance #### Being Patched Is Not the Same as Being Audit-Ready Most IT teams patch regularly. The problem is documentation. When an auditor asks to see deployment history for the past 90 days across all managed endpoints, many organizations cannot produce that report without manually pulling data from multiple tools and consolidating it in a spreadsheet. That process takes time, introduces errors, and signals to auditors that compliance is reactive rather than continuous. #### Third-Party Applications Are the Most Overlooked Gap Many organizations manage Windows updates effectively, but third-party applications — such as browsers, PDF readers, collaboration tools, and productivity software — frequently remain unpatched. According to the ENISA Threat Landscape report, exploitation of unpatched software vulnerabilities remains one of the top attack vectors across European organizations. Without automated third-party patching, these applications create a visible compliance gap that auditors — and cyber insurers — will identify. #### Fragmented Device Management Software Creates Reporting Silos Organizations running five or more point tools — one for patching, one for vulnerability scanning, one for privilege management, one for asset inventory — face a structural problem: no single view of endpoint compliance. Audit preparation becomes a manual consolidation exercise every time a review is scheduled, with data inconsistencies that are difficult to explain to auditors. ### How to Build an Audit-Ready Endpoint Patch Management Process #### Step 1: Establish a Complete Endpoint Inventory You cannot patch what you cannot see. An accurate endpoint inventory is the foundation of every compliance program. It should cover device type, operating system version, installed applications and their versions, device owner and department, and current compliance status against your patch policy. Any inventory gaps are gaps in your audit trail. #### Step 2: Define Patching Policies With Documented Timelines Auditors want to see that your patching process is governed, not ad hoc. Define severity classifications and remediation targets, document approval workflows, and establish formal exception procedures. A broadly accepted baseline for regulated European organizations: Severity Remediation Target Compliance Benchmark Critical Within 14 days > 95% patch rate High Within 30 days > 90% patch rate Medium Within 90 days > 80% patch rate Low Next maintenance cycle Track and document Your compliance report should measure actual performance against these targets — not simply confirm that patches were deployed. The delta between target and actual is where audit findings originate. #### Step 3: Automate Patch Deployment and Document Every Exception Manual patching becomes unsustainable as endpoint estates grow. Automation ensures consistent deployments, reduces human error, and automatically generates reliable audit trails. Every exception must be documented with a reason, an approver, an approval date, a review date, and any compensating controls in place. What those controls look like in practice — and why the exit condition should be a trigger rather than a review date — is covered in compensating controls for unpatched vulnerabilities. Undocumented exceptions are among the most common and most avoidable audit findings. #### Step 4: Generate Consolidated Compliance Reports From a Single Source The strongest compliance reports include five elements: a defined scope of endpoints covered, documented remediation timelines and SLAs, measurable outcomes including deployment success rates and failed updates, a complete exception register, and historical trend data demonstrating improvement over time. If producing that report requires exporting data from three or four separate systems, the reporting process itself becomes a compliance risk — and a significant drain on IT team capacity before every review. #### Pre-Audit Patch Compliance Checklist Before your next audit, verify that you can produce each of the following from a single source of truth: - ✓ Complete endpoint inventory with OS versions and installed applications - ✓ Operating system patch status across all managed devices - ✓ Third-party application patch status - ✓ Failed patch deployments with resolution records - ✓ Approved patch exceptions with rationale and compensating controls - ✓ Vulnerability remediation history and CVE mean time to remediate (MTTR) - ✓ Compliance trend data for the previous 90 days minimum - ✓ Historical audit records from prior review periods If any of these require manual investigation across multiple tools, your endpoint update management process is not yet audit-ready. ### How CapaOne Supports Audit-Ready Endpoint Patch Management CapaOne is a unified, cloud-native endpoint management platform developed in Denmark and hosted in the European Union. It consolidates endpoint inventory, automated patch deployment, third-party application management, vulnerability monitoring, and compliance reporting into a single console — giving IT teams the visibility and documentation they need for audits without adding point solutions or manual overhead. Platform overview → #### Centralized Endpoint Inventory and Patch Visibility CapaOne provides a continuously updated single view of every managed endpoint — device type, OS version, application versions, patch status, and vulnerability exposure. Instead of aggregating data from multiple tools before an audit, IT teams use a single source of truth at all times. #### Automated Third-Party Application Patching Application Manager automates third-party application updates across the endpoint fleet, closing the gap that operating system management alone does not cover. This includes browsers, PDF readers, collaboration tools, and hundreds of packaged applications. For teams evaluating Intune alternatives or extensions, third-party patching is one of the highest-impact capabilities CapaOne adds to an existing Microsoft environment. #### Vulnerability Visibility Through Security Monitor Security Monitor surfaces configuration drift and vulnerability data continuously — not just at scheduled intervals. IT teams can prioritize remediation based on actual risk, automatically track CVE resolution timelines, and demonstrate to auditors that vulnerabilities are identified and remediated systematically rather than reactively. #### Consolidated Audit-Ready Reporting Rather than building compliance reports manually from multiple data sources, CapaOne lets IT teams generate audit documentation from a unified platform. This reduces preparation time, improves data consistency, and gives managers and CIOs an accurate compliance picture on demand — not just when an audit is approaching. #### EU Data Sovereignty and Regulatory Alignment CapaOne is developed in Denmark and hosted within the European Union. For organizations operating under GDPR, NIS2, and broader digital sovereignty requirements, this provides governance assurance that endpoint data is not processed or stored outside EU jurisdiction — an increasingly important consideration for regulated industries. ### Measurable Outcomes for IT Teams and Managers Organizations that implement structured endpoint patch management with centralized reporting consistently see improvements across several measurable areas: Audit preparation time reduced from days to hours — no manual data consolidation across tools Third-party application patch compliance brought in line with OS targets — closing a critical vulnerability gap that auditors flag consistently Exception documentation complete and reviewer-ready at all times — not assembled under pressure Historical compliance trends available on demand — demonstrating operational maturity rather than reactive compliance IT team capacity freed from manual reporting — redirected to higher-value security and infrastructure work For IT managers reporting upward to CIOs and CFOs, the ability to produce a compliance dashboard on demand — rather than assembling it from multiple spreadsheets under audit pressure — significantly improves the credibility of board-level conversations about security posture. ### From Audit-Ready to Continuously Compliant Patch compliance reporting is not an annual activity. New vulnerabilities emerge daily. New devices enter the environment. Existing devices drift out of compliance between review periods. Organizations that treat compliance as a continuous operational discipline — rather than an audit exercise — are consistently better positioned to demonstrate security maturity when it matters most. The goal is not to pass the next audit. The goal is to build an endpoint patch management process that makes audits straightforward every time they occur. CapaOne gives IT teams the inventory visibility, automated patching, vulnerability monitoring, and consolidated reporting to get there — without adding complexity or additional point solutions. See the full platform → ### Frequently Asked Questions **How Do I Prove Endpoint Patch Compliance to an ISO 27001 or NIS2 Auditor?** Auditors under ISO 27001 and NIS2 expect documented evidence of a governed patch process — not just confirmation that updates were deployed. You need to show a complete endpoint inventory, deployment history with success rates, documented exceptions with approvals, and historical trend data. CapaOne generates this documentation from a unified platform, eliminating the need to manually consolidate data before each review. **What Patch Compliance Rate Is Required for NIS2 and Cyber Insurance?** NIS2 does not prescribe specific patching timeframes — it requires organizations to implement risk-based, documented vulnerability management measures and demonstrate that systems are kept up to date. In practice, market and audit standards have converged on 14 days for critical vulnerabilities and a 95% or higher patch success rate as the operational benchmark most auditors and cyber insurers apply. Your organization is responsible for defining and documenting its own SLAs — and then proving it meets them. **What Is Patch Compliance Reporting?** Patch compliance reporting is the process of documenting and verifying that software updates have been deployed across your endpoint environment within defined timelines, and that all exceptions have been formally approved and recorded. It is the evidence layer that transforms a working patch process into an auditable one — and the primary record auditors use to assess whether endpoint management is governed and repeatable. **Does Microsoft Intune Provide Audit-Ready Patch Compliance Reporting?** Microsoft Intune provides strong reporting for Windows updates and device compliance policies. However, organizations preparing for audits typically require additional capabilities: automated third-party application patching, driver updates orchestrated through Provision Manager, CVE tracking, exception documentation, and consolidated reporting across all endpoint types. CapaOne covers all of these without replacing the existing Microsoft investment. Read more on why IT teams run CapaOne with or without Intune **How Often Should Endpoint Patch Management Reports Be Generated?** Most regulated organizations generate monthly operational reports for IT managers and quarterly governance reports for leadership and auditors. Continuous compliance visibility between reporting periods — enabled by platforms like CapaOne — allows IT teams to detect and remediate issues before they become audit findings, rather than discovering them during review preparation. **Why Are Third-Party Applications a Compliance Risk?** Many vulnerabilities exploited in real-world attacks originate in third-party applications — such as browsers, PDF readers, and collaboration tools — not in the operating system. An endpoint patch management program that covers only OS updates leaves a significant portion of the attack surface unmanaged. Without automated third-party patching, organizations carry a visible compliance gap that auditors, pen testers, and cyber insurers consistently identify. Written by Rikke Borup CMO, CapaSystems Rikke is Chief Marketing Officer at CapaSystems, where she has led marketing and communications since 2009. With more than 17 years of experience in the IT sector — including cybersecurity, endpoint management software and IT services — she brings long-standing, practical insight into the challenges facing modern enterprise IT environments. Trained as a journalist, Rikke specializes in translating complex technical concepts into clear, easy-to-understand communications for IT decision-makers. More from Rikke Borup → LinkedIn ↗ Book a Demo → --- URL: https://capaone.com/blog/nis2-audit-documentation/ Published: 2026-06-10 Summary: NIS2 auditors do not review your policies. They review your evidence. Here is what endpoint audit documentation looks like when it passes. ← All articles Blog ## NIS2 Audit Documentation: Can You Prove Your Endpoint Posture? With the first NIS2 audit deadline on June 30, 2026, most IT teams are about to find out whether their security is real or just well-intentioned. According to a CyberSmart survey of 670 business leaders across the UK and EU from April 2026, only 16% of organizations consider themselves fully NIS2-compliant. The gap is not poor security. It is missing documentation By Rikke Borup, CMO, CapaSystems · June 10, 2026 Your auditor will not ask to see your security policy. They will ask for evidence. NIS2 audit documentation is the structured, continuous record showing that your organization has monitored endpoint configuration, patched known vulnerabilities, and controlled privileged access — not as a one-time exercise, but as an ongoing operational practice. That distinction is what most mid-sized IT teams are unprepared for. Under the NIS2 Directive, enforcement is now active across all 21 EU member states that have transposed the legislation. Essential entities face fines of up to €10 million or 2% of global annual turnover. The bottleneck for most organizations is not intent. It is the ability to produce evidence on demand. This article covers what NIS2 audit documentation requires in practice, why most organizations fall short, what auditors specifically examine, and how to build an endpoint environment that produces the evidence automatically — the operational side of the broader NIS2 requirements for endpoint management. ### Why Most Organizations Fail NIS2 Audit Readiness The organizations that struggle most with NIS2 audits are not those with poor security. They are those whose security is real but whose documentation is fragmented across multiple point tools — none of which were designed to produce audit-ready output. #### Fragmented Tooling, No Single Record A typical mid-sized IT environment runs separate tools for patch management, vulnerability scanning, privilege access and endpoint configuration. Each produces its own logs in its own format. When an auditor requests a consolidated posture record, someone has to manually extract, cross-reference and format data from several different systems. The result is incomplete, time-consuming and difficult to defend under scrutiny. #### Manual Evidence Collection NIS2 requires continuous evidence — not a report assembled the week before an audit. Manual collection introduces gaps: data that was never logged, logs that were overwritten, timestamps that do not align across systems. Auditors are trained to look for exactly these inconsistencies. #### Incomplete Patch Scope Most organizations patch their operating systems. Fewer have systematic processes for third-party applications. Fewer still have automated driver updates with a documented audit trail. NIS2 does not distinguish between these categories — and neither do auditors. #### No Governance Log for Privileged Access Least privilege is a named NIS2 requirement. Without automated logging of every elevation event — who, when, which system, which justification — it is impossible to demonstrate the principle is followed in practice rather than stated in policy. ### NIS2 Audit Documentation Checklist for Endpoint Teams When a NIS2 auditor arrives, these are the records your organization should be able to produce on demand: - Configuration history — timestamped records of endpoint configuration state and detected drift - Patch records — OS, third-party applications and drivers, with dates and affected endpoints - Vulnerability reports — CVE exposure status and remediation timelines - Privilege access logs — every elevation event with justification and session duration - Asset inventory — complete and continuously updated endpoint register - Compliance reports — current posture status exportable for audit presentation - Remediation records — documented workflow showing how identified issues were resolved If any of these records require manual compilation before you can produce them, your documentation process has a gap. ENISA’s Threat Landscape 2024 identifies exploitation of known, unpatched vulnerabilities as one of the leading attack vectors in Europe — which is precisely why NIS2 auditors probe patch and remediation records first. ### How CapaOne Generates NIS2 Audit Documentation Automatically CapaOne is designed so that compliance evidence is a continuous output of day-to-day endpoint management — not something assembled under audit pressure. The platform covers every item on the checklist above from a single console, hosted in the EU. #### Security Monitor: Configuration and Posture Records CapaOne Security Monitor tracks endpoint configuration continuously and logs every deviation with timestamps. Configuration history, drift detection, vulnerability exposure and remediation records are captured automatically. When an auditor requests a posture report, it is already structured and time-stamped — no manual compilation required. See the full capability on the CapaOne platform overview. #### Privilege Manager: Access Governance Logs CapaOne Privilege Manager implements just-in-time elevation with automatic session logging. Every privilege request is recorded: who, when, which system, which justification. The log is exportable for audit use without additional preparation — transforming least privilege from a stated policy into a documented, auditable practice. #### Application Manager and Provision Manager: Full Patch Coverage CapaOne Application Manager manages third-party application deployment and updates, documenting each patch event as part of the compliance record. Driver orchestration is handled by Provision Manager, which automates bare-metal OS deployment and driver updates in a cloud-native workflow — with a full audit trail. Together they deliver patch documentation across the entire endpoint software stack: OS, applications and drivers. ### Built in Denmark. Hosted in the EU. NIS2 by Design. CapaOne is developed in Denmark and hosted within EU infrastructure. Data residency is documentable, and the hosting location can be stated clearly to DPAs and auditors. For organizations operating under digital sovereignty requirements — an increasingly common procurement criterion across regulated European industries — this matters. Comparing platforms side by side on EU hosting, NIS2 support, and Intune fit turns that criterion into a decision instead of an assumption. For organizations running Microsoft Intune, CapaOne closes the NIS2 documentation gaps Intune does not address natively: third-party application patching, driver orchestration, privileged access governance and audit-ready posture reporting. Read how CapaOne works with or without Intune. For organizations without Intune, CapaOne functions as a complete standalone endpoint management platform. ### June 30 Is the First Deadline. The Standard Applies to Every Audit After. NIS2 compliance is not a one-time certification. The organizations best positioned — with auditors, cyber insurers and in regulated procurement processes — are those that treat NIS2 audit documentation as a continuous operational output. June 30 is the first deadline. The evidence requirement applies at every audit that follows. If your current tooling cannot produce that documentation without manual effort, the question is not whether to address it — it is how quickly. Book a demo of CapaOne Endpoint Management Platform and see what NIS2 audit documentation looks like when it is generated automatically. Start a free trial and explore the platform at your own pace. ### Frequently Asked Questions **What Is NIS2 Audit Documentation?** NIS2 audit documentation is the continuous, structured record an organization must be able to produce to demonstrate operational compliance to a regulator or auditor. For endpoint management teams, this covers configuration history, patch records, vulnerability reports, privilege access logs, asset inventory, compliance reports and remediation records. **What Does a NIS2 Auditor Look for in Endpoint Documentation?** NIS2 auditors examine whether endpoint security controls are continuously monitored and evidenced — not just stated in policy. They specifically look for: continuous configuration records with drift detection history, privilege access logs showing least privilege is enforced in practice, and patch compliance history covering OS, third-party applications and drivers. **What Is the NIS2 Audit Deadline in 2026?** June 30, 2026 is the first formal compliance audit deadline for NIS2-obligated organizations across the EU. Enforcement is active in 21 member states. Essential entities face fines of up to €10 million or 2% of global annual turnover for non-compliance, as set out in the NIS2 Directive. **Can CapaOne Generate NIS2 Audit Documentation Automatically?** Yes. CapaOne Security Monitor, Privilege Manager and Application Manager continuously generate the documentation NIS2 auditors require — configuration posture records, privilege governance logs and full patch compliance history — without manual preparation. Driver orchestration is handled by Provision Manager, which automates OS deployment and driver updates with a full audit trail. All data is held on EU-hosted infrastructure. Written by Rikke Borup CMO, CapaSystems Rikke is Chief Marketing Officer at CapaSystems, where she has led marketing and communications since 2009. With more than 17 years of experience in the IT sector — including cybersecurity, endpoint management software and IT services — she brings long-standing, practical insight into the challenges facing modern enterprise IT environments. Trained as a journalist, Rikke specializes in translating complex technical concepts into clear, easy-to-understand communications for IT decision-makers. More from Rikke Borup → LinkedIn ↗ Book a Demo → --- URL: https://capaone.com/blog/nis2-endpoint-compliance-denmark-cybersecurity-strategy/ Published: 2026-06-09 Summary: Denmark's 2026–2029 cyber strategy raises the bar on NIS2 endpoint compliance. Here is what changed — and what CIOs must have in place. ← All articles Blog ## NIS2 Endpoint Compliance and Denmark's New Cybersecurity Strategy Denmark just made endpoint governance a national priority. If your organization cannot demonstrate continuous visibility and audit-ready patch compliance, the gap is no longer just a security risk — it is a regulatory and reputational one. By Rikke Borup, CMO, CapaSystems · June 9, 2026 On 28 January 2026, the Danish government and a broad parliamentary majority agreed on a national cybersecurity strategy for 2026–2029, backed by 211 million kroner. The centerpiece is SMV-CERT: a new public-private entity that will monitor threats, issue warnings, and provide incident support — co-funded by Industriens Fond, which contributed 42 million kroner to its private component. The strategy is explicit about its scope: it targets the organizations and citizens that the NIS2 Directive does not reach directly. That framing matters. While the strategy formally covers SMEs and citizens, its underlying logic applies to every Danish organization expected to demonstrate NIS2 endpoint compliance: you need continuous endpoint visibility, documented patching processes, and compliance evidence that is available before anyone asks for it. DI Digital, Denmark’s digital business association, welcomed the agreement and highlighted SMV-CERT as a long-awaited step forward for SME protection. At the same time, the association pointed to a structural tension in the strategy: it raises ambition without providing a concrete operational framework for how organizations build the capacity to meet it. That gap — between regulatory expectation and operational reality — is where CIOs are now being asked to act. ### What the 2026–2029 Strategy Changes for Your Compliance Posture The agreement is built around four pillars: a strengthened cyber hotline for citizens, coordinated action against digital fraud, the establishment of SMV-CERT, and deeper operational cooperation between public and private actors through national exercises. SMV-CERT will not manage endpoints on your behalf. It will issue threat intelligence and provide advisory support. The organizations that can act on that intelligence are those with real-time endpoint visibility already operational — not those scrambling to aggregate data across disconnected tools when an advisory lands. #### NIS2 Plus National Requirements: The Combined Picture NIS2 sets binding requirements for risk management, incident reporting, and supply chain security across the EU. Denmark’s 2026–2029 strategy supplements NIS2 — extending its logic to sectors and organizations outside NIS2’s direct scope and reinforcing the expectation of operational endpoint governance across Danish business. Taken together, the compliance picture now requires continuous visibility into endpoint exposure, automated and documented patch management across OS and third-party applications, and compliance evidence generated as an operational output—not assembled manually when an audit or insurance renewal demands it. #### The Implementation Gap Higher ambition without a clear operational framework creates a practical constraint for IT teams. For a CIO with a team of 5–20 people, the question is concrete: do the tools currently in place provide continuous visibility and audit-ready evidence that the combined NIS2 and national compliance environment now demands? For most mid-market organizations, the honest answer is no. ### Three NIS2 Endpoint Compliance Areas CIOs Must Address Now SMV-CERT’s operational launch is still ahead. The organizations that will benefit from its threat intelligence are those that have already closed the foundational gaps. For a detailed breakdown of each requirement, see our practical guide to NIS2 requirements for endpoint management. #### Continuous Endpoint Visibility Knowing your exposure requires a unified, real-time view of OS versions, application patch levels, driver currency, and configuration state across every endpoint. Fragmented point solutions produce fragmented views — and by the time data is manually aggregated, the window for response has closed. The compliance standard implied by both NIS2 and the Danish strategy is continuous visibility, not a point-in-time snapshot produced for a quarterly review. #### Third-Party Application Patching OS patch cycles are managed. Third-party application vulnerabilities frequently are not. Hundreds of applications run on every endpoint — none covered by OS update policies. ENISA’s Threat Landscape 2024 identifies unpatched applications as one of the primary initial access vectors in European cyber incidents. Automated third-party patching — without manual repackaging — is an operational baseline for NIS2 endpoint compliance, not an optional capability. #### Audit-Ready Compliance Evidence In a fragmented stack, compliance reporting is a project. Gathering evidence across disconnected tools takes hours or days, and the result is a snapshot — not a continuous record. When an auditor, a cyber insurer or a board member asks for proof of endpoint governance, the answer cannot depend on someone manually assembling exports from multiple systems. Compliance evidence must be a byproduct of daily operations — not produced on demand. ### How CapaOne Addresses NIS2 En****dpoint Compliance CapaOne is a European-built, cloud-native Endpoint Management Platform designed for lean IT teams that need to deliver enterprise-grade NIS2 endpoint compliance without the resources of an enterprise. The platform consolidates core capability areas into a single system, replacing the point-solution stack that fragments compliance evidence and slows vulnerability response. See the full platform on the CapaOne platform overview. #### Security Monitor: Continuous Exposure Visibility Security Monitor surfaces vulnerability and configuration exposure across the full endpoint estate in a single view. OS versions, application patch levels, driver currency, and configuration state are visible continuously. When SMV-CERT issues a threat advisory, your team can act within hours — not days spent aggregating data across separate tools. #### Application Manager: Automated Third-Party Patch Compliance Application Manager automates detection, packaging, and deployment of third-party application updates without manual repackaging or scripting. Patch coverage extends across the application estate. Compliance evidence is generated as a byproduct of the deployment workflow — not assembled after the fact. #### Provision Manager: OS Deployment and Driver Orchestration Provision Manager handles cloud-native OS deployment and automated driver orchestration in a single workflow. When a device needs to be provisioned or recovered, the platform manages the full sequence — including correct drivers for the specific hardware model — without on-premises infrastructure or manual image maintenance. ### European by Design CapaOne is developed in Denmark and hosted in the EU. All operational data — patch status, application inventory, configuration state, vulnerability exposure — remains under EU jurisdiction with no exposure to US cloud legislation. For organizations subject to GDPR, NIS2, and a national strategy that explicitly prioritizes European digital sovereignty, data residency is a structural requirement. Learn more about CapaOne’s European sovereignty and data residency. ### The Direction Is Set. The Operational Gap Is Yours to Close. Denmark’s 2026–2029 strategy does not add new binding requirements for most mid-market organizations beyond NIS2. What it does is signal where regulatory and reputational attention will focus—and raise the baseline expectation for what demonstrable endpoint governance looks like. Organizations that can demonstrate continuous endpoint visibility, documented patch compliance, and audit-ready evidence are not just compliant; they are audit-ready. They are positioned to act on threat intelligence, answer board questions with data, and approach cyber insurance renewals from a documented posture rather than an assumed one. The organizations not positioned for this are not those that lack security intent. They are those still managing endpoints across separate tools, producing compliance evidence manually, and relying on point-in-time snapshots. The strategy makes the direction of travel clear. The distance to close is operational — and it starts with the platform your IT team runs every day. Book a demo of CapaOne Endpoint Management Platform and see how your organization can meet the NIS2 endpoint compliance standard Denmark’s strategy now demands — with the IT team you already have. Start a free trial and explore the platform at your own pace. ### Frequently Asked Questions **What Is SMV-CERT and Who Does It Cover?** SMV-CERT is a new public-private cyber entity established under Denmark’s 2026–2029 cybersecurity strategy, co-funded by the Danish government and Industriens Fond with 42 million kroner for its private component. It monitors cyber threats, issues early warnings, and provides advisory support — primarily for SMEs and organizations outside NIS2’s direct scope. SMV-CERT issues intelligence; it does not manage endpoints. To act on its advisories, your organization needs continuous endpoint visibility and automated patch workflows already in place. **Does the 2026–2029 Strategy Create New Compliance Obligations?** Not in the form of new binding legal requirements beyond NIS2 for most mid-market organizations. What it does is reinforce the operational expectation: demonstrable endpoint governance, continuous vulnerability visibility, documented patching processes, and audit-ready compliance evidence. For organizations already subject to NIS2, GDPR, ISO 27001, or cyber insurance requirements, the strategy aligns with and extends those existing obligations. **How Does CapaOne Support NIS2 Endpoint Compliance?** CapaOne Endpoint Management Platform addresses the core operational requirements of NIS2 and the Danish strategy points toward: continuous endpoint exposure visibility through Security Monitor, automated third-party application patching through Application Manager, OS deployment and driver orchestration through Provision Manager, and just-in-time privilege management through Privilege Manager. Compliance evidence is generated as a byproduct of daily operations. The platform is developed in Denmark and hosted in the EU. **Why Does EU Hosting Matter for NIS2 Endpoint Compliance?** Endpoint management platforms process sensitive operational telemetry: patch status, application inventory, OS logs, privilege elevation events, and configuration state. For organizations subject to GDPR and NIS2, the hosting jurisdiction is a compliance variable. Platforms hosted outside the EU may expose this data to US cloud legislation, including the Cloud Act and FISA, regardless of contractual terms. CapaOne is hosted in the EU, ensuring all data remains under EU jurisdiction without additional configuration. **Where Should a CIO Start With NIS2 Endpoint Compliance?** Start with a visibility audit: can your team produce a real-time view of patch status, application versions, driver currency, and configuration state across the full endpoint estate — without manually aggregating data from multiple tools? If not, that is the first gap. From there, assess whether automated patching covers third-party applications, not just OS updates. Then, determine whether compliance evidence is generated automatically or assembled manually under pressure. CapaOne closes all three gaps. Written by Rikke Borup CMO, CapaSystems Rikke is Chief Marketing Officer at CapaSystems, where she has led marketing and communications since 2009. With more than 17 years of experience in the IT sector — including cybersecurity, endpoint management software and IT services — she brings long-standing, practical insight into the challenges facing modern enterprise IT environments. Trained as a journalist, Rikke specializes in translating complex technical concepts into clear, easy-to-understand communications for IT decision-makers. More from Rikke Borup → LinkedIn ↗ Book a Demo → --- URL: https://capaone.com/blog/nis2-requirements-endpoint-management/ Published: 2026-06-09 Summary: What does NIS2 actually require from endpoint management? Visibility, patching, access controls, and audit evidence — explained for IT teams. ← All articles Blog ## NIS2 Requirements for Endpoint Management: A Practical Guide NIS2 does not tell you which tools to buy. It tells you what you must be able to prove. For endpoint teams, that difference changes everything. By Rikke Borup, CMO, CapaSystems · June 9, 2026 Most organizations subject to NIS2 already have patching processes, endpoint tools, and security policies in place. The compliance gap is rarely a question of intent. It is a question of evidence. NIS2 emphasizes operational capability — the ability to demonstrate that risk is managed continuously, not only when an auditor arrives. For endpoint management teams, that shift is significant. Patch status, vulnerability exposure, privilege controls, and compliance records are no longer internal operational metrics. They are the documentation your organization must be able to produce on demand. This guide covers what NIS2 actually requires in practice, where most mid-sized organizations fall short, how NIS2 sits alongside GDPR and data sovereignty, and how to build an endpoint environment that meets the standard — without rebuilding everything from scratch. ### What NIS2 Requires From Endpoint Management Teams The Network and Information Security Directive 2 sets binding requirements for risk management, incident response, supply chain security, and business continuity across the EU. Unlike earlier frameworks that focused on policy documentation, NIS2 emphasizes operational control. Denmark’s national cybersecurity strategy for 2026–2029 reinforces exactly this shift — extending NIS2’s logic to sectors and organizations outside its direct scope and raising the baseline expectation for every Danish organization. Read our analysis of what the strategy means for CIOs and IT teams. For endpoint management, the practical requirements fall into five areas. NIS2 Requirement Operational Capability Needed Risk Management Continuous endpoint visibility and vulnerability monitoring Vulnerability Management Automated detection, prioritization, and remediation tracking Patch Management OS and third-party application patching with deployment evidence Access Controls Least privilege enforcement and just-in-time elevation Incident Response Real-time endpoint alerts and configuration state visibility Compliance Reporting Audit-ready evidence generated continuously — not on demand #### 1. Continuous Endpoint Visibility You cannot manage risk you cannot see. NIS2 expects organizations to continuously understand their exposure, not produce a snapshot for a quarterly review. That requires a unified, real-time view of device inventory, OS versions, application versions, configuration state, and vulnerability exposure across every endpoint. Fragmented point solutions produce fragmented visibility. When patch data lives in one tool, vulnerability data in another, and device inventory in a third, the combined picture only exists when someone manually assembles it. By that point, the window for response has often closed. #### 2. Vulnerability Management NIS2 requires organizations to identify and proactively address vulnerabilities. According to the ENISA Threat Landscape 2024, unpatched and known vulnerabilities account for 21.3% of initial access vectors in European cyber incidents — making vulnerability management one of the highest-impact controls an endpoint team can operate. Effective vulnerability management under NIS2 requires continuous monitoring, risk prioritization, exposure tracking across both OS and applications, and documented remediation timelines. Periodic scans are not sufficient. #### 3. Patch Management Patch management is one of the most visible indicators of cybersecurity maturity — and one of the first areas an auditor will examine. Around 60% of data breaches involve known, unpatched vulnerabilities rather than novel zero-days, which is why patch evidence carries so much weight. Under NIS2, organizations should be able to demonstrate OS patch compliance, third-party application patching, deployment success rates, and remediation timelines. The challenge for most IT teams is not OS patching. Windows update cycles are well understood. The gap is third-party applications. Browsers, PDF readers, conferencing tools, and productivity applications run on every endpoint and represent equally significant attack surfaces — but are often excluded from automated patching workflows entirely. #### 4. Privileged Access Management Excessive privileges remain one of the most common causes of security incidents. NIS2 reinforces the need for strong access controls. For endpoint environments, that means enforcing least privilege principles, controlling elevation through policy rather than standing admin rights, and maintaining logs that document who received elevated access, when, and for how long. Standing local administrator rights are a significant compliance risk. Just-in-time elevation — where access is granted for a specific task and automatically revoked — is the operational standard NIS2 compliance points toward. #### 5. Compliance Reporting and Audit Readiness Security controls only satisfy NIS2 if organizations can prove they exist and operate effectively. CIOs should be able to answer the following without manual data assembly: which devices are compliant, which vulnerabilities remain unresolved, how quickly patches are deployed, which users have privileged access, and what has changed in the last 90 days. If producing those answers requires exporting data from four different tools and combining them in a spreadsheet, compliance becomes unsustainable at scale. ### NIS2 Endpoint Management Checklist Use this checklist to assess your current NIS2 readiness across endpoint management. Any gap increases both compliance risk and operational risk. - ✓ Complete and continuously updated endpoint inventory - ✓ Real-time vulnerability visibility across OS and applications - ✓ Automated OS patching with documented deployment success rates - ✓ Automated third-party application patching - ✓ Least privilege enforcement and just-in-time elevation - ✓ Access logging and privilege audit records - ✓ Compliance reporting generated automatically — not manually assembled - ✓ Historical audit records accessible without manual export - ✓ Incident response processes with endpoint alert integration - ✓ Continuous monitoring across the full endpoint estate ### Where Mid-Sized Organizations Fall Short Across organizations managing 250–1,000 endpoints, the same NIS2 compliance gaps appear repeatedly. #### Fragmented Visibility Multiple endpoint tools produce inconsistent data and fragmented reporting. No single view covers the full estate. Evidence gathering becomes a manual project rather than an operational output. #### Unmanaged Third-Party Applications OS updates run on schedule. Third-party applications — browsers, PDF readers, conferencing tools — remain unpatched for weeks or months. That exposure is visible to auditors and to attackers. #### Manual Compliance Reporting Audit evidence depends on spreadsheets and manual exports. Producing it takes hours or days. The result is a point-in-time snapshot, not a continuous compliance record. #### Standing Administrator Privileges Local administrator rights remain widespread. There are no logs of when the elevation occurred, who approved it, or how access was used. Under NIS2, that is a documented gap — not an acceptable default. #### Tool Sprawl Security and endpoint teams frequently operate five or more overlapping tools. Each adds licensing cost, agent overhead, and a new source of fragmented data. Consolidation is not just an efficiency decision under NIS2 — it is a visibility and auditability decision. ### NIS2 Enforcement Is Now Live NIS2 has moved from preparation into enforcement. As of May 2026, 21 of the EU’s 27 member states have transposed the directive into national law, according to the ECSO NIS2 Transposition Tracker. Regulators are active, and fines for essential entities reach €10 million or 2% of global annual turnover, whichever is higher, with explicit management liability. The European Commission’s January 2026 simplification proposals reduce paperwork for an estimated 28,700 organizations — but they do not narrow enforcement scope. The reporting burden gets lighter; the obligation does not. ### What Compliance Looks Like Today Most organizations are not ready. Only 16% of organizations required to comply with NIS2 consider themselves fully compliant, according to CyberSmart’s April 2026 NIS2 Survey of 670 business leaders across the UK and EU. For Danish IT teams, a national deadline sharpens the pressure: under the 2026 municipal budget agreement between the government and KL, Danish municipalities must establish four to five regional shared IT service organizations by 1 January 2027 — consolidation that puts endpoint compliance evidence on the near-term agenda. ### GDPR, NIS2, and Data Sovereignty: What Each Requires from Endpoint Management GDPR, NIS2, and data sovereignty ask three different questions of the same endpoint estate. GDPR asks whether you protect the personal data your endpoints and management tools process. NIS2 asks whether you manage cybersecurity risk across your systems — and whether you can prove it. Data sovereignty asks who controls that data: where it lives, who can reach it, and which jurisdiction applies. None of the three names a specific tool. All three come down to control you can document. | GDPR | NIS2 | Data sovereignty | Core question | Do you protect personal data? | Do you manage cybersecurity risk, and can you prove it? | Who controls the data, and under which law? | Source | Regulation (EU) 2016/679, Article 32 and Chapter V | Directive (EU) 2022/2555, Article 21 | No single law — organizations set it in procurement, guided by GDPR’s transfer rules | Applies to | Every organization that processes personal data | Essential and important entities in scope | Every organization that decides where its endpoint data may go | Endpoint controls | Encryption, access control, data minimization, regular testing | Asset inventory, vulnerability handling, patching, access control, MFA, incident handling | Hosting location, vendor access, sub-processors, vendor jurisdiction | #### GDPR: Protect the Personal Data Your Endpoints Process Endpoint management tools typically process personal data: user names, device identifiers, IP addresses, and installed-software records. Article 32 of GDPR requires appropriate technical and organizational measures to protect that data, including encryption, ongoing confidentiality and integrity, and regular testing of the measures themselves. For endpoint teams, that means disk encryption, least-privilege access, timely patching, and records that show who changed what. #### NIS2: Manage Cybersecurity Risk and Prove It NIS2 Article 21 lists the measures in-scope organizations must take, including asset management, vulnerability handling, access control, multi-factor authentication, cryptography, and incident handling. The sections above translate those measures into five endpoint capabilities. One point often causes confusion: NIS2 does not require you to store data in the EU. It requires you to manage risk — including supply chain risk, which makes your endpoint management vendor part of your risk assessment. #### Data Sovereignty: Control Where Endpoint Data Goes and Who Can Reach It Data sovereignty is not a regulation in its own right. It describes who controls your data in practice. GDPR sets the rules for transferring personal data outside the EU/EEA, and the European Data Protection Board’s guidelines recognize that remote access from a third country can itself count as a transfer. EU-located servers alone therefore do not settle the question. Before you choose an endpoint platform, ask four things: where it stores endpoint data, who can access that data and from where, which sub-processors it uses, and which country’s law governs the vendor. #### Where CapaOne Fits CapaOne Endpoint Management Platform answers all three from one place. The platform is Danish-built and EU-hosted, with no transfer of endpoint data to US jurisdiction — a GDPR-first design that keeps control of endpoint data in Europe. Its NIS2-aligned posture comes from daily operations: Security Monitor, Application Manager, and Privilege Manager generate the vulnerability, patch, and privilege evidence an auditor asks for. CapaOne runs as a complete platform on its own, so none of this depends on another management tool. For hosting details, sub-processor transparency, and the Data Processing Agreement, read how CapaOne approaches European sovereignty in endpoint management. ### Does Microsoft Intune Cover NIS2 Requirements? Microsoft Intune provides a strong foundation for endpoint management: device management, compliance policies, configuration management, and application deployment. For organizations running a Microsoft-anchored stack, Intune is a core part of the answer. However, organizations evaluating NIS2 readiness consistently identify gaps that Intune does not cover natively: Third-party application patching — Intune manages Microsoft applications and some Win32 apps, but does not automate packaging and deployment of the broader third-party software estate Vulnerability visibility — Intune provides device compliance data, but not continuous exposure monitoring across OS versions, application patch levels, and driver currency in a single view Driver and OS deployment — bare-metal provisioning and automated driver orchestration require capabilities outside Intune’s native scope Just-in-time privilege elevation — Intune does not natively enforce least-privilege through controlled, audited elevation workflows CapaOne Endpoint Management Platform covers those gaps as a complete platform — designed to work with Microsoft Intune, or entirely without it. Read how CapaOne works with Microsoft Intune. #### How CapaOne Addresses NIS2 Requirements for Endpoint Management CapaOne Endpoint Management Platform consolidates the five core NIS2 capability areas into a single cloud-native system — replacing the point-solution stack that fragments compliance evidence and slows vulnerability response. #### Security Monitor Continuous vulnerability and configuration visibility across the full endpoint estate. OS versions, application patch levels, driver currency, and configuration state in a single view — not assembled manually across tools. #### Application Manager Automated detection, packaging, and deployment of third-party application updates without manual repackaging. Patch coverage across the full application estate. Compliance evidence is generated as a byproduct of the deployment workflow. At NIRAS — a Danish engineering firm managing more than 3,000 devices across 60+ global locations — automated patching through CapaOne replaced a resource-intensive manual process and delivered transparent vulnerability scoring across the entire estate. #### Provision Manager Cloud-native OS deployment and automated driver orchestration in a single workflow. No on-premise infrastructure. No manual image maintenance. Correct drivers for every hardware model are applied automatically. #### Privilege Manager Policy-based just-in-time elevation that removes standing administrator rights without adding friction for end users. Full audit evidence of who received elevation, when, and for what purpose — audit-ready by default. At Lattec — a one-person IT team managing 60 endpoints — CapaOne checks and handles updates automatically twice daily, giving the administrator complete control and stronger security without manual intervention. CapaOne is developed in Denmark and hosted in the EU. The platform is EU-hosted, with no transfer of endpoint data to US jurisdiction. ### NIS2 Compliance Is Operational, Not Theoretical NIS2 does not require organizations to buy specific products. It requires the ability to demonstrate control — continuously, not on demand. For endpoint management teams, that means closing the gap between the tools currently in place and the evidence those tools can actually produce. Patch data in one system, vulnerability data in another, and privilege records in a third is not a compliance posture. It is a compliance liability. The organizations that will be best positioned for NIS2 are not those with the largest security budgets. They are those that can answer an auditor’s question in minutes rather than days — because their endpoint platform generates compliance evidence as a byproduct of daily operations. Book a demo of CapaOne Endpoint Management Platform to see how your organization can close the NIS2 endpoint management gap — with the IT team you already have. ### Frequently Asked Questions **What Are the NIS2 Requirements for Endpoint Management?** NIS2 does not mandate specific endpoint management tools. What it requires is the ability to demonstrate operational control: continuous visibility into endpoint exposure, documented vulnerability management, OS and third-party patch compliance, least-privilege access controls, and audit-ready evidence of compliance. Organizations should be able to produce that evidence without manually assembling data across multiple tools. **What Do GDPR, NIS2, and Data Sovereignty Require from Endpoint Management?** GDPR requires organizations to protect the personal data their endpoints and management tools process, through measures such as encryption, access control, and regular testing. NIS2 requires in-scope organizations to manage cybersecurity risk — asset management, vulnerability handling, patching, access control, and incident handling — and to prove it. Data sovereignty is not a regulation of its own: it is about control over where endpoint data lives, who can reach it, and which jurisdiction applies, shaped by GDPR's rules on transfers outside the EU. None of the three mandates a specific tool. CapaOne Endpoint Management Platform is EU-hosted, with no transfer of endpoint data to US jurisdiction, and generates the patch, vulnerability, and privilege evidence an NIS2-aligned posture depends on. **Does NIS2 Require Patch Management?** NIS2 requires appropriate cybersecurity risk management measures. Patch management — covering both OS and third-party applications — is one of the most direct controls supporting that requirement. Organizations should be able to demonstrate patch compliance rates, deployment timelines, and outstanding vulnerabilities across their full software estate, not only OS updates. **Does Microsoft Intune Support NIS2 Compliance?** Microsoft Intune supports several NIS2-related requirements, including device management and compliance policies. Third-party application patching, vulnerability management, driver and OS deployment, and just-in-time privilege management call for additional capabilities. CapaOne Endpoint Management Platform delivers them as a complete platform — designed to work with Microsoft Intune, or entirely without it. **What Evidence Is Required for NIS2 Compliance?** Organizations should be able to produce patch status reports, vulnerability data with remediation timelines, device compliance records, access governance logs showing who held elevated privileges and when, and configuration state history. The key NIS2 requirement is that this evidence is available continuously — not assembled manually after an audit request arrives. **How Can IT Teams Prepare for an NIS2 Audit?** Start by assessing whether your current tools can produce continuous compliance evidence without manual aggregation. Work through the checklist in this guide: endpoint inventory, vulnerability visibility, third-party patch coverage, privilege controls, and audit-ready reporting. The organizations best prepared for NIS2 audits are those whose compliance evidence is generated automatically as part of daily endpoint operations — not produced under pressure when an audit is announced. Book a demo to see how CapaOne closes each of these gaps — from patch coverage and vulnerability visibility to privilege controls and audit-ready reporting. **What Is the Difference Between NIS2 Compliance and NIS2 Readiness?** NIS2 compliance means your organization meets the directive's requirements on paper. NIS2 readiness means your operations enforce those requirements automatically, every day, without manual intervention. The difference matters when an incident occurs, or an audit begins: compliance is what you claim, readiness is what you can prove. **Which Organizations Does NIS2 Apply To?** NIS2 applies to approximately 160,000 organizations across the EU, including essential and important entities in sectors such as energy, transport, financial services, healthcare, digital infrastructure, and manufacturing. The full directive scope is published by the European Commission. Written by Rikke Borup CMO, CapaSystems Rikke is Chief Marketing Officer at CapaSystems, where she has led marketing and communications since 2009. With more than 17 years of experience in the IT sector — including cybersecurity, endpoint management software and IT services — she brings long-standing, practical insight into the challenges facing modern enterprise IT environments. Trained as a journalist, Rikke specializes in translating complex technical concepts into clear, easy-to-understand communications for IT decision-makers. More from Rikke Borup → LinkedIn ↗ Book a Demo → --- URL: https://capaone.com/blog/best-cloud-endpoint-management-platforms/ Published: 2026-06-08 Summary: Compare cloud-based endpoint management platforms for mid-market organizations — patching, EU hosting and Intune fit, and where CapaOne fits in. ← All articles Blog ## 6 Best Cloud Endpoint Management Platforms for 2026 Most mid-sized IT teams run five endpoint tools. They only need one. By Rikke Borup, CMO, CapaSystems · June 8, 2026 Managing endpoints across a 200–1,000 employee organization has become a balancing act. Unified visibility across Windows devices, automated patching for third-party applications, audit-ready compliance reporting — all while keeping an IT team focused on work that matters rather than manual maintenance across disconnected systems. This guide covers the six leading cloud-based endpoint management platforms for mid-sized organizations in 2026. Each platform is evaluated against the criteria that determine real operational impact: third-party application patching, unified asset visibility, compliance reporting, Microsoft Intune integration, deployment speed, and EU data sovereignty. ### How We Evaluated These Platforms Six criteria drove this comparison. Not feature lists — operational reality for IT teams managing Windows-heavy environments with limited resources. #### Third-Party Application Patching OS updates cover a fraction of the attack surface. Browsers, PDF readers, and productivity tools account for a significant share of exploitable vulnerabilities. According to the ENISA Threat Landscape 2024, unpatched software remains one of the primary vectors for successful attacks. Platforms that automate third-party patching rank higher. #### Unified Visibility and Inventory Real-time insight into every endpoint’s patch status, configuration drift, and security posture — without switching between dashboards. #### Compliance Reporting Generating audit-ready evidence for GDPR, NIS2, or internal governance should take minutes. If it takes hours of manual data gathering, the platform is not doing its job. #### Microsoft Intune Integration Most mid-sized organizations already use Intune for enrollment and compliance policies. Platforms that work with Intune rather than duplicate it deliver more value per euro spent. #### Deployment Speed Cloud-native platforms that deploy in days reduce time-to-value and free IT teams from infrastructure maintenance. Weeks-long implementations are not acceptable for mid-market budgets and team sizes. #### EU Data Sovereignty Endpoint management platforms process sensitive operational telemetry — patch status, application inventory, privilege elevation events, configuration state. For organizations subject to GDPR and NIS2, where that data is processed and stored is a compliance variable, not a preference. ### The 6 Best Cloud Endpoint Management Platforms for 2026 #### 1. CapaOne — Best Overall for European Mid-Sized Organizations CapaOne Endpoint Management Platform is a cloud-native platform built in Denmark and hosted in the European Union. It consolidates third-party application patching, OS deployment and driver management, vulnerability visibility, privileged access control, and mobile device management into one console — designed to work alongside Microsoft Intune or entirely without it. For IT administrators managing 200–1,000 endpoints, CapaOne eliminates the tool sprawl that comes from stitching together separate solutions for each capability. One agent. One console. One renewal cycle. ### CapaOne Modules: Application Manager — Automates packaging, deployment, and third-party application updates. No manual repackaging, no scripting required for standard workflows. Keeps endpoints current without consuming administrator time. Provision Manager — Handles cloud-native bare-metal OS deployment and automated driver orchestration. Vendor-certified, model-aware driver packs deploy automatically. When a device needs provisioning from scratch or recovery after failure, Provision Manager manages the full sequence — OS installation, correct drivers for the specific hardware model, handoff for configuration. Privilege Manager — Enforces least-privilege through policy-based just-in-time elevation using existing Entra ID groups. Removes standing local admin rights without creating friction for end users. Full audit logging supports NIS2 governance requirements. Security Monitor — Surfaces configuration drift and vulnerability insights across endpoints. Gives IT teams clarity on exposure across OS versions, application versions, and driver currency in one view. Experience Monitor — Tracks real-time reliability and performance signals across the endpoint estate. Detects crashes, instability, and degradation before users raise support tickets. Mobile Manager — Unifies enrollment, configuration, compliance enforcement, and application delivery across iOS, iPadOS, and Android from one console. ### Pros: Replaces four to five point solutions with one platform — consolidation that lowers TCO and eliminates vendor sprawl Works standalone or alongside Microsoft Intune — not dependent on it EU-hosted with full GDPR and NIS2 alignment, no US jurisdiction exposure Deploys same day — agent install, inventory sync, operational from day one Pricing at EUR 1 per endpoint per month per module, with a cap of three modules billed when selecting up to five Windows products ### Cons: Optimized for Windows-centric environments; organizations with large macOS or Linux estates should evaluate coverage for those platforms As a newer platform, some third-party integrations are still maturing #### 2. Microsoft Intune — Foundation for Microsoft 365 Environments Microsoft Intune offers cloud-based device management integrated directly with Microsoft 365 and Entra ID. For organizations already invested in the Microsoft ecosystem, Intune handles enrollment, compliance policies, and Windows updates from a familiar console. Intune supports Windows, macOS, iOS, Android, Linux, and ChromeOS. Conditional access policies verify device compliance before granting access to corporate resources. ### Pros: Native integration with Microsoft 365 and Entra ID simplifies identity and policy management Included in many Microsoft 365 E3 and E5 subscriptions Broad operating system and device type support ### Cons: Third-party application patching requires additional tools or integrations — not covered natively Driver management is not included Advanced features including Endpoint Privilege Management require higher-tier licensing For organizations needing full operational coverage, Intune alone creates the tool sprawl it was meant to prevent #### 3. NinjaOne — Cross-Platform RMM Monitoring NinjaOne is a cloud-native remote monitoring and management platform covering endpoint visibility, patching, and remote access. It supports Windows, macOS, and Linux, making it relevant for mixed-OS environments. Automated patch deployment covers operating systems and third-party applications. Scripting capabilities allow IT teams to standardize configurations across device groups. ### Pros: Unified console for monitoring, patching, and remote management Cross-platform support across Windows, macOS, and Linux Scripting engine enables custom automation ### Cons: Pricing not publicly disclosed — requires sales engagement No confirmed EU hosting option, relevant for organizations subject to GDPR and NIS2 Mobile device management handled through a separate module Privilege management is not a native capability #### 4. ManageEngine Endpoint Central — Feature-Rich, Complex ManageEngine Endpoint Central offers unified endpoint management with cloud-hosted and on-premises deployment options. The platform covers patch management, software distribution, asset tracking, and mobile device management across Windows, macOS, and Linux. ### Pros: Flexible deployment supports both cloud and on-premises requirements Comprehensive feature set across patching, inventory, and OS deployment Supports Windows, macOS, and Linux ### Cons: Owned by Zoho Corporation, a US-registered entity — EU data sovereignty cannot be guaranteed Interface complexity requires significant platform familiarity Add-on modules increase total cost for organizations needing full coverage Scripting and configuration overhead is higher than cloud-native alternatives #### 5. Ivanti UEM — Enterprise Scale, Enterprise Complexity Ivanti UEM offers patch management with pre-built content for a broad range of operating systems. The platform targets large-scale environments with policy enforcement and software deployment across extensive device fleets. ### Pros: Extensive patch content library covering diverse OS environments Designed for large-scale automation Integrates with Ivanti’s broader security portfolio ### Cons: Pricing follows a custom quote model with add-on licensing for security features Implementation complexity is high — not designed for mid-market IT teams without dedicated resources No confirmed EU hosting option Total cost of ownership typically exceeds mid-market budgets #### 6. Omnissa Workspace ONE — Multi-Platform for Complex BYOD Omnissa Workspace ONE, formerly VMware Workspace ONE, manages corporate and personally owned devices across Windows, macOS, iOS, Android, Linux, and ChromeOS. The platform emphasizes conditional access and identity integration for hybrid workforces. ### Pros: Supports a wide range of device types including corporate-owned and BYOD Dashboard provides visibility into device compliance and security status Multiple enrollment options for different provisioning workflows ### Cons: Pricing has changed following the Broadcom acquisition — requires updated quotes Feature depth exceeds what most mid-sized organizations need Multiple subscription tiers make licensing decisions complex US-owned entity — EU data sovereignty cannot be guaranteed ### Platform Comparison: Cloud Endpoint Management 2026 Platform Third-Party Patching OS Deployment & Drivers EU Hosting Standalone (No Intune) CapaOne ✓ ✓ ✓ ✓ Microsoft Intune ✗ ✗ ✓ ✓ NinjaOne ✓ ✗ ✗ ✓ ManageEngine Endpoint Central ✓ ✓ ✗ ✓ Ivanti UEM ✓ ✗ ✗ ✓ Omnissa Workspace ONE ✗ ✗ ✗ ✓ ### What to Look for in a Cloud Endpoint Management Platform Choosing the right platform starts with understanding your environment. If you manage primarily Windows devices with Microsoft Intune already in place, look for a platform that works alongside Intune rather than duplicating it — adding the capabilities it doesn’t cover. Third-party application patching, OS deployment and driver management, and privileged access control are consistent gaps Intune does not cover natively. Consider where your endpoint data is processed. European organizations subject to GDPR and NIS2 should evaluate platforms hosted in the EU. This is not a compliance checkbox — it affects your ability to demonstrate control to auditors and regulators, and reduces exposure to extraterritorial data access legislation. Automation depth matters more than feature count. A platform that automates patching without constant manual intervention saves more IT hours than one with extensive features requiring ongoing attention. Look for staged rollouts, catch-up patching for offline devices, and policy-based deployment rules. Consolidating endpoint tools has become a stated priority for IT leaders across European mid-sized organizations — driven by rising compliance requirements, budget pressure, and the operational cost of managing fragmented stacks. The platforms that deliver on it are the ones where consolidation is the design principle, not an afterthought. ### How Cloud Endpoint Management Supports Compliance Reporting Compliance reporting becomes straightforward when endpoint data lives in one place. Instead of pulling patch status from one tool, vulnerability data from another, and access logs from a third, a unified platform generates audit-ready evidence from a single source. For NIS2 compliance, organizations need documented evidence of patch management processes, vulnerability monitoring, and least-privilege enforcement. The platforms that handle this well export compliance snapshots, surface historical patch status, and demonstrate that endpoints met baseline requirements at any point in time. Compliance becomes the natural result of daily operations — not a quarterly reporting exercise. ### Why CapaOne Is the Best Cloud Endpoint Management Platform for Mid-Sized Organizations CapaOne addresses the specific challenges facing European IT teams managing Windows-heavy environments. Rather than replacing your existing Intune investment, CapaOne extends it with the capabilities Microsoft does not cover: automated third-party patching, OS deployment and driver management, vulnerability visibility, and just-in-time privileged access. The platform’s EU hosting removes uncertainty about data sovereignty. When you need to demonstrate to auditors where your endpoint telemetry is processed and stored, CapaOne delivers a clear answer: built in Denmark, hosted in the EU, aligned with GDPR and NIS2. CapaOne replaces four to five point solutions with one platform. This lowers total cost of ownership while simplifying operations for IT teams that do not have time to manage multiple vendor relationships. The goal is not a more powerful stack. It is a simpler, more controlled one. Book a demo of CapaOne Endpoint Management Platform — or start a free trial and explore the platform hands-on. ### Frequently Asked Questions **What Is a Cloud-Based Endpoint Management Platform?** A cloud-based endpoint management platform lets IT teams manage, secure, and monitor devices from a centralized console hosted in the cloud — with no on-premises servers or infrastructure required. CapaOne Endpoint Management Platform deploys same day and scales from 200 to 1,000+ endpoints without infrastructure overhead. **Do I Need Endpoint Management If I Already Use Microsoft Intune?** Intune handles enrollment, compliance policies, and Windows updates. It does not natively cover third-party application patching, OS deployment and driver management, or privileged access control. CapaOne covers those gaps while using your existing Entra ID groups and compliance structure — so your Intune investment stays intact. **How Does Endpoint Management Support NIS2 Compliance?** NIS2 requires documented patch management, vulnerability monitoring, and least-privilege enforcement. CapaOne automates these requirements with continuous vulnerability visibility, policy-based just-in-time elevation with full audit logging, and exportable compliance evidence across the endpoint estate. **What Is the Difference Between UEM and Endpoint Management?** Unified endpoint management (UEM) refers to managing all device types — desktops, laptops, mobile devices — from one platform. Endpoint management can focus more narrowly on specific device categories. CapaOne Endpoint Management Platform manages Windows, iOS, iPadOS, and Android devices from one console, covering both definitions. **How Quickly Can I Deploy a Cloud Endpoint Management Platform?** CapaOne deploys same day. Install the agent, sync inventory, and start managing endpoints immediately. No on-premises infrastructure, no implementation consultants, no steep scripting requirements. Written by Rikke Borup CMO, CapaSystems Rikke is Chief Marketing Officer at CapaSystems, where she has led marketing and communications since 2009. With more than 17 years of experience in the IT sector — including cybersecurity, endpoint management software and IT services — she brings long-standing, practical insight into the challenges facing modern enterprise IT environments. Trained as a journalist, Rikke specializes in translating complex technical concepts into clear, easy-to-understand communications for IT decision-makers. More from Rikke Borup → LinkedIn ↗ Book a Demo → --- URL: https://capaone.com/blog/ai-generated-zero-day-endpoint-patch-window-visibility/ Published: 2026-06-05 Summary: AI-generated zero-days compress patch windows. Here is what that means for endpoint visibility and third-party patching. ← All articles Blog ## When AI Writes the Exploit, Your Patch Window Gets Shorter Google confirmed the first AI-generated zero-day on May 11. The operational question is not the exploit — it is how fast your team can see which endpoints are exposed. By Rikke Borup, CMO, CapaSystems · June 5, 2026 The window between a vulnerability being known and it being weaponized is shrinking. That is the operational consequence of what Google confirmed on May 11 — and it is the question IT teams need to answer before the next one lands. Google’s Threat Intelligence Group published findings confirming the first known case of a zero-day exploit developed with the help of artificial intelligence. A cybercrime group used an AI model to generate a Python script that bypasses two-factor authentication in a widely-used open-source web administration tool. Google intervened before a planned mass exploitation event could be executed. The exploit was attributed to AI with high confidence — a hallucinated CVSS score, educational docstrings, and code structure characteristic of LLM output. SC Media quoted Black Duck’s head of cybersecurity governance: “This signals a shift from human-paced vulnerability discovery to machine-scaled weaponization.” That shift is not theoretical. It is already in the data. ### What Faster Exploit Development Actually Means Google’s report is careful about scope: AI is accelerating existing vulnerability discovery and exploit development workflows — not creating entirely new attack techniques. The threat is not AI inventing novel attack categories. It is AI removing the bottleneck of specialist expertise and time from the exploit development process. The practical consequence is compression. Exploit development that previously required days or weeks of specialized human work can now happen faster, at lower cost, and at greater scale. The publicly documented acceleration in exploit release cadence over recent months illustrates what that looks like before AI assistance becomes widespread. With AI in the workflow, that cadence compresses further. #### The Third-Party Application Dimension The Google-confirmed exploit targets a web-based system administration tool — not the Windows OS. That distinction matters operationally. Most endpoint environments patch the Windows OS through established mechanisms: Windows Update, WSUS, and OS management tooling. The third-party application stack — web administration tools, browsers, document viewers, communication platforms, infrastructure utilities — follows a different and often less automated cadence. When exploit development accelerates, the applications with the longest manual patch cycles become the highest-risk targets. An AI-generated exploit targeting a web admin tool is precisely the category where manual patching processes create the widest exposure window. ### The Endpoint Visibility Question When a zero-day is confirmed in the wild, two things need to happen quickly: identify which endpoints in your estate are exposed, and close that exposure. The speed of both depends on your endpoint visibility posture before the event — not your ability to react after it. Organizations without real-time endpoint visibility face a structural disadvantage when exploit timelines compress. The question is not whether they can patch — it is whether they can see what needs patching, across the full estate, before the window closes. #### Visibility Is Not the Same as Patching This is worth stating explicitly because the two are often conflated. Patching closes a vulnerability. Visibility tells you which endpoints need the patch — and which have not received it yet despite deployment being underway. As patch windows compress, the visibility gap — the time between a patch being deployed and an IT team being able to confirm which endpoints have actually applied it — becomes operationally critical. Browser updates show the gap most clearly: CVE-2026-7896 stayed exploitable on every endpoint where Chrome or Edge had not restarted after the update arrived. That gap is where exposure persists, and where AI-accelerated exploitation finds its opportunity. ### Where CapaOne Fits CapaOne does not replace your OS patching mechanism — Microsoft distributes Windows patches through Windows Update, WSUS, Intune, and Autopatch. CapaOne’s role is the endpoint vulnerability visibility and third-party application control layer that determines how quickly your team can act when a new threat emerges. #### Security Monitor: Real-Time Endpoint Visibility Security Monitor surfaces CVE exposure, configuration drift, and patch posture across the endpoint estate in real time — independently of Microsoft Defender. When a zero-day is confirmed, Security Monitor answers the operational question: which endpoints are currently exposed, and which have received the relevant patch? That answer arrives as device-level posture evidence — not a deployment progress indicator. When exploit timelines compress, the difference between knowing a patch was deployed and knowing which specific endpoints applied it is the difference between acting on evidence and acting on assumption. #### Application Manager: Automated Third-Party Patching When exploit development accelerates, manual patch queues become a liability. Third-party patching speed becomes a security control, not an operational convenience — and the applications with the longest manual patch cycles become the highest-risk targets. Application Manager automates third-party application updates across the full estate — including web administration tools, infrastructure utilities, browsers, and business applications that represent the highest-risk targets when OS patching is well-covered. When a new exploit targets a third-party application, automated updates mean those applications do not sit unpatched while manual processes work through the queue. For the Google-confirmed exploit specifically: a web-based system administration tool with a known AI-generated exploit is precisely the category where manual patching creates the widest exposure window. Automated updates close that window before it becomes an incident. ### What the Board Needs to Understand When AI compresses the window from zero-day to active exploitation, the question for leadership is not whether the organization patches fast enough in absolute terms. It is whether the organization has the visibility infrastructure to act fast enough on a compressed timeline. An organization that patches well but cannot see which endpoints are exposed within hours of a confirmed zero-day has a structural gap that patch cadence alone cannot close. The Verizon Data Breach Investigations Report consistently identifies the gap between vulnerability disclosure and confirmed remediation as a primary breach factor — AI-assisted exploit development makes that gap more consequential, not less. Real compliance emerges when operational practices automatically enforce security and governance standards — not when patch deployment is reported but endpoint posture is assumed. The question AI-accelerated exploit development raises is not new — it is the same question every compressed patch window raises: can your team see which endpoints are exposed, and close that exposure before the window closes? Book a demo to assess your endpoint visibility posture and see how Security Monitor and Application Manager work together — or start a free trial and validate your patch latency and exposure coverage today. ### Frequently Asked Questions **What Did Google Confirm About AI-Generated Zero-Day Exploits?** On May 11, 2026, Google’s Threat Intelligence Group confirmed the first known case of a zero-day exploit developed with AI assistance. A cybercrime group used an AI model to generate a Python script bypassing two-factor authentication in a widely-used open-source web administration tool. Google worked with the vendor to prevent a planned mass exploitation event. The exploit was attributed to AI with high confidence based on a hallucinated CVSS score, educational docstrings, and LLM-characteristic code structure. **What Does AI-Assisted Exploit Development Mean for Patch Windows?** AI-assisted exploit development accelerates the time from vulnerability discovery to weaponization. Where exploit development previously required specialized human expertise over days or weeks, AI can compress that timeline. For IT teams, this means the window between a vulnerability being known and it being actively exploited is shrinking — increasing the operational importance of real-time endpoint visibility and automated third-party application patching. **Does This Affect Windows Endpoints Specifically?** The Google-confirmed exploit targets a web-based system administration tool, not the Windows OS. This makes third-party application patching the critical control — not just OS patching. Most endpoints run dozens of third-party applications, each a potential vector if unpatched. CapaOne Application Manager automates third-party application updates across the estate, reducing the exposure window that AI-accelerated exploit development compresses. **What Is Endpoint Vulnerability Visibility?** Endpoint vulnerability visibility is the ability to see, in real time, which endpoints across your estate are exposed to known vulnerabilities — which applications are outdated, which configurations have drifted, and which devices have not received recent patches. When exploit development accelerates, the time available to identify and remediate exposure shrinks. Organizations without real-time visibility cannot act fast enough on a compressed timeline. **How Does CapaOne Help When Exploit Timelines Compress?** Security Monitor surfaces CVE exposure, configuration drift, and patch posture across the endpoint estate in real time — independently of Microsoft Defender. Application Manager automates third-party application patching across the full estate, including applications outside Microsoft’s EAM catalog. Together they address the two controls that matter most when patch windows shrink: knowing which endpoints are exposed, and closing that exposure automatically. Written by Rikke Borup CMO, CapaSystems Rikke is Chief Marketing Officer at CapaSystems, where she has led marketing and communications since 2009. With more than 17 years of experience in the IT sector — including cybersecurity, endpoint management software and IT services — she brings long-standing, practical insight into the challenges facing modern enterprise IT environments. Trained as a journalist, Rikke specializes in translating complex technical concepts into clear, easy-to-understand communications for IT decision-makers. More from Rikke Borup → LinkedIn ↗ Book a Demo → --- URL: https://capaone.com/blog/endpoint-automation-gap-sysadmin-2026-tool-sprawl/ Published: 2026-06-04 Summary: 73% of sysadmins want endpoint management automated. Only 23% are there. What the sysadmin automation gap looks like — and what closes it. ← All articles Blog ## The Endpoint Automation Gap: 73% Want It, 23% Have It Most sysadmins know exactly what they want. The tools they have are not delivering it. By Rikke Borup, CMO, CapaSystems · June 4, 2026 You already know you want more automation. Most sysadmins do. The question is why it is not happening yet — and what the platform that actually delivers it looks like. PDQ’s 2026 State of System Administration report, based on 1,034 IT professionals surveyed between October and December 2025, puts a number on it: 73% of sysadmins say endpoint management should be mostly or fully automated. Only 23% are already there. That 50-point gap is not a technology problem. It is a tooling problem. The endpoint automation gap is the distance between the automation IT teams want and the automation their current tools actually deliver. It exists not because automation is technically unavailable — but because most endpoint environments run on fragmented point solutions that each automate one slice of the problem while leaving the rest manual. ### What the Sysadmin Automation Gap Actually Looks Like The gap does not come from indifference. Sysadmins report rising stress, expanding responsibilities, and growing system complexity — without matching headcount or training. Those are symptoms. The cause sits in the tooling: work that repeats every week still requires manual attention across several consoles. What sysadmins pursue in response is telling. Standardizing environments and automating high-risk, repeatable tasks rank as the two primary strategies. That is not a request for more features. It is a request for less manual work on the tasks that never stop repeating. #### The AI Nuance Worth Noting Sysadmins are not resistant to AI. The hesitation is narrower than that: automation that makes production decisions no one can review or reverse is a different proposition from automation that removes repetitive work. Assistive automation with human oversight is the target, not autonomous agents. ### Why Tool Sprawl Keeps the Gap Open The automation most sysadmins want is not exotic. It is the basic stuff: application updates that run without a packaging sprint, privilege elevation that does not require a helpdesk ticket, driver updates that do not need manual research per hardware model, vulnerability visibility that does not require cross-referencing three consoles. A typical Tuesday currently looks like this for most endpoint admins: open the vulnerability dashboard and note which CVEs need attention. Switch to the patching tool and check which endpoints missed last night’s update. Open the packaging tool and work through the Chrome installer that broke last week. Check the privilege request queue and process the four elevation tickets that came in overnight. Pull a report from a third tool to correlate exposure across the estate — by which point the morning is gone and the packaging sprint has not started. None of those tasks is complex. All of them are manual. And all of them require the IT Administrator to hold the state of six different tools in his head simultaneously — which is exactly what the catch-up cycle looks like from the inside. The reason most sysadmins are still doing this manually is not that automation tools do not exist. It is that the tools they have are fragmented. One tool for patching, another for privilege management, a third for vulnerability scanning, a fourth for drivers. Each tool has its own console, its own update cycle, its own quirks, and its own maintenance burden. The cognitive load of context-switching between four to six point solutions is itself a form of manual work. It is invisible in headcount discussions but visible in the stress and catch-up cycle the research describes. Tool sprawl does not just create more work — it makes the automation you already have harder to trust and harder to maintain. ### What Closing the Gap Looks Like in Practice The automation sysadmins want does not require a rip-and-replace. It requires a platform that consolidates the repeatable work into one operational model. Here is what that looks like across the tasks that consume the most time. #### Application Updates Without the Packaging Sprint Application Manager automates third-party and business application updates across the estate — no manual packaging, no scripting, no chasing installer logic per update cycle. Updates run on schedule, silently, with staged rollout control and deployment posture evidence. The packaging sprint becomes a one-time setup, not a recurring task. For the applications outside any pre-built catalog — custom line-of-business tools, sector-specific software — no-code packaging removes the scripting dependency. The IT Administrator sets the rules once. The platform handles the rest. #### Privilege Elevation Without the Helpdesk Ticket Privilege Manager replaces ad-hoc elevation requests with policy-based, just-in-time elevation via existing Entra ID groups. Users get access to what they need, for the duration they need it, without standing local admin and without generating a helpdesk ticket. Every elevation event is logged automatically — no manual documentation required. The time this returns is not just the elevation handling itself. It is the context-switching, the back-and-forth, and the interruption cost that accumulates when every elevation request lands in the IT Administrator’s queue. #### Vulnerability Visibility Without the Console Juggle Security Monitor surfaces CVE exposure, configuration drift, and patch posture across the estate in a single console — without cross-referencing separate tools to assemble a complete picture. The vulnerability signals that previously required the IT Administrator to pull from three places arrive in one view, prioritized by severity. The value is not just the data. It is the elimination of the assembly work — the manual reconciliation between tools that produces a posture view that is already outdated by the time it is complete. #### Driver Updates Without the Hardware Research Driver management is one of the most consistently underestimated time sinks in endpoint operations. Every hardware model requires model-specific, vendor-certified driver packages. The research, download, test, and deploy cycle runs separately from application patching and has no natural automation path in most environments. CapaOne Provision Manager delivers vendor-certified, model-aware driver updates on schedule — without manual research per hardware model. It does not eliminate the complexity of driver management. It makes that complexity invisible to the IT administrator who previously had to navigate it manually. See how Provision Manager fits into the platform. ### One Console, Not Six Each automation above saves time on its own. But the real gain is not in any single product — it is in not having to leave the console to do the next thing. Context-switching between tools is not free. CapaOne Endpoint Management Platform consolidates application management, privilege elevation, vulnerability visibility, and driver updates into one operational model — one agent on endpoints, one dashboard, one inventory view. The automation that was technically possible across six tools becomes operationally sustainable in one. That is the difference between having automation and working in an automated environment. The former is a set of tools. The latter is a way of working that does not require the IT Administrator to hold six contexts in his head simultaneously. It’s also a different job than a dashboard built to jump between dozens of separate client environments — a platform built for managing many customers is not the same as one built for a single team. Most sysadmins want endpoint management mostly or fully automated. The platform that gets there is not the one with the most features — it is the one that makes the repeatable work disappear without adding new complexity. Start a free trial and see how many of your weekly manual tasks CapaOne removes from your stack — or book a demo and walk through your specific environment to map where the automation gap actually sits. ### Frequently Asked Questions **What Is the Endpoint Automation Gap?** The endpoint automation gap is the distance between the automation IT teams want and the automation their current tools actually deliver. PDQ's 2026 State of System Administration report found that 73% of sysadmins say endpoint management should be mostly or fully automated, while only 23% have already automated core tasks. The gap exists not because automation is technically unavailable, but because most endpoint environments run on fragmented point solutions that each automate one slice of the problem while leaving the rest manual. **What Did the PDQ 2026 State of Sysadmin Report Find About Automation?** PDQ surveyed 1,034 IT professionals between October and December 2025 for its 2026 State of System Administration report. 73% said endpoint management should be mostly or fully automated. Only 23% have already automated core tasks — a 50-point gap between aspiration and reality. **What Tasks Do Sysadmins Most Want to Automate?** PDQ’s report identifies standardizing environments and automating high-risk, repeatable tasks as the two primary strategies sysadmins pursue. Application updates, privilege elevation workflows, and driver management are among the most time-consuming manual tasks that automation directly addresses. **Does CapaOne Require Microsoft Intune to Deliver Endpoint Automation?** No. CapaOne operates as a complete endpoint management platform and delivers automation across application updates, privilege elevation, driver management, and vulnerability visibility — regardless of whether Intune is in the stack. For organizations running Intune, CapaOne adds the automation layer where Intune requires manual effort. **What Does CapaOne Automate for IT Administrators?** Application Manager automates third-party and business application updates without manual packaging or scripting. Privilege Manager replaces ad-hoc elevation requests with policy-based just-in-time elevation. Security Monitor surfaces vulnerability signals automatically across the estate. Provision Manager delivers vendor-certified driver updates on schedule. All in a single console, without context-switching between tools. **What Is Tool Sprawl and Why Does It Drive Sysadmin Stress?** Tool sprawl occurs when IT teams manage endpoints through multiple separate point solutions — one for patching, one for privilege management, one for vulnerability scanning, one for driver updates. Each tool requires its own context, its own console, and its own maintenance. The cognitive load of switching between tools and reconciling inconsistent views is a primary driver of the stress and catch-up feeling PDQ’s report documents. Written by Rikke Borup CMO, CapaSystems Rikke is Chief Marketing Officer at CapaSystems, where she has led marketing and communications since 2009. With more than 17 years of experience in the IT sector — including cybersecurity, endpoint management software and IT services — she brings long-standing, practical insight into the challenges facing modern enterprise IT environments. Trained as a journalist, Rikke specializes in translating complex technical concepts into clear, easy-to-understand communications for IT decision-makers. More from Rikke Borup → LinkedIn ↗ Book a Demo → --- URL: https://capaone.com/blog/how-to-consolidate-endpoint-management/ Published: 2026-06-03 Summary: Endpoint management consolidation with CapaOne — how to assess, migrate, and run one platform instead of five. ← All articles Blog ## How to Consolidate Endpoint Management Into One Platform Five tools. Five renewal dates. Five places to look when something breaks. By Rikke Borup, CMO, CapaSystems · June 3, 2026 Complexity is free. It just costs you later. Most IT teams did not choose complexity. It accumulated — one point solution at a time. A patching tool here. A provisioning tool there. A separate solution for privilege management. A monitoring add-on. Before long, the team spends more time switching between systems than actually managing endpoints. Endpoint management consolidation is the process of replacing disconnected point solutions with a single, unified platform that covers patching, OS deployment, driver management, privilege control, vulnerability insight, and device monitoring in a single, consistent workflow. The result of not consolidating is not a more secure environment. It is more expensive and fragile. Compliance evidence is stored in three separate exports. Every new tool adds another point of failure. And the administrators who know the stack best are the ones who can least afford to leave. This guide explains how IT teams approach that transition — what to assess, what to migrate, and the operational changes that occur when it is done right. ### Why Tool Sprawl Happens — and Why It Stays Tool sprawl in endpoint management rarely starts with a bad decision. Each point solution was chosen to solve a real problem. The issue is accumulation. According to Gartner, 71% of IT leaders planned to consolidate endpoint tools within 18 months as of 2024. The intent exists. The execution is harder. Several forces keep fragmented stacks in place even when consolidation is the stated goal: #### Vendor Lock-in and Renewal Pressure Multi-year contracts and per-seat licensing make it expensive to exit individual tools. Each renewal is an implicit vote to keep the current approach, regardless of whether it still makes sense. #### Integration Overhead Point solutions are often connected by scripts, scheduled tasks, or manual handoffs. Removing one tool means auditing and replacing those dependencies — work that is invisible until you try to do it. #### Institutional Knowledge Individual admins become experts in specific tools. Consolidation requires retraining and a period of lower confidence than before. That friction is real, and it delays action. Understanding these forces matters because consolidation is not purely a technology decision. It is an operational change—and it succeeds when the migration plan accounts for the human side as much as the technical side. ### What a Consolidated Endpoint Platform Covers Before assessing your current stack, it helps to define what a unified endpoint management platform should actually do. The following areas represent the minimum operational coverage for a mid-market IT environment managing 250 to 1,000 endpoints. That’s deliberately a different bar than an enterprise UEM roadmap built for a much larger estate — an enterprise rollout answers a different question than a mid-market deployment. #### Third-Party Application Patching Most endpoint estates run hundreds of third-party applications. Chrome, Adobe Reader, 7-Zip, VLC — none of these are covered by OS patch cycles, and without a process of their own, third-party applications stay unpatched. A consolidated platform automates detection, packaging, and deployment of third-party updates without manual repackaging or scripting. #### OS Deployment and Driver Management Bare-metal OS deployment and driver management should be part of the same workflow. When a device needs to be provisioned from scratch — or recovered after a failure — the platform should handle the full sequence: installing Windows, applying the correct drivers for the specific hardware model, and handing the device off for configuration. Without this, provisioning relies on on-premise infrastructure, manual image maintenance, and driver research that consumes hours per device. #### Privilege Management Standing local administrator rights remain one of the most common breach accelerators in enterprise environments. The ENISA Threat Landscape consistently identifies privilege misuse as a top attack vector. Consolidated platforms enforce just-in-time elevation through policy — removing standing admin rights without adding friction for end users. #### Vulnerability Visibility Knowing which endpoints are exposed requires visibility across operating system versions, application versions, driver currency, and configuration state. Fragmented tools produce fragmented views. A unified platform surfaces exposure signals in one console — allowing IT teams to prioritize by impact rather than by tool. #### Mobile Device Management iOS, iPadOS, and Android devices require enrollment, configuration, compliance enforcement, and application delivery. When MDM is handled by a separate tool, operational overhead multiplies and policy consistency suffers. Unified platforms manage mobile and Windows endpoints from the same console. #### Endpoint Monitoring and Experience Data Reactive IT is expensive. Proactive monitoring — surfacing reliability signals, crash patterns, and performance anomalies before users raise tickets — reduces incident volume and mean time to resolution. This capability is often the last to be added in fragmented stacks because no single point solution naturally owns it. ### How to Assess Your Current Stack Consolidation starts with an honest inventory. The goal is not to evaluate tools on their individual merits — it is to map operational coverage and identify overlap, gaps, and hidden dependencies. #### Step 1: List Every Active Endpoint Tool Include everything that touches endpoints: patching tools, provisioning and imaging solutions, privilege management tools, monitoring agents, MDM platforms, and any scripts or scheduled tasks that serve an equivalent function. Tools that were purchased but are no longer actively used still count — they carry licensing costs and agent overhead. #### Step 2: Map Coverage to Capability Areas Against each capability area listed above — patching, OS deployment and drivers, privilege, vulnerability, MDM, monitoring — note which tool covers it, how completely, and whether the coverage is automated or manual. Gaps become immediately visible. So does overlap. #### Step 3: Identify Integration Dependencies Catalog every script, scheduled task, or manual process that connects two tools. These dependencies represent migration work. They also represent operational risk — each one is a failure point that exists because the stack was never designed. #### Step 4: Calculate the True Cost Total cost of ownership in a fragmented stack is not just licensing. It includes administrative time per tool, agent conflicts and troubleshooting, training overhead for new staff, and the cost of compliance evidence gathering across multiple exports. Organizations that run this calculation typically find the total is significantly higher than the consolidated alternative. ### What Changes When You Consolidate The operational impact of consolidation is immediate in some areas and gradual in others. Here is what IT teams consistently experience in the first 90 days. #### Single Pane of Glass Replacing five dashboards with one changes the team’s cognitive load. Inventory, patch status, OS deployment logs, privilege elevation events, and vulnerability exposure are visible from the same console. Triage moves faster. Reporting requires fewer exports. #### Automation Replaces Manual Workflows Fragmented stacks, by necessity, accumulate manual processes. A consolidated platform automates the connections between capabilities — a vulnerability identified in the exposure view can trigger an update workflow directly, without a human moving data between systems. #### Compliance Evidence Becomes Operational Output In a fragmented stack, compliance reporting is a project. Gathering evidence across tools, normalizing formats, and producing audit-ready exports takes hours or days. In a consolidated platform, compliance evidence is a byproduct of daily operations — it exists continuously, not on demand. #### The Team Works on Fewer Tools Context switching between systems is one of the least-discussed costs in IT operations. Every context switch carries cognitive overhead — reorienting to a new interface, recalling a different data model, and adjusting to a different update cadence. Consolidation eliminates most of that overhead. Administrators become more effective in a single system than moderately proficient in several. ### How CapaOne Supports Endpoint Management Consolidation CapaOne Endpoint Management Platform is built for exactly this transition. It replaces four to five point solutions with one cloud-native platform that covers application deployment and patching, OS deployment and driver management, privilege management, mobile device management, vulnerability visibility, and endpoint monitoring in a single, consistent workflow. The platform works standalone or alongside Microsoft Intune. For organizations already running Intune, CapaOne adds the operational depth Intune does not cover — third-party patching, bare-metal provisioning and driver orchestration, just-in-time privilege elevation, and unified monitoring. For organizations without Intune, CapaOne operates as the primary endpoint management platform from day one. Each capability area maps to a dedicated module: Application Manager — automated packaging, deployment, and third-party update workflows Provision Manager — cloud-native bare-metal OS deployment and automated driver orchestration Privilege Manager — policy-based just-in-time elevation with full audit evidence Mobile Manager — unified enrollment and management across iOS, iPadOS, and Android Security Monitor — continuous exposure visibility across OS, applications, and drivers Experience Monitor — real-time reliability and performance signals across the endpoint estate CapaOne is developed in Denmark and hosted in the EU — built to meet GDPR and NIS2 requirements without additional configuration. Organizations operating under European data regulations gain full data residency within EU jurisdiction as a baseline, not an add-on. Deployment takes days. The first endpoints are under management within hours of onboarding. No implementation consultants. No steep scripting requirements. One agent across the estate. The measurable outcomes organizations typically see within 90 days include significant reductions in vulnerability mean-time-to-resolution, fewer manual administrative hours, and the elimination of three to five separate vendor contracts. ### Frequently Asked Questions **What Is Endpoint Management Consolidation?** Endpoint management consolidation is the process of replacing multiple disconnected point solutions with a single unified platform. CapaOne Endpoint Management Platform covers the six core capability areas IT teams typically handle with separate tools: application deployment and patching via Application Manager, cloud-native OS deployment and driver management via Provision Manager, just-in-time privilege elevation via Privilege Manager, mobile device management via Mobile Manager, vulnerability and configuration visibility via Security Monitor, and endpoint reliability monitoring via Experience Monitor. The result is one agent, one console, and one renewal — instead of five or six. **How Long Does Endpoint Management Consolidation Take?** For mid-market organizations managing 250 to 1,000 endpoints, endpoint management consolidation with CapaOne Endpoint Management Platform starts delivering value within hours of onboarding. The first endpoints are under management the same day. Full consolidation — retiring legacy tools, migrating workflows across Application Manager, Provision Manager, Privilege Manager, Mobile Manager, Security Monitor, and Experience Monitor, and training the team — typically completes within 30 to 90 days. No implementation consultants are required, and no extensive scripting background is needed to get operational value from day one. **Do We Need to Replace Microsoft Intune to Consolidate?** Endpoint management consolidation does not require replacing Microsoft Intune. CapaOne Endpoint Management Platform operates as a complete standalone platform — or adds the operational depth Intune does not cover natively. That includes third-party application patching through Application Manager, cloud-native OS deployment and driver orchestration through Provision Manager, just-in-time privilege elevation through Privilege Manager, mobile device management through Mobile Manager, vulnerability visibility through Security Monitor, and endpoint reliability signals through Experience Monitor. Intune remains the policy baseline. CapaOne closes the gaps. **What Is the ROI of Endpoint Management Consolidation?** The return on consolidation comes from three areas. First, licensing savings from retiring point solutions — organizations that consolidate into the CapaOne Endpoint Management Platform typically replace three to five separate vendor contracts. Second, administrative time is recovered through automation across Application Manager, Provision Manager, and Privilege Manager, which eliminates manual packaging, image maintenance, driver research, and privilege escalation workflows. Third, reduced risk exposure from consistent patching, least-privilege enforcement, and continuous vulnerability visibility through Security Monitor. Most organizations recoup the platform cost within the first year through licensing savings alone. **Is a European Endpoint Management Platform Different From a US-Based One?** For organizations subject to GDPR and NIS2, endpoint management consolidation requires evaluating more than features and pricing — hosting jurisdiction is a compliance variable. Endpoint management platforms process sensitive operational telemetry: patch status, application inventory, OS deployment logs, privilege elevation events, and configuration state. CapaOne Endpoint Management Platform is developed in Denmark and hosted in the EU, ensuring that all operational data remains under EU jurisdiction and is not exposed to US cloud legislation such as the Cloud Act or FISA. That data residency guarantee is built into the platform baseline — it requires no additional configuration. Consolidation is not a migration project. It is a decision to stop accepting the cost of complexity — in time, in risk, and in money spent managing tools instead of endpoints. Book a demo of CapaOne Endpoint Management Platform — or start a free trial and explore the platform hands-on. Written by Rikke Borup CMO, CapaSystems Rikke is Chief Marketing Officer at CapaSystems, where she has led marketing and communications since 2009. With more than 17 years of experience in the IT sector — including cybersecurity, endpoint management software and IT services — she brings long-standing, practical insight into the challenges facing modern enterprise IT environments. Trained as a journalist, Rikke specializes in translating complex technical concepts into clear, easy-to-understand communications for IT decision-makers. More from Rikke Borup → LinkedIn ↗ Book a Demo → --- URL: https://capaone.com/blog/intune-e5-epm-eam-july-2026-third-party-application-gap/ Published: 2026-06-03 Summary: M365 E5 includes EPM and EAM from July 2026. Here is what that covers — and where your third-party application stack still needs management. ← All articles Blog ## M365 E5 From July 2026: The Third-Party Application Gap Microsoft adds EPM and EAM to E5. The third-party application stack — everything outside Microsoft's catalog — remains your responsibility. By Rikke Borup, CMO, CapaSystems · June 3, 2026 Your M365 E5 license is about to include more endpoint management capabilities. The question worth asking before July 1 is not what Microsoft is adding — it is whether what they are adding covers the application management problem you actually have. From July 2026, E5 includes Endpoint Privilege Management, Enterprise Application Management, and Microsoft Cloud PKI. Pricing changes take effect July 1. Feature rollout begins October 2026. E5 customers pay the new pricing from July — but the features are not available until October. EAM covers a defined catalog of pre-packaged applications. That solves the packaging problem for those applications. It does not solve the operational lifecycle problem: version drift across the full estate, staged rollout control, deployment governance, rollback handling, and proving update posture to auditors. That work — across every application outside Microsoft’s catalog — remains yours. ### What the July 2026 Change Actually Includes The Intune Suite — previously a $10/user/month add-on — consolidates into the M365 bundle. E3 gains Remote Help, Advanced Analytics, and Intune Plan 2. E5 gains all of that plus Endpoint Privilege Management, Enterprise Application Management, and Microsoft Cloud PKI. For E5 customers already paying for the Intune Suite separately, the Microsoft Tech Community announcement is a net gain — the separate license cost disappears. The operational question is whether EAM covers enough of the application estate to matter. ### What EAM Actually Covers — and Where It Stops EAM reduces the time IT teams spend packaging and maintaining common applications. For applications in Microsoft’s catalog, deployment and update management flows directly through the Intune console without manual packaging. That is a genuine operational improvement for those applications. The operational boundary is the catalog itself. Security Risk Advisors noted the catalog contained 933 applications at the time of their analysis — growing, but a defined set. Applications outside that catalog still require standard Intune Win32 deployment: manual packaging, installer logic, detection rules, and ongoing update management. The cost of staying manual on those applications is not just IT time. Every unpatched version in the estate is an open CVE exposure window. Packaging backlogs create version drift that builds silently — different versions running across endpoints, inconsistent security posture, and no single view of what is actually current. That is the operational application lifecycle problem EAM does not address. #### What EAM Does Not Cover The applications outside Microsoft’s catalog are not a marginal edge case. They include the business-critical and sector-specific applications that represent the majority of most organizations’ CVE exposure: custom line-of-business applications, industry-specific tools, legacy applications with non-standard installers, and applications that simply have not been added to the catalog yet. EAM also remains primarily Windows Win32. As Move2Modern noted, third-party platforms typically offer broader catalogs across more niche software and often with macOS coverage — EAM has no current plans to expand platform coverage. Driver lifecycle management is outside both EPM and EAM scope entirely. Driver updates, model-specific firmware, and hardware vendor packages remain unaddressed by the new E5 inclusions. ### Where CapaOne Fits After July 2026 The licensing change clarifies the third-party application management question — it does not resolve it. CapaOne covers what the new E5 inclusions leave open: the full application estate outside Microsoft’s catalog, driver lifecycle, and least-privilege governance available today rather than October. Here is how each product fits. #### Application Manager: The Full Application Lifecycle Application Manager covers the complete operational application lifecycle across the full estate — including every application outside Microsoft’s EAM catalog. Automated updates eliminate packaging backlogs. No-code packaging for business applications removes scripting dependency. Staged rollout control, deployment posture evidence, and version drift visibility give IT teams the governance layer that turns application management from reactive maintenance into a controlled, auditable operation. Driver lifecycle management — vendor-certified, model-aware updates across the hardware estate — is handled through Provision Manager, which neither EPM nor EAM addresses. #### Privilege Manager: Available Now, Not October Privilege Manager operates today. For organizations that cannot wait until the October 2026 feature rollout to establish least-privilege governance, Privilege Manager delivers policy-based elevation via existing Entra ID groups, full audit logging for NIS2 and governance requirements, and integration with Application Manager for pre-approved elevation workflows — without standing local admin. CapaOne Privilege Manager stands on its own as a complete privilege management platform, and it runs alongside Intune EPM for organizations adopting it in October. ### The Evaluation IT Managers Should Run Before July The licensing change creates a natural decision point. Before July 1, it is worth mapping three things: Which applications in your estate fall inside EAM’s catalog? These are the applications where EAM delivers immediate operational value from October. Identify them now so you can plan the transition. Which applications fall outside the catalog? These require continued manual management or a third-party solution. Application Manager covers this gap — automated updates, posture visibility, and no-code packaging for the full estate. When do you need least-privilege enforcement? If the answer is before October, Privilege Manager is operational today. If the answer is October or later, plan for EPM rollout and evaluate whether CapaOne Privilege Manager adds governance depth that EPM does not natively provide. What is your driver management approach? Neither EPM nor EAM addresses driver lifecycle. Provision Manager closes that gap with automated, vendor-certified driver updates across hardware models. The July 2026 licensing change is a useful moment to map what your endpoint estate actually needs — what EAM covers, what it does not, and where additional automation applies. Book a demo to see how Application Manager and Privilege Manager work alongside the new E5 inclusions — or start a free trial and validate coverage across your own application estate. ### Frequently Asked Questions **What Does M365 E5 Include From July 2026?** From July 2026, M365 E5 includes Endpoint Privilege Management, Enterprise Application Management, and Microsoft Cloud PKI — in addition to the E3 features: Remote Help, Advanced Analytics, and Intune Plan 2. Pricing changes take effect July 1. Feature rollout begins October 2026. **What Does Intune EAM Cover for Third-Party Applications?** EAM provides a Microsoft-managed catalog of pre-packaged Win32 applications ready for deployment through Intune. The catalog automates packaging and updates for those applications. Applications outside the catalog still require standard Intune Win32 deployment — including manual packaging and update management. EAM remains primarily Windows Win32 with no current plans for broader platform coverage. **Does Intune EPM Replace a Dedicated Privilege Management Solution?** CapaOne Privilege Manager operates today, with policy-based elevation through existing Entra ID groups, full audit logging for NIS2 and governance requirements, and integration with Application Manager. Intune EPM enforces least privilege for Windows endpoints inside the Intune ecosystem and reaches E5 customers in October 2026. Organizations run CapaOne as a complete privilege management platform on its own, or alongside Intune EPM. **What Does CapaOne Cover That EAM Does Not?** CapaOne Application Manager covers the full third-party and business application stack — including applications outside Microsoft’s EAM catalog — with automated updates, no-code packaging, and deployment posture evidence. Provision Manager covers driver lifecycle management, which neither EPM nor EAM addresses. **When Can E5 Customers Actually Use EPM and EAM?** Pricing changes take effect July 1, 2026. Feature rollout for EPM, EAM, and Cloud PKI begins October 2026. E5 customers pay the new pricing from July but cannot access the new features until October. Written by Rikke Borup CMO, CapaSystems Rikke is Chief Marketing Officer at CapaSystems, where she has led marketing and communications since 2009. With more than 17 years of experience in the IT sector — including cybersecurity, endpoint management software and IT services — she brings long-standing, practical insight into the challenges facing modern enterprise IT environments. Trained as a journalist, Rikke specializes in translating complex technical concepts into clear, easy-to-understand communications for IT decision-makers. More from Rikke Borup → LinkedIn ↗ Book a Demo → --- URL: https://capaone.com/blog/windows-zero-day-least-privilege-ransomware-defense/ Published: 2026-06-02 Summary: Six Windows zero-days chained into ransomware. CapaOne explains why least privilege is the defense that holds when patches do not exist yet. ← All articles Blog ## Ransomware Chains Six Zero-Days: What Stops the Attack A privilege escalation exploit is patched. A Defender bypass is not. The question is what your endpoint architecture does while the window is still open. By Rikke Borup, CMO, CapaSystems · June 2, 2026 Six Windows exploits in six weeks. One of them has a patch. One does not. And together they form an active ransomware delivery chain that Huntress confirmed exploited in production environments from April 10. Between April and May 2026, security researcher Nightmare-Eclipse released a coordinated series of Windows privilege escalation, Defender bypass, and BitLocker circumvention techniques designed to chain together into ransomware deployments. Barracuda Networks mapped the full sequence on May 19: the first exploit (CVE-2026-33825, patched in May Patch Tuesday) escalates an unprivileged user to NT AUTHORITYSYSTEM via a TOCTOU flaw in Defender’s update process. A second technique blinds Defender and prevents detection of new threats — still partially unaddressed. A third bypasses BitLocker on stolen devices. BleepingComputer and Help Net Security have tracked active exploitation throughout May. This is ultimately a least-privilege failure story. The organizations most exposed are those with standing local admin rights and no independent posture visibility. The chain starts with an unprivileged user — and standing admin is what makes escalation to SYSTEM possible. ### The Attack Chain IT Teams Are Facing Understanding the sequence matters because each step depends on the one before it. This is not six independent vulnerabilities — it is a structured Windows privilege escalation and ransomware delivery path. #### Step 1: Privilege Escalation via CVE-2026-33825 The first exploit starts as an unprivileged user and escalates to NT AUTHORITYSYSTEM via a TOCTOU flaw in Defender’s update process — now patched as CVE-2026-33825 in May 2026 Patch Tuesday. For endpoints that have received the patch, this first step is blocked. The operational question is which endpoints have actually confirmed the fix. The same patch posture challenge we outlined for CVE-2026-41096 applies here: deployed is not the same as applied. #### Step 2: Defender Bypass A second technique disables Defender’s ability to detect new threats once the attacker achieves escalation. This step remains partially unaddressed — there is no complete Microsoft patch. Once Defender is blind, subsequent payloads can execute without triggering standard detections. #### Steps 3–6: Persistence, BitLocker Bypass, and Ransomware With SYSTEM privileges and detection neutralized, the remaining techniques establish persistence, bypass BitLocker on stolen or compromised devices, and deploy ransomware. The BitLocker bypass is particularly relevant for organizations with remote or field devices. ### Why Patching Alone Is Not Sufficient Here The privilege escalation exploit has a patch. Applying it blocks the first step in the chain. But two structural realities limit a patch-only response: The Defender bypass has no complete patch. Waiting for Microsoft to close this step is not a viable strategy for organizations actively targeted. The chain can still execute on any environment where escalation is possible and Defender is the primary detection layer. The patch window is always open. As the Verizon Data Breach Investigations Report consistently shows, the gap between patch release and confirmed remediation across an estate is where most exploitation occurs. CVE-2026-33825 is patchable — but not every endpoint in every organization has that patch confirmed applied today. When AI writes the exploit, that patch window gets shorter. The structural question is what happens when an attacker reaches an endpoint during that window — or targets an environment where the Defender bypass has no fix to apply. That is where endpoint architecture matters more than patch cadence. ### What CapaOne Does — and Does Not Do CapaOne does not patch Windows OS vulnerabilities — Microsoft distributes those fixes through Windows Update, WSUS, Intune, and Autopatch. For organizations running Microsoft Intune, CapaOne adds the structural controls and posture visibility Intune does not natively provide. Against this ransomware attack chain specifically, three CapaOne capabilities matter — and they address the attack at different points in the escalation sequence. #### Privilege Manager: Removing the Escalation Foundation Privilege Manager removes standing local admin rights and replaces them with policy-based, just-in-time elevation via Entra ID groups. The privilege escalation step starts as an unprivileged user and escalates to SYSTEM via a TOCTOU flaw in Defender’s update process. That escalation path assumes the attacker has a process or context with access to Defender’s update mechanism. The most effective protection against Windows privilege escalation exploits is removing the standing local admin rights the escalation depends on. Privilege Manager enforces least-privilege by default — replacing always-on admin access with time-limited, policy-governed elevation. Without standing local admin, the TOCTOU flaw becomes structurally harder to reach. This matters most for the Defender bypass: since that step has no patch, Privilege Manager is not a compensating control waiting for a fix. It is the primary defense available today against the escalation that makes the bypass possible. #### Security Monitor: Independent Visibility When Defender Is the Target When ransomware operators disable Defender, organizations lose the operational evidence needed to quickly determine exposure scope. Security Monitor provides independent endpoint posture visibility — CVE exposure, configuration drift, and device state — that operates outside Defender’s detection layer. That independence is not a nice-to-have when Defender is the attack target. It is the only reliable posture signal available. Security Monitor also confirms which endpoints have CVE-2026-33825 applied — device-level evidence rather than a deployment progress indicator. That distinction matters when you need to know exposure scope within the hour, not after manually cross-referencing update logs. #### Application Manager: Closing the Secondary Exposure Layer Once SYSTEM-level access is achieved and Defender is blind, outdated third-party applications are the most accessible path for payload delivery and lateral movement. Application Manager keeps the third-party application layer current automatically — reducing the number of exploitable paths available after initial escalation. ### What to Do Now The Windows privilege escalation exploit chain is active. Here is where to focus: - Confirm CVE-2026-33825 patch posture in Security Monitor. Filter across the estate for endpoints where this first escalation step is still unpatched. Deployment status is not sufficient — you need device-level confirmation. - Review standing local admin in Privilege Manager. Every endpoint with standing admin rights is a viable starting point for privilege escalation to SYSTEM. Privilege Manager shows which endpoints carry that exposure and removes it without adding helpdesk friction. - Assess your Defender dependency. The Defender bypass technique has no complete patch. Security Monitor provides the independent posture and configuration visibility that compensates for a blinded Defender — confirm it is active and surfacing posture signals across the endpoints most at risk. - Audit post-escalation exposure in Application Manager. Once the attacker gains SYSTEM-level access and Defender is blind, this attack chain uses outdated third-party applications as the primary payload delivery path. Check which endpoints are running outdated browsers, document viewers, and communication tools — these are the specific application types Huntress identified as secondary vectors in confirmed ransomware deployments. The organizations that limit exposure from ransomware attack chains are those that have removed the privilege foundation the escalation depends on — before a patch exists, not after. See how Privilege Manager changes the attack surface available to ransomware operators — or start a free trial and validate whether standing local admin rights still exist across your endpoint estate. ### Frequently Asked Questions **Is the Privilege Escalation Exploit (CVE-2026-33825) Fully Patched?** Yes. CVE-2026-33825 is patched in May 2026 Patch Tuesday and available through Windows Update, WSUS, Intune, and Autopatch. Refer to the Microsoft MSRC advisory for the full affected version list. Confirming which endpoints have received the patch — rather than assuming rollout is complete — is the operational priority. **Is the Defender Bypass Technique Fully Patched?** No. The Defender bypass technique remains partially unaddressed as of May 2026. Microsoft has not released a complete fix. This makes structural defenses — particularly least-privilege enforcement — more important than patch cadence for this specific step in the chain. **Does CapaOne Patch Windows OS Vulnerabilities?** No. Microsoft distributes Windows OS patches through Windows Update, WSUS, Intune, and Autopatch. CapaOne’s role is structural: Privilege Manager removes the escalation foundation the attack chain depends on, Security Monitor provides independent posture visibility when Defender is targeted, and Application Manager closes the third-party application layer used for post-escalation payload delivery. **How Does Least Privilege Limit This Ransomware Attack Chain?** The privilege escalation step requires a process context with access to Defender’s update mechanism. Privilege Manager removes standing local admin rights, replacing them with policy-based just-in-time elevation. This makes the conditions required for escalation to SYSTEM structurally harder to achieve — limiting the chain’s viability even on endpoints where the patch has not yet been confirmed applied. **What Is the Risk If the Defender Bypass Executes Successfully?** Organizations that rely solely on Defender as their detection layer lose visibility into subsequent payloads — including ransomware — once the bypass succeeds. Security Monitor provides an independent posture and configuration layer that continues to operate regardless of Defender’s state, maintaining exposure visibility when Defender is the target. Written by Rikke Borup CMO, CapaSystems Rikke is Chief Marketing Officer at CapaSystems, where she has led marketing and communications since 2009. With more than 17 years of experience in the IT sector — including cybersecurity, endpoint management software and IT services — she brings long-standing, practical insight into the challenges facing modern enterprise IT environments. Trained as a journalist, Rikke specializes in translating complex technical concepts into clear, easy-to-understand communications for IT decision-makers. More from Rikke Borup → LinkedIn ↗ Book a Demo → --- URL: https://capaone.com/blog/mdm-migration-without-wipe-macos-26-apple-fleet-consolidation/ Published: 2026-05-28 Summary: MDM migration without a wipe is now possible in macOS 26. Here is what IT teams need to know to consolidate their Apple fleet. ← All articles Blog ## MDM Migration Without a Wipe: What macOS 26 Unlocks By Rikke Borup, CMO, CapaSystems · May 28, 2026 If device wipes have been your reason for not consolidating your Apple fleet onto a single MDM platform, that reason just disappeared. With macOS 26 Tahoe and iOS/iPadOS 26, Apple introduced MDM migration without a wipe — no factory resets, no data loss, no physical device handling required. The migration is orchestrated through Apple Business Manager, and users receive a notification they can act on in minutes. For IT teams managing fragmented Apple fleets across multiple MDM solutions, this is the consolidation window you have been waiting for. There is a second change that makes this more urgent: the legacy MDM software update commands — including MDM commands, restrictions, the com.apple.SoftwareUpdate payload, and MDM update queries — no longer answer on iOS 27, which Apple released on September 14, 2026. Every device that updates moves beyond the reach of policies built on those commands, creating a management gap that grows with each device update. This post covers what the migration entails, the eligibility requirements, and how to use this window to consolidate your Apple endpoints into a unified management platform. ### What Apple’s Native MDM Migration Actually Does Previously, moving iOS devices between MDM solutions via Automated Device Enrollment required a full device wipe. The only alternative was manual re-enrollment, which left the MDM profile removable by the end user, creating an unmanaged device risk. For macOS, re-enrollment without wiping was technically possible but operationally cumbersome. The new migration capability completely changes this. The workflow runs through Apple Business Manager or Apple School Manager and allows IT administrators to assign enrolled devices to a new MDM server — with no factory reset, no data loss, and no Activation Lock removal required. From the user’s perspective, they receive a system notification, click Start Enrollment, and the migration completes in the background. Administrators can set a migration deadline in ABM. As the deadline approaches, the notification frequency increases. At the deadline, migration becomes mandatory. #### What Transfers During Migration Device management control transfers to the new MDM User data and applications remain intact Activation Lock status is preserved Corporate apps managed through VPP transfer — provided separate VPP tokens are configured for both MDMs Existing MDM configurations are replaced: policies, restrictions, and compliance profiles from the old MDM are overwritten by the new MDM. Configurations must be replicated in the target MDM and tested before migration begins — devices will operate under new policies from the moment migration completes ### Eligibility Requirements — What Must Be in Place Migration is not available for every Apple device. The following requirements must all be met before a device is eligible: Device OS: macOS 26 Tahoe, iOS 26, or iPadOS 26 or later must be installed Enrollment type: Devices must be corporate-owned and enrolled via Automated Device Enrollment (ADE). Devices enrolled via Apple Configurator must complete a 30-day provisional ownership period first ABM/ASM membership: Both the source and target MDM must be registered as servers in the same Apple Business Manager or Apple School Manager account MDM API support: Both MDM solutions must support Apple’s Migration APIs and Declarative Device Management (DDM) Tokens: Updated MDM certificates, server tokens, and separate VPP tokens must be configured for both MDMs BYOD and personally owned devices do not follow this migration path. Migration applies only to corporate-owned, ADE-enrolled devices. ### The DDM Deadline: Why This Cannot Wait The MDM migration capability arrives at the same time Apple forces a fundamental change in its management architecture. Legacy MDM software update commands — the mechanisms most organizations used to push OS updates to Apple devices — no longer answer on iOS 27. Organizations still relying on them no longer control updates on devices that have moved to iOS 27. Declarative Device Management represents a fundamental architectural shift. Rather than MDM servers polling devices and issuing commands reactively, DDM enables devices to apply configurations based on declarative policies, report status asynchronously, and operate consistently even when offline. For IT teams, this means configuring software update policies as declarations rather than as legacy commands. The practical implication is straightforward: if your current MDM solution does not fully support DDM, you need a new MDM. And if you need a new MDM, the native migration capability means you can make that move without a fleet-wide wipe. #### The Intel Mac Sunset: A Natural Consolidation Moment The timing matters for another reason: macOS 26 Tahoe is the final release supporting Intel-based Macs. For organizations already planning a hardware refresh cycle, the new migration capability creates a natural opportunity to consolidate both hardware and management architecture simultaneously. New Apple Silicon Macs enroll directly into the target MDM via ADE from day one — no legacy migration required. ### How to Use This Window to Consolidate Your Apple Fleet The migration window is open now for organizations running eligible devices. Here is a structured approach: Audit your current Apple device inventory. Identify which devices are ADE-enrolled, which OS version they run, and which MDM they are currently managed by. Devices that do not meet eligibility requirements require a separate remediation plan. Verify your target MDM supports Apple Migration APIs and DDM. This is a hard requirement. If the target MDM does not support both, migration will not complete successfully. Register both MDM solutions in Apple Business Manager. Both source and target MDMs must appear as configured servers in the same ABM account before migration can be initiated. Configure separate VPP tokens for both MDMs. This ensures managed App Store apps transfer correctly to the new platform without gaps in license management. Replicate configurations in the target MDM before initiating migration. Policies, restrictions, compliance profiles, and app assignments should be in place and tested on a pilot device before fleet-wide migration begins. Set a migration deadline in ABM and communicate it to users. Users receive notifications and can complete migration themselves. The deadline ensures stragglers are managed without manual intervention. Migrate to DDM software update policies immediately. Legacy update commands no longer answer on iOS 27. Configure DDM update policies now, and check that every device on iOS 27 has one. For organizations using this window to consolidate onto a single platform, the choice of destination MDM matters as much as the migration itself. The platform needs to support Apple Migration APIs and DDM, enroll devices via ADE, and manage the rest of your endpoint fleet — Android and Windows — without adding another fragmented console. ### How CapaOne Mobile Manager Fits This Migration CapaOne Endpoint Management Platform includes Mobile Manager, which unifies enrollment, configuration, compliance, and application delivery across iOS, iPadOS, and Android in a consolidated endpoint governance platform. For organizations consolidating iPhone and iPad fleets onto one platform, Mobile Manager supports ADE-based enrollment via Apple Business Manager and manages software updates through both legacy MDM and Declarative Device Management. It supports Apple’s Migration APIs, so ADE-enrolled devices on iOS 26 or later can move to it through Apple’s native migration workflow without a wipe. For organizations managing mixed fleets, Mobile Manager covers iOS, iPadOS, and Android in one place, eliminating the separate MDM consoles that currently produce fragmented compliance visibility. Enrollment, configuration, compliance evidence, application delivery, and essential remote actions all run on a single platform, alongside Application Manager, Privilege Manager, and Security Monitor for full endpoint governance coverage. For organizations where mobile device compliance is part of a broader NIS2 evidence requirement, Mobile Manager provides the documented enrollment, configuration, and policy enforcement data that NIS2 endpoint compliance requires — across every managed device in the fleet, in a unified operational layer. Apple Business Manager orchestrates the migration itself. CapaOne manages the iPhones and iPads you enroll in Mobile Manager, alongside the rest of your endpoint fleet. Book a demo of CapaOne Endpoint Management Platform to see how Mobile Manager supports iPhone and iPad consolidation, Declarative Device Management, and unified endpoint governance across mixed device environments. ### Frequently Asked Questions **Do I Need to Wipe Devices to Migrate MDM in macOS 26?** No — and that is the core change. Previously, migrating ADE-enrolled iOS devices to a new MDM required a full device wipe, with the inevitable loss of user data and app configurations. macOS 26 and iOS/iPadOS 26 eliminate this requirement entirely. User data, applications, and Activation Lock status are all preserved. The migration runs in the background after the user taps a system notification. **Can IT Teams Migrate Apple Devices Gradually?** Yes. Apple Business Manager allows administrators to set a migration deadline and notify users progressively — meaning devices can be migrated in waves rather than all at once. As the deadline approaches, notification frequency increases. At the deadline, migration becomes mandatory. This makes it practical to pilot with a small group, validate configurations in the target MDM, and roll out to the full fleet in controlled stages. **What Is the Difference Between ADE Enrollment and Manual Enrollment for MDM Migration?** ADE enrollment — via Apple Business Manager or Apple School Manager — is the only enrollment type that supports native MDM migration without a wipe. Devices enrolled manually via Device Enrollment or Apple Configurator are not eligible for the new migration workflow. Devices added via Apple Configurator must complete a 30-day provisional ownership period before they become eligible. BYOD and personally-enrolled devices are not eligible under any circumstances. **What Happens If We Have Not Moved to DDM Yet?** Legacy MDM software update commands — including MDM commands, restrictions, the com.apple.SoftwareUpdate payload, and MDM update queries — no longer answer on iOS 27, which Apple released on September 14, 2026. A device that updates to iOS 27 stays enrolled, but update policies built on those commands stop governing it. Organizations that have not moved to Declarative Device Management lose update control device by device, as each one updates. **What Should IT Teams Look for in a Target MDM Before Migrating?** Three requirements are non-negotiable: the target MDM must support Apple’s Migration APIs, support Declarative Device Management for software updates, and be registered as a server in your Apple Business Manager or Apple School Manager account. Beyond the technical requirements, the most important operational question is whether the target MDM can manage your endpoint fleet — iOS, iPadOS, Android, and Windows — in a single console, so the migration consolidates rather than adds another fragmented tool. Written by Rikke Borup CMO, CapaSystems Rikke is Chief Marketing Officer at CapaSystems, where she has led marketing and communications since 2009. With more than 17 years of experience in the IT sector — including cybersecurity, endpoint management software and IT services — she brings long-standing, practical insight into the challenges facing modern enterprise IT environments. Trained as a journalist, Rikke specializes in translating complex technical concepts into clear, easy-to-understand communications for IT decision-makers. More from Rikke Borup → LinkedIn ↗ Book a Demo → --- URL: https://capaone.com/blog/windows-autopatch-third-party-patching-hotpatch-gap/ Published: 2026-05-27 Summary: Windows Autopatch covers Windows, Edge, Teams and M365 Apps. CapaOne handles the third-party patching that sits outside that scope. ← All articles Blog ## Windows Autopatch and Third-Party Patching: Where the Scope Ends Autopatch does what it was built to do, and hotpatch removes most restarts. Neither changes who owns the applications Microsoft does not ship. By CapaOne Support · May 27, 2026 Windows Autopatch and third-party patching solve two different problems, and IT teams that treat them as one problem end up with a gap they cannot see. Autopatch keeps Microsoft’s software current across the fleet, and hotpatch has removed most of the restarts that made monthly updates disruptive. Neither changes who owns the browsers, PDF readers, runtimes, and line-of-business applications that Microsoft does not ship. That layer stays with the IT team, and it is where most of the unpatched software on a typical Windows estate sits. ### What Windows Autopatch Updates Windows Autopatch is a cloud service that automates updates across registered devices. According to Microsoft’s documentation, it covers four things: Windows quality and feature updates, Microsoft 365 Apps for enterprise, Microsoft Edge, and Microsoft Teams. It can also deliver Windows drivers and firmware that are published through Windows Update. The service applies updates in phased deployment rings, so a small test group receives an update before the broad fleet does. When telemetry shows a problem, the rollout pauses automatically. For the software it covers, Autopatch removes most of the scheduling and monitoring work an IT team used to do by hand. The scope is deliberate. Autopatch updates Microsoft’s own software estate. Everything else on the device belongs to a different process. ### How Hotpatch Changes the Restart Cadence Hotpatch is the more recent change, and it addresses a real operational problem: a device is not protected when an update downloads, but when it takes effect — and that used to mean waiting for a user to accept a restart. Eligible devices now run on a quarterly cycle. Microsoft’s release notes set January, April, July, and October as baseline months: the device installs a cumulative security update and restarts. In the two months after each baseline, security updates apply without a restart and take effect immediately. Eight months out of twelve, nobody sees a restart prompt. The eligibility conditions are specific. A device needs Windows 11 Enterprise version 24H2 or later on an x64 processor, virtualization-based security running, and the current baseline installed. Intune must manage it through a quality update policy with hotpatch turned on. Miss one condition and the device receives the standard cumulative update instead — still patched, but with the restart back. For an IT team, the practical gain is a shorter distance between “update released” and “device actually protected.” That gain applies to the software Autopatch covers. ### Where Third-Party Patching Sits A typical Windows endpoint runs software from a dozen vendors. Chrome or Firefox alongside Edge. Acrobat Reader. Java or .NET runtimes. 7-Zip, Notepad++, PuTTY, VLC. Whatever line-of-business applications the organization depends on. None of it moves through Windows Update, so none of it moves through Autopatch. Each of those applications ships its own updates on its own schedule. Some update themselves silently, some prompt the user, some do nothing until an administrator intervenes. The result across a fleet is uneven: an organization can hold a clean Autopatch compliance report and still run a hundred outdated Acrobat installations. That unevenness is the part that resists reporting. Windows patch status is one number from one source. Third-party patch status is a question that has to be answered application by application, unless something automates both the updating and the record of it. Without that, the result is the endpoint patch compliance gap: patching by hand, and proving it by hand. ### How CapaOne Covers the Third-Party Layer CapaOne Application Manager automates third-party application patching across a governed catalog. It detects installed and outdated applications through an endpoint agent, applies updates in staged rollouts targeted at existing Entra ID groups, and writes an exportable audit trail for every deployment. Applications outside the catalog run through no-code packaging rather than hand-built scripts. Security Monitor adds the visibility layer: which endpoints carry a known vulnerability, which ones drifted out of policy, and what the exposure looks like across the fleet rather than per device. The two services divide cleanly. Autopatch owns Microsoft’s software; CapaOne owns everything else, with one console and one agent for both the updating and the evidence. Organizations running Intune can read the split in more detail on the Intune patch management page, and the Intune third-party patch gap covers why the boundary exists in the first place. Teams evaluating hotpatch specifically will want the hotpatch baseline eligibility requirements before they plan a rollout. CapaOne runs standalone for organizations without Intune or Autopatch, managing the full application estate from the same console. CapaOne hosts all endpoint data in the EU, with no transfer of endpoint data to US jurisdiction. ### What Changes for the IT Team Splitting the two layers cleanly produces results that show up in ordinary operations. - One report covers both layers. Windows currency from Autopatch, third-party currency from CapaOne, without assembling the second one manually. - Third-party updates stop depending on the user. Staged rollouts run on policy, not on whether somebody clicked an update prompt. - Audit evidence exists as a byproduct. Every deployment carries a record, which supports a NIS2-aligned posture without a separate documentation exercise. - No packaging backlog. Catalog applications update themselves; the rest go through no-code packaging instead of maintained scripts. Autopatch does what it was designed to do, and hotpatch made it noticeably less disruptive. The question worth asking is not whether Microsoft’s tooling is good enough — it is which layer it covers, and what covers the other one. Book a demo of the CapaOne Endpoint Management Platform to see third-party patching and vulnerability visibility working together, or start a free trial and check your own estate. ### Frequently Asked Questions **Does Windows Autopatch Handle Third-Party Patching?** No. Windows Autopatch covers Windows quality and feature updates, Microsoft 365 Apps for enterprise, Microsoft Edge, and Microsoft Teams, plus drivers and firmware delivered through Windows Update. Applications outside that set — third-party browsers, PDF readers, runtimes, compression tools, and line-of-business software — remain the IT team's responsibility. That boundary is a scope definition, not a shortcoming: Autopatch updates Microsoft's own software estate, and third-party patching is a separate layer that needs its own automation. **What Does Windows Autopatch Actually Update?** Windows Autopatch is a cloud service that automates updates for Windows, Microsoft 365 Apps for enterprise, Microsoft Edge, and Microsoft Teams across registered devices. It can also deliver Windows drivers and firmware that are available through Windows Update. The service uses phased deployment rings so updates reach a small test group before the wider fleet, and it pauses rollouts automatically when it detects problems. **Does Hotpatch Remove All Restarts?** No. Hotpatch removes the restart for eight months of the year, not twelve. January, April, July, and October are baseline months: devices install a cumulative security update and restart. In the two months following each baseline, eligible devices apply security updates that take effect immediately without a restart. A device that falls off the current baseline receives the standard cumulative update instead, which restores the restart requirement. **What Are the Requirements for Hotpatch Updates?** A device needs Windows 11 Enterprise version 24H2 or later on an x64 processor, virtualization-based security turned on, and the current quarterly baseline installed. Microsoft Intune must manage the device through a Windows quality update policy with hotpatch enabled, which is configured in Windows Autopatch. Devices that miss any prerequisite fall back to standard cumulative updates rather than failing to patch. **Can CapaOne Run Alongside Windows Autopatch?** Yes. The two cover different layers and do not overlap. Windows Autopatch handles Microsoft's own software — the operating system, Microsoft 365 Apps, Edge, and Teams. CapaOne Application Manager handles third-party application patching across a governed catalog, with staged rollouts and exportable audit evidence. Organizations that do not run Autopatch or Intune use CapaOne as a complete endpoint management platform on its own. Book a Demo → Start Free Trial --- URL: https://capaone.com/blog/cve-2026-40361-word-preview-pane-rce-office-patch-posture/ Published: 2026-05-20 Summary: CVE-2026-40361 makes the Outlook Reading Pane an attack vector, no click needed. CapaOne shows which endpoints still run unpatched Office. ← All articles Blog ## The Outlook Reading Pane Is Now an Attack Vector Don't open attachments from unknown senders' used to be enough. CVE-2026-40361 makes that advice obsolete. By Rikke Borup, CMO, CapaSystems · May 20, 2026 May 2026 Patch Tuesday included four critical Microsoft Word RCEs. Two of them — CVE-2026-40361 and CVE-2026-40364 — carry Microsoft’s ‘Exploitation More Likely’ rating. Krebs on Security and Microsoft’s advisory both confirm that the Outlook Reading Pane is an attack vector. The same Word rendering code that runs when you open a document also runs when Outlook previews it. A user who selects a malicious email — without clicking the attachment — can trigger exploitation. ‘Don’t open attachments’ has been the baseline security instruction for two decades. This vulnerability makes it structurally insufficient. The attack surface is now every inbox, on every Windows endpoint, in every organization running an unpatched version of Office. ### Why the Patch Window Is Longer Than It Looks Microsoft 365 Apps on the monthly enterprise channel receives the fix within 24 hours of Patch Tuesday via Click-to-Run. For those endpoints, the exposure window is short. But Click-to-Run only covers Microsoft 365 Apps. MSI-based Office installations — Office 2016, 2019, and 2021 — do not update themselves. They require a managed rollout through WSUS or equivalent tooling. SC Media and Help Net Security have both reported that these installations can sit weeks behind when organizations lack a structured update process. Most enterprise environments carry both. A progressive migration to Microsoft 365 Apps leaves a tail of MSI installs on older hardware, in remote sites, or in departments that were deprioritized. Each of those endpoints stays exposed to a zero-click attack vector until the patch arrives. If you have not already confirmed patch posture for CVE-2026-41096 — the CVSS 9.8 Windows DNS Client RCE from the same Patch Tuesday — the same principles apply across your Windows estate. #### The Inventory Problem The harder question is not whether the patch exists. The question is whether IT teams know exactly which endpoints are running MSI-based Office—and can confirm, device by device, that the fix has landed. That inventory is harder to maintain than it sounds, given that Office versions are spread across Click-to-Run, WSUS, and legacy deployments, with no single fleet-wide posture view. ### What CapaOne Does — and Does Not Do CapaOne does not patch Microsoft Office. Click-to-Run handles Microsoft 365 Apps; WSUS handles MSI installs. CapaOne’s role is to give IT teams the visibility and controls that matter once a zero-click attack vector is confirmed active. For organizations also running Microsoft Intune, CapaOne adds the posture layer that Intune does not natively provide. #### See Exactly Which Endpoints Are Still Exposed Security Monitor surfaces Office version posture and configuration drift across your estate in a single console — regardless of whether endpoints are managed through Click-to-Run, WSUS, or legacy deployments. When the Outlook Reading Pane becomes an active attack vector, Security Monitor answers the operational question: which endpoints are still running unpatched Word, and where are they? That is not a deployment progress bar. It is device-level posture evidence — the difference between assuming the patch landed and knowing it did. #### Remove the Next Layer of Exposure A successful preview-pane exploit gives an attacker execution on the endpoint. What happens next depends heavily on what else is running. Outdated browsers, document converters, and communication tools are the most accessible secondary path. Application Manager automatically keeps that third-party layer current, closing the entry points attackers use after initial access. #### Limit What a Compromise Can Do If exploitation occurs before the patch reaches every endpoint, the blast radius depends on privilege posture. Privilege Manager removes standing local admin rights and replaces them with policy-based, just-in-time elevation. Without standing admin, an attacker who gains execution through the preview pane has no immediate mechanism for lateral movement or privilege escalation. The patch window will always exist. Privilege Manager limits the damage that the window creates. ### The Outlook Reading Pane Attack Vector: What to Do This Week The priority is knowing where your exposure actually sits: Map your Office install types in Security Monitor. Filter by version posture to separate Click-to-Run from MSI-based installs. MSI endpoints are your exposure tail — Click-to-Run will handle itself. Identify update ring gaps. Endpoints on the semi-annual enterprise channel or behind WSUS group policy delays may not receive the fix for weeks. Security Monitor surfaces these without manual cross-referencing. Audit third-party application posture in Application Manager. Browsers, PDF readers, and collaboration tools running outdated versions are the most accessible post-exploitation path. Check for version drift and automate where possible. Review standing admin in Privilege Manager. Any endpoint with persistent local admin rights extends the blast radius if a preview-pane exploit succeeds before the patch arrives. Privilege Manager removes that standing access. The Outlook Reading Pane, as an attack vector, changes the threat model for every Windows endpoint running Office. The question is how quickly your IT team can confirm which endpoints are still exposed — and what they can do before the patch arrives. Book a demo to see Security Monitor and Privilege Manager in context — or start a free trial and run it against your own estate. ### Frequently Asked Questions **Does CVE-2026-40361 Require Opening the Attachment?** No. Microsoft has confirmed the Outlook Reading Pane is an attack vector. The vulnerability triggers when a malicious file is previewed — selecting the email in Outlook is sufficient. Opening the attachment is not required. **Is the Windows File Explorer Preview Pane Also Affected?** Yes. Microsoft’s advisory confirms that both the Outlook Reading Pane and the Windows File Explorer Preview Pane use the same Word rendering code that contains the vulnerability. Any preview of a malicious .docx file through either interface can trigger exploitation. **Which Office Versions Are Affected?** All supported versions are affected. Microsoft 365 Apps receives the fix within 24 hours on the monthly enterprise channel via Click-to-Run. MSI-based installs — Office 2016, 2019, and 2021 — require separate update management. Refer to the Microsoft MSRC advisory for the complete list of affected versions. **Does CapaOne Patch Microsoft Office?** No. CapaOne does not deliver Microsoft Office updates. Security Monitor identifies which endpoints are still running unpatched Office versions, Application Manager closes the third-party application layer, and Privilege Manager limits post-exploitation impact through least-privilege enforcement. Written by Rikke Borup CMO, CapaSystems Rikke is Chief Marketing Officer at CapaSystems, where she has led marketing and communications since 2009. With more than 17 years of experience in the IT sector — including cybersecurity, endpoint management software and IT services — she brings long-standing, practical insight into the challenges facing modern enterprise IT environments. Trained as a journalist, Rikke specializes in translating complex technical concepts into clear, easy-to-understand communications for IT decision-makers. More from Rikke Borup → LinkedIn ↗ Book a Demo → --- URL: https://capaone.com/blog/how-least-privilege-access-control-insider-threat/ Published: 2026-05-20 Summary: Least-privilege access control stops insider threats before escalating. A real case from CapaSystems User Group — how CapaOne closes the gap. ← All articles Blog ## How Least-Privilege Access Control Prevents Insider Threats A trusted employee. A refused laptop. 100 million dollars in intellectual property at risk. By Rikke Borup, CMO, CapaSystems · May 20, 2026 Not every security incident starts with an encrypted server or a ransom demand. Some begin with a termination letter. A disputed laptop. A salesperson who had access to R&D data he should never have been able to open. At CapaSystems User Group in Skanderborg on Wednesday 29 April, Christian Ranum Spohr from Eagle Shark presented this case — Case 2 from a session that also covered ransomware. Where Case 1 was loud, urgent, and visible, Case 2 was quiet, slow, and far harder to detect. That is what makes it the more instructive of the two. And it is a case that demonstrates exactly why least-privilege access control is not a technical configuration — it is a governance decision with financial consequences. ### When the Risk Comes From Inside the Organization The case began with a termination. An employee in a trusted position was let go as part of a restructuring. He refused to return his work computer. The company assumed it was a simple dispute. It was not. Digital forensics revealed he had accessed systems he had no business entering — specifically the company’s full research and development folder, containing intellectual property valued at an estimated 100 million US dollars. He was a salesperson. He had no legitimate reason to access R&D data. But the access rights had never been restricted. Christian Ranum Spohr’s team was brought in. What followed was a months-long investigation combining digital forensics, physical surveillance, and legal documentation. The team discovered the former employee had established a shell company — staffed by a childhood friend and three neighbors — through which he was channeling contracts and payments. The investigation also uncovered a Russian business partner with whom he had been in regular contact, and documented physical meetings between the two. The case was resolved without going to court. The union complaint filed on the employee’s behalf was dropped when the evidence was presented. The computer was eventually returned — though it had been submerged in water and was no longer functional. The intellectual property theft was contained. The financial exposure was limited to the investigation cost, which was significantly less than the potential 100 million dollar loss. #### The Detail That Made the Breach Possible The access rights had never been restricted. That single sentence carries the entire weight of this case. Not a sophisticated attack. Not a zero-day exploit. Not an external adversary who spent months mapping the infrastructure. A salesperson walked into the R&D folder because no one had ever closed the door. Christian Ranum Spohr was direct about it at CapaSystems User Group: there was an IT manager who learned something important from this case — not because the tools failed, but because no one had asked the right question. Why does a salesperson have access to R&D data? “There was someone with IT responsibility who learned something important from this case. And there is a reason not everyone should have the keys to everything.” — Christian Ranum Spohr, Eagle Shark · CapaSystems User Group, Skanderborg, April 2026 ### What This Case Reveals About Least-Privilege Access Control and Insider Threat Risk In most mid-market organizations, access rights accumulate over time. Employees change roles. Projects end. Permissions granted for a specific purpose remain long after the purpose disappears. The result is a sprawling access landscape that no one fully controls — and that a motivated insider can exploit for months before anyone notices. The insider threat does not announce itself. It does not trigger alarms at 11 PM on a Friday. It operates quietly, within the bounds of legitimate credentials, until someone either discovers it by accident or conducts a deliberate investigation. For IT leaders — and particularly for CIOs and CISOs responsible for governance and risk — this represents a structural problem. The question is not whether employees can be trusted. Most can. The question is whether the organization has the operational discipline to ensure that trust and access are two separate things. Verizon’s 2025 DBIR found that 29% of breaches in EMEA originated from within the organization — a figure that underscores how significant the insider risk is for Nordic and European IT leaders specifically. #### Access Rights as a Governance Responsibility Every employee should have access to exactly what their role requires. Nothing more. When a role changes — through promotion, transfer, or termination — access should change immediately. And every access event to sensitive systems should generate a log that someone reviews. This is not a technical aspiration. It is a governance requirement. Under NIS2, organizations are expected to implement and document risk-based access controls — and to demonstrate that those controls function in practice, not just in policy documents. The former employee in Christian Ranum Spohr’s case had standing access to data that represented the company’s core intellectual value. There was no technical barrier between a salesperson and 100 million dollars worth of R&D. That is not a failure of trust. It is a failure of governance. ### What IT Leaders Can Do Before the Incident Occurs CapaOne Endpoint Management Platform gives IT leaders the operational foundation to close this gap. Built in Denmark and hosted in the EU, CapaOne provides real-time visibility into who has access to what across the endpoint estate, enforces least-privilege principles, and maintains the audit trail that turns a security incident into a documented, defensible case. This capability is not unique to endpoint platforms — privilege control appears in both security suites and endpoint platforms — but here it runs as continuous governance, not a response tool for after an incident already happened. When access rights are continuously managed rather than set once and forgotten, the window for undetected insider misuse closes significantly. Anomalies become visible. Termination workflows trigger access revocation automatically. The salesperson’s path to the R&D folder no longer exists. A complete endpoint management platform — designed to work with Microsoft Intune, or entirely without it — CapaOne addresses the governance gap that insider threats exploit most: standing access rights that should have been removed, and blind spots in endpoint visibility that allow misuse to continue undetected. The former employee in this case walked through a door that should have been closed the day his role changed. In most organizations, that door is still open — for someone. That is the real insider threat. Not the person. The gap. Book a demo of CapaOne Endpoint Management Platform → ### Frequently Asked Questions **What Is an Insider Threat in the Context of Endpoint Security?** An insider threat occurs when a current or former employee, contractor, or trusted partner misuses their access to systems, data, or intellectual property. Unlike external attacks, insider threats operate within the bounds of legitimate credentials — making them harder to detect and often more damaging to the organization. **Why Do Insider Threats Often Go Undetected for So Long?** Most organizations grant access rights based on initial role requirements but rarely review or restrict them as roles change. A salesperson who gains access to R&D data during a cross-functional project may retain that access for years. Without continuous visibility into access patterns and endpoint behavior, there is no trigger to investigate until damage has already occurred. **How Does Least-Privilege Access Reduce Insider Threat Risk?** Least-privilege access means every employee has access only to the systems and data their current role requires — nothing more. When roles change or employment ends, access is revoked immediately. This limits the attack surface available to a malicious insider and ensures that any unauthorized access is detectable against a baseline of expected behavior. **What Role Does Endpoint Management Play in Insider Threat Prevention?** Endpoint management platforms that enforce least-privilege, log access events, and provide real-time visibility into endpoint behavior give IT leaders the operational tools to detect and respond to insider threats. When every access event is logged and every endpoint is visible, the window for undetected misuse closes significantly. **How Often Should Organizations Review Access Rights?** Access rights should be reviewed continuously — especially during role changes, project transitions, and employee offboarding. Many insider threats occur because permissions granted years earlier were never removed or revalidated. Continuous review is not a one-time audit. It is an operational discipline. Written by Rikke Borup CMO, CapaSystems Rikke is Chief Marketing Officer at CapaSystems, where she has led marketing and communications since 2009. With more than 17 years of experience in the IT sector — including cybersecurity, endpoint management software and IT services — she brings long-standing, practical insight into the challenges facing modern enterprise IT environments. Trained as a journalist, Rikke specializes in translating complex technical concepts into clear, easy-to-understand communications for IT decision-makers. More from Rikke Borup → LinkedIn ↗ Book a Demo → --- URL: https://capaone.com/blog/cve-2026-41096-windows-dns-client-rce-patch-posture/ Published: 2026-05-19 Summary: CVE-2026-41096 hits every Windows endpoint. CapaOne closes the patch posture gap — fleet-wide visibility, third-party coverage, least-privilege. ← All articles Blog ## Endpoint Patch Posture and CVE-2026-41096: What IT Teams Miss Patch Tuesday closed the vulnerability. Confirming it reached every endpoint is the harder problem. By Rikke Borup, CMO, CapaSystems · May 19, 2026 CVE-2026-41096 is a CVSS 9.8 heap overflow in the Windows DNS Client. No authentication. No user interaction. Every Windows endpoint in your estate is in scope until the May 2026 Patch Tuesday update lands — and Microsoft rates exploitation as ‘less likely,’ but Krebs on Security and the Zero Day Initiative are treating it as urgent. The attack surface is too broad to do otherwise. The patch exists. The harder question is whether you can confirm — across your full fleet, right now — which endpoints have it. That is what this post is about. Not the vulnerability itself, but the posture problem that every critical Patch Tuesday exposes. ### Why Patch Posture Breaks Down at Scale The Windows DNS Client is not an optional component. It runs on virtually every Windows machine your organization operates. That means the patch scope for CVE-2026-41096 is, by definition, your entire Windows estate. Microsoft distributes the fix through Windows Update and WSUS. For organizations running Microsoft Intune or Autopatch, that rollout is already in motion. The operational question is not whether the patch exists — it is whether you can confirm, across your full fleet, which endpoints have received it and which have not. That confirmation gap is where most incidents begin. Not because IT teams are negligent, but because endpoint patch posture at scale is harder to verify than it looks. ### ‘Deployed’ Is Not the Same as ‘Applied’ A patch being ‘deployed’ is not the same as a patch being ‘applied.’ Endpoints that were offline during the rollout window, machines with update ring delays, devices managed through legacy WSUS configurations, and endpoints that rebooted late — all of these can show as pending while your dashboard shows progress. The Verizon Data Breach Investigations Report consistently identifies unpatched known vulnerabilities as one of the leading factors in confirmed breaches. The gap between patch release and patch confirmation is precisely where that exposure lives. ### Where CapaOne Fits — and Where It Does Not To be direct: CapaOne does not deploy the Windows OS patch for CVE-2026-41096. Microsoft distributes that fix through Windows Update, WSUS, Intune, or Autopatch — and those mechanisms should handle it. CapaOne’s role is different, and it matters in three specific ways. ### Patch Posture Visibility via Security Monitor Security Monitor surfaces CVE-based vulnerability signals, configuration drift, and patch posture across your endpoint estate in a single console. When a critical Patch Tuesday drops, Security Monitor gives IT administrators one view that answers the real question: which endpoints are still exposed? That view does not depend on which distribution mechanism you use. It works alongside Intune, alongside Autopatch, alongside WSUS. The posture data is independent of the delivery channel, which is what makes it useful when something falls through. ### Closing the Third-Party Application Layer A Windows RCE of this severity rarely operates in isolation. Attackers who gain initial access through a DNS client exploit typically move laterally through outdated third-party applications — browsers, document viewers, plugins — that were not part of the original patch cycle. Application Manager automatically keeps that layer current, removing the most common secondary entry points before they become relevant. ### Limiting Blast Radius via Privilege Manager If an endpoint is compromised before the patch arrives, the damage radius depends heavily on what that endpoint can do. Privilege Manager enforces just-in-time privilege elevation with no standing local admin. Without standing local admin, an attacker who gains execution on an endpoint has no immediate platform for lateral movement. The attack is contained at the device level. This is not a substitute for patching. It is a structural control that reduces the impact of the window between vulnerability disclosure and confirmed remediation — a window that will always exist at enterprise scale. ### What to Do This Week Here is what that looks like in practice: Open Security Monitor and filter by patch posture. You are looking for endpoints where the May 2026 update is absent or unconfirmed — not just a deployment progress bar. Security Monitor surfaces configuration drift and missing posture signals at the device level, so you can see exactly which machines are still exposed, not just how many. Identify update ring stragglers. Endpoints in deferred rings or behind WSUS group policy delays will not receive the fix within the standard window. Security Monitor’s fleet view makes these visible without having to cross-reference multiple consoles. Check your third-party application versions in Application Manager. Browsers, PDF readers, and communication tools running outdated versions are the most accessible secondary vector if DNS client access is achieved. Application Manager shows version posture across the estate and automates the remediation. Review privilege posture in Privilege Manager. Any endpoint with standing local admin rights extends the blast radius if exploitation occurs before the patch arrives. Privilege Manager shows which endpoints still carry standing admin — and removes it without adding helpdesk friction. ### Frequently Asked Questions **Does CVE-2026-41096 Require User Interaction?** No. The vulnerability is triggered by a malicious DNS response with no authentication and no user interaction required. Any Windows endpoint that resolves DNS — which is virtually all of them — is in scope until the May 2026 Patch Tuesday update is applied. **Does CapaOne Deploy the Windows OS Patch?** No. Microsoft distributes the Windows OS patch through Windows Update, WSUS, Intune, and Autopatch. CapaOne’s role is visibility and control: Security Monitor identifies which endpoints are still exposed, Application Manager closes the third-party application layer, and Privilege Manager limits the post-exploitation radius. **Which Windows Versions Are Affected?** All Windows client and server versions are affected. Refer to the NVD entry for CVE-2026-41096 and the Microsoft MSRC advisory for the complete list of affected versions and patch availability status. **How Does Privilege Manager Reduce Exposure?** Privilege Manager enforces least-privilege by removing standing local admin rights and replacing them with policy-based, time-limited elevation via Entra ID groups. If an attacker achieves code execution through the DNS client vulnerability, no standing local admin rights means no immediate platform for lateral movement or privilege escalation. Every Patch Tuesday has a patch. Not every IT team can answer, within the hour, which of their endpoints are still exposed. That gap is where incidents start — and it is exactly what CapaOne Endpoint Management Platform is built to close. Book a demo and see Security Monitor, Application Manager, and Privilege Manager working together — or start a free trial and run it against your own estate. Written by Rikke Borup CMO, CapaSystems Rikke is Chief Marketing Officer at CapaSystems, where she has led marketing and communications since 2009. With more than 17 years of experience in the IT sector — including cybersecurity, endpoint management software and IT services — she brings long-standing, practical insight into the challenges facing modern enterprise IT environments. Trained as a journalist, Rikke specializes in translating complex technical concepts into clear, easy-to-understand communications for IT decision-makers. More from Rikke Borup → LinkedIn ↗ Book a Demo → --- URL: https://capaone.com/blog/cve-2026-7896-chrome-edge-blink-patch-endpoint-fleet/ Published: 2026-05-14 Summary: CVE-2026-7896 enables heap corruption via crafted HTML. CapaOne shows every endpoint's browser version in 60 seconds — no spreadsheet needed. ← All articles Blog ## CVE-2026-7896 Chrome Edge Patch: Is Your Entire Endpoint Fleet Running the Fixed Version? A critical Blink integer overflow allows attackers to trigger heap corruption simply by loading a web page. Here is how to verify your entire fleet is patched in 60 seconds — without building a spreadsheet By CapaOne Support · May 14, 2026 On May 6, 2026, Google and Microsoft jointly disclosed CVE-2026-7896 — a critical integer overflow in Blink, the rendering engine that powers Chrome, Edge, Opera, Brave, and every other Chromium-based browser. The fix shipped in Chrome and Edge 148.0.7778.96. Every version below that is vulnerable to remote code execution via a crafted HTML page — no file download, no macro, no user interaction beyond loading the page. The vulnerability affects every Windows endpoint where the browser has not yet restarted and applied its pending update. That includes laptops that have been running for days without a reboot, VDI sessions that never end, kiosks, shared workstations, and any endpoint where enterprise update policies delay or defer the rollout. The first operational question is not theoretical. It is: how many of our managed endpoints are still running a Chromium build below 148.0.7778.96 right now? If the answer is ‘we think most are patched’ — that is not an answer. That is a hope. ### Why Browser CVEs Are Different From OS Patch Tuesday OS patches follow a predictable monthly rhythm: the volume varies, as June 2026 Patch Tuesday showed, but the date stays fixed. Browser updates do not. Chromium releases move on a faster cadence — sometimes with critical memory-safety issues embedded in what looks to users like a minor dot release. The patch exists the moment the release ships. The gap is not between disclosure and fix; it is between the fix and the endpoint running it. CVE-2026-7896 illustrates why this matters. As Windows Forum’s analysis notes, a fully updated Windows 11 machine running an outdated browser is not a fully patched endpoint in any meaningful security sense. The OS may be current. The attack surface is not. Enterprise environments compound this. Many organizations run both Chrome and Edge — Chrome on developer workstations, Edge on general desktops, Chromium-based WebView2 inside line-of-business applications, and occasionally additional Chromium builds for compatibility testing. A single Blink CVE can become a multi-tool scavenger hunt across browser inventories that no single policy controls entirely. Browser update policies — Group Policy, Chrome Enterprise, Microsoft Intune — queue the update. They do not confirm, per device, that the browser has restarted and that the new version is running. That gap is where exposure lives. ### How CapaOne Shows You Browser Version Coverage Across the Fleet CapaOne’s Application Manager maintains a real-time software inventory across every managed endpoint — including browser versions. When CVE-2026-7896 was disclosed, IT administrators using CapaOne could immediately filter the fleet by installed Chrome or Edge version and identify every device still running a build below 148.0.7778.96. No cross-referencing. No export to spreadsheet. No manual comparison against a version list. The view surfaces regardless of how the browser reached that device — whether through Autopatch, Intune, Chrome Enterprise update policy, manual install, or shadow IT. CapaOne reads the installed version directly from the endpoint. The policy that deployed it is irrelevant. For endpoints where the browser has received the update package but not yet restarted, Security Monitor’s configuration posture signals flag the pending state separately from devices that are genuinely running the patched version. IT administrators can push a forced restart to specific device cohorts — prioritizing high-risk users such as finance, HR, and executive assistants — without touching the rest of the fleet. The same dataset exports directly to CSV for change management documentation and NIS2 Article 21 evidence — capturing browser version, device, and remediation timestamp per endpoint. ### What Makes This Vulnerability Particularly Dangerous on Enterprise Endpoints The technical root cause of CVE-2026-7896 sits in Blink’s layout engine — specifically in the code handling complex CSS grid and flexbox containers nested inside iframes. Lyrie Research’s analysis describes how an integer overflow in that code path results in heap metadata corruption that can be leveraged to execute arbitrary code in the renderer process. What makes this dangerous at the enterprise level is the delivery path. Drive-by exploitation requires only that a user loads a malicious page through a phishing link, a compromised ad network, a poisoned CDN, or a legitimate site serving attacker-controlled content. No attachment. No macro prompt. No elevation dialog. The blast radius expands significantly on endpoints where users hold standing local administrator rights. A compromised renderer process on a standard-user account has limited lateral movement options. The same compromise on a local admin account opens persistence mechanisms, credential access paths, and lateral movement options that transform a browser exploit into a network incident. This is precisely why CapaOne’s Privilege Manager— which enforces just-in-time elevation and removes standing local admin rights across the fleet — serves as a meaningful secondary control even against browser-based exploits. A successful Blink exploit on a standard-user account faces a substantially narrower attack surface than one on a local admin account. Book a demo of CapaOne Endpoint Management Platform here to see how Application Manager surfaces browser version coverage across your entire fleet — or start a free trial and check your own fleet hands-on. ### Frequently Asked Questions **Which Browser Versions Are Vulnerable to CVE-2026-7896?** All Chromium-based browsers prior to version 148.0.7778.96 are affected. This includes Google Chrome, Microsoft Edge, Opera, Brave, and applications that embed Chromium’s WebView2 runtime. The patched version shipped on May 6, 2026. Organizations should verify that all endpoints are running 148.0.7778.96 or later and that pending updates have been applied through a browser restart — not just downloaded. **Does Windows Autopatch or Intune Handle Browser Version Enforcement?** Autopatch manages Windows OS and Microsoft 365 Apps — it does not enforce browser version compliance for Chrome or third-party Chromium builds. Intune can push browser update policies, but policy delivery does not guarantee that the browser has restarted and the new version is active. CapaOne’s Application Manager reads the installed version directly from each endpoint, regardless of which policy or mechanism deployed the browser. **How Does CapaOne Identify Which Endpoints Are Still Running a Vulnerable Browser Version?** Application Manager maintains a real-time software inventory across all managed endpoints, including browser versions. IT administrators can filter by application name and version to identify every device below 148.0.7778.96 within seconds. The view covers Chrome, Edge, and any other Chromium-based browser installed in the environment, regardless of whether it was deployed centrally or installed by users. **Why Does Local Admin Status Affect the Risk Level of CVE-2026-7896?** CVE-2026-7896 achieves code execution in the browser renderer process. On a standard-user account, the attacker’s options from that foothold are limited. On an account with standing local administrator rights, the same exploit opens lateral movement paths, credential theft vectors, and persistence mechanisms. Removing standing local admin — which CapaOne’s Privilege Manager enforces fleet-wide through just-in-time elevation — substantially reduces the blast radius of a successful browser exploit. Book a Demo → --- URL: https://capaone.com/blog/qilin-ransomware-in-2026-how-identity-first-attacks-target-european-endpoints-and-why-consolidation-is-the-response/ Published: 2026-05-14 Summary: Qilin led Q1 2026 ransomware with identity-first attacks and a 96% exfiltration rate. See how CapaOne closes the endpoint gaps behind them. ← All articles Blog ## Qilin Ransomware in 2026: How Identity-First Attacks Target European Endpoints — and Why Consolidation Is the Response Qilin leads Q1 2026 ransomware activity with 361 recorded victims. The attack model has shifted from encryption to identity theft and data exfiltration at 96%. Here is what that means for European IT teams — and the endpoint posture that addresses it By Rikke Borup, CMO, CapaSystems · May 14, 2026 The numbers from Q1 2026 are consistent across every major threat intelligence source. ReliaQuest recorded 2,638 ransomware posts on data-leak sites — a 22% increase year-on-year. BlackFog identified 2,160 undisclosed attacks in the same period, representing only a fraction of total activity. ZeroFox observed over 2,000 separate incidents. The trend line from 2024 through Q4 2025 has not reversed — it has flattened at a high level. This is not a spike. It is the new baseline. What has changed is the attack model. BlackFog’s Q1 2026 report shows data exfiltration at 96% of recorded incidents. Attackers are no longer primarily trying to encrypt systems and demand ransom for the decryption key. They are stealing credentials, exfiltrating data, and demanding payment under threat of publication — or simply monetizing the stolen data directly. System downtime is optional. For European IT managers and CIOs facing NIS2 reporting obligations and insurance renewal pressure, this shift has concrete operational implications. Defenses built around backup-and-restore logic or network segmentation alone do not address a threat model centered on identity compromise and data exfiltration. The response requires a different endpoint posture. ### Qilin and the Q1 2026 Threat Landscape: What the Data Shows for European Organizations Three developments from Q1 2026 are directly relevant to European IT organizations. First, Qilin maintained its position as the most active ransomware group by victim volume, with GuidePoint Research recording 361 victims despite a 25% decline from its Q4 2025 peak. Qilin’s open affiliate recruitment model enables broad, high-volume targeting — the group does not need to select targets carefully when affiliates can attack at scale. Second, Europe accounted for approximately 22% of all ransomware incidents in Q1 2026, according to ZeroFox’s quarterly wrap-up — a slight increase from Q4 2025. North America and Europe together represent 76% of global incidents. European organizations are not a secondary target. Third, the identity-first attack pattern is accelerating. BlackFog’s report highlights that 86% of employees now use AI tools weekly, with 49% relying on unsanctioned platforms — creating uncontrolled data pathways alongside the credential-theft vectors that groups like Qilin’s affiliates exploit through RDP compromise, phishing, and NTLM relay attacks. The average volume of data stolen per undisclosed incident reached 743GB in Q1. ### Why Endpoint Consolidation Is the Structural Response The shift from encryption-focused to identity- and data-focused ransomware does not make endpoint management less relevant. It makes it more relevant — because the attack paths now run through endpoint-level vulnerabilities, credential exposure, and privilege abuse rather than through network-level encryption keys. Fragmented endpoint tooling creates the gaps these attack paths exploit. An organization managing patching in one tool, privilege access in another, vulnerability visibility in a third, and compliance reporting in a spreadsheet does not have a unified view of its risk surface. It has a collection of partial views that leave systematic gaps. The consolidation case is operational, not theoretical. When a new CVE drops — or when a CISA KEV deadline approaches — the question is how long it takes to know which endpoints are exposed and how long it takes to close that exposure. Fragmented tools mean fragmented answers. CapaOne Endpoint Management Platform consolidates the capabilities that address the identity-first ransomware model: real-time asset inventory and vulnerability visibility through Security Monitor, privileged access control through Privilege Manager, and automated third-party application patching through Application Manager. One platform. One dashboard. One audit trail. ### The European Dimension: Sovereignty, NIS2, and Insurance For European organizations, the ransomware reality intersects with three converging pressures that make endpoint consolidation a board-level question, not just an IT operation one. NIS2 reporting obligations: NIS2 Article 21 requires organizations to maintain and demonstrate technical measures to address identified vulnerabilities. When an incident occurs — or when a regulator inquires — the evidence requirement is per-device, per-vulnerability, per-timestamp. Fragmented tools rarely produce that evidence automatically. CapaOne generates it as a standard output of normal operations. Cyber insurance renewal: Insurers increasingly require documented evidence of patch compliance, privileged access controls, and vulnerability management practices as conditions of coverage. Organizations that cannot demonstrate these controls face premium increases, coverage exclusions, or rejection. The same CapaOne exports that satisfy NIS2 auditors satisfy insurance questionnaires. Digital sovereignty: CapaOne is built, hosted, and owned in Europe. For IT leaders managing geopolitical risk alongside operational risk, that is not a marketing statement — it is a procurement criterion. No US data residency exposure. No Schrems II complexity. Full GDPR alignment by architecture. Book a demo of CapaOne Endpoint Management Platform here to see how Security Monitor, Privilege Manager, and Application Manager work together to reduce ransomware exposure — with European hosting and NIS2 reporting built in. ### Frequently Asked Questions **Has the Ransomware Threat Actually Increased in Q1 2026, or Is Reporting Just More Comprehensive?** Multiple independent sources converge on the same conclusion: ransomware activity stabilized in Q1 2026 at the elevated level reached at the end of 2025. ReliaQuest recorded a 22% year-on-year increase in data-leak site posts. ZeroFox observed over 2,000 incidents. BlackFog identified 2,160 undisclosed attacks. The consistency across sources reflects a genuine sustained threat level, not a reporting artifact. **Why Does the Shift to Identity-Focused Ransomware Change What Endpoint Controls Are Required?** Traditional ransomware defenses centered on backup integrity and network segmentation address encryption-based attacks. Identity-focused attacks bypass encryption entirely — stealing credentials, exfiltrating data, and monetizing access through SaaS platforms and cloud services. The effective controls are endpoint-level: removing standing local admin rights, patching applications that expose credential theft vectors, and maintaining real-time visibility into configuration drift and vulnerability exposure. **How Does CapaOne Address the Identity-First Ransomware Attack Model?** CapaOne’s Privilege Manager removes standing local administrator rights across the fleet, replacing them with just-in-time elevation controlled by policy. This directly reduces the blast radius of credential compromise — a captured credential from a standard-user account has far fewer lateral movement options than one from a local admin account. Security Monitor provides real-time CVE visibility and configuration posture signals that identify the exposure points attackers use for initial access. **Does CapaOne Produce the Evidence Required for NIS2 Reporting After a Ransomware Incident?** Yes. CapaOne generates device-level CSV exports covering patch status, installed versions, configuration posture, remediation actions, and timestamps. These exports satisfy NIS2 Article 21 documentation requirements for both proactive governance reviews and post-incident regulatory inquiries. The same data supports cyber insurance questionnaires and leadership dashboards for monthly reporting. **How Does Qilin Ransomware Gain Initial Access Through Endpoints?** Qilin affiliates primarily gain initial access through three endpoint-level vectors: RDP brute force against endpoints with exposed remote access, credential phishing that harvests NTLM hashes or session tokens, and exploitation of unpatched vulnerabilities in internet-facing applications and browsers. Once inside, the group moves laterally by abusing accounts with standing local administrator rights — which allows rapid escalation from a single compromised endpoint to domain-level access. Removing standing local admin through CapaOne’s Privilege Manager closes the lateral movement path that makes initial access operationally valuable to Qilin affiliates. Patching third-party applications and browsers through Application Manager closes the initial access vectors themselves. Written by Rikke Borup CMO, CapaSystems Rikke is Chief Marketing Officer at CapaSystems, where she has led marketing and communications since 2009. With more than 17 years of experience in the IT sector — including cybersecurity, endpoint management software and IT services — she brings long-standing, practical insight into the challenges facing modern enterprise IT environments. Trained as a journalist, Rikke specializes in translating complex technical concepts into clear, easy-to-understand communications for IT decision-makers. More from Rikke Borup → LinkedIn ↗ Book a Demo → --- URL: https://capaone.com/blog/endpoint-patch-compliance-gap-audit-automation-2026/ Published: 2026-05-13 Summary: 94% of organizations have an endpoint patch compliance gap. CapaOne closes it with full lifecycle automation and NIS2-aligned audit exports. ← All articles Blog ## The Endpoint Patch Compliance Gap: Why 94% of Organizations Still Patch Manually — and How to Close It The State of Endpoint Management Report 2026 shows that only 6% of organizations have closed their endpoint patch compliance gap entirely. Here is what separates them from the 94% — and how CapaOne gets you there By Rikke Borup, CMO, CapaSystems · May 13, 2026 According to the Action1 State of Endpoint Management Report 2026, only 6% of organizations have achieved full patch automation. The other 94% manage shortfalls manually — through scripts, spreadsheets, ad hoc exception handling, and reactive patching triggered by incidents rather than by policy. That gap has direct consequences. Research from Verizon’s Data Breach Investigations Report consistently identifies exploitation of known, unpatched vulnerabilities as one of the leading initial access vectors. Once a critical CVE is disclosed, threat actors begin scanning for exposed systems within days. Organizations typically take 55 days or more to patch half their fleet. That window is where breaches happen. For IT managers and CIOs, the 6% figure is both a benchmark and a strategic question: what separates the organizations in that group from the 94% still operating manually? And what does moving from one group to the other actually require? ### Why the Endpoint Patch Compliance Gap Persists — and What It Costs The gap between patching policy and patching reality is rarely a technology problem. Most IT environments already have tools for deploying patches. The problem is coverage, consistency, and visibility — the three things manual processes cannot sustain at scale. Coverage gaps: Automated OS patching through Windows Update or Autopatch covers the operating system. It does not cover the hundreds of third-party applications — browsers, PDF readers, compression tools, developer libraries, line-of-business software — that represent a large share of the CVE surface. Those gaps are filled manually, inconsistently, or not at all. Consistency failures: Remote workers, offline devices, and endpoints on deferred update rings miss scheduled deployments. Without automated follow-up logic, those devices accumulate drift silently. The patch posture looks compliant in the dashboard. The actual fleet is not. On Windows hotpatch, a missed baseline costs more than one update: the device falls back to cumulative updates with restarts until it catches up. Visibility blind spots: Manual processes rarely produce the documentation auditors require. Knowing that patches were deployed is different from proving — per device, per application, per timestamp — that remediation happened within a defensible timeframe. NIS2 Article 21 and cyber insurance questionnaires increasingly demand the latter. The combined cost is substantial. Ivanti research found that 71% of IT and security professionals describe their patching process as overly complex and time-consuming. For a team of five to twenty IT professionals managing 250 to 1,000 endpoints, manual patching is not just inefficient — it is structurally incompatible with the risk environment in which organizations now operate. ### What Full Patch Automation Actually Requires Full patch automation is not a single feature. It is a lifecycle — five connected steps that must run without manual intervention before an organization can claim genuine automation coverage. #### 1. Continuous Discovery Automation starts with knowing what is installed. Every endpoint, every application, every version — updated continuously, not on a weekly scan schedule. Without real-time inventory, prioritization is guesswork, and deployment targeting is incomplete. #### 2. Risk-Based Prioritization Not every patch carries the same urgency. Full automation requires a prioritization layer that maps CVE severity, CISA Known Exploited Vulnerabilities flags, and active-exploitation signals to produce a ranked remediation queue — so critical vulnerabilities like CVE-2026-7896 or CVE-2026-32202 surface immediately, without requiring IT staff to manually monitor security feeds. #### 3. Automated Deployment Patches deploy on schedule, in defined rings, with staged rollout logic that advances updates based on success rates. Offline endpoints receive the patch when they reconnect. No manual follow-up. No exception lists are maintained in spreadsheets. #### 4. Verification Deployment is not remediation. Verification confirms per device that the patched version is running — not just that the update package was delivered. This distinction matters especially for browser updates, where a pending restart can leave a device technically updated but practically vulnerable, as CVE-2026-7896 in Chrome and Edge showed. #### 5. Compliance Documentation Full automation produces audit-ready evidence automatically — patch date, installed version, remediation action, and timestamp per device. The same dataset satisfies NIS2 reporting, cyber insurance questionnaires, and internal governance reviews without additional manual extraction. ### How CapaOne Automates the Full Patch Lifecycle CapaOne’s Application Manager covers all five steps across Windows OS updates, macOS, Linux, and a curated catalog of third-party applications — without requiring separate tools, separate consoles, or manual packaging work. The platform handles discovery, prioritization, staged deployment, verification, and compliance documentation from a single dashboard. CapaOne’s Security Monitor adds the risk layer — CVE-based scoring, exposure visibility across applications and drivers, and prioritized remediation queues that surface the vulnerabilities most likely to be exploited before generic patching queues reach them. When CISA adds a CVE to the Known Exploited Vulnerabilities catalog, that signal automatically propagates into the prioritization logic. For NIS2-obligated organizations, CapaOne generates device-level CSV exports covering patch status, installed versions, remediation actions, and timestamps. Those exports satisfy Article 21 documentation requirements and support cyber insurance questionnaires without additional manual extraction — removing the compliance scramble that follows an audit inquiry. The SMB security and vulnerability management market is growing at 7.55% annually, driven in part by AI-based prioritization and regulatory pressure from NIS2. The organizations investing now are building the operational foundation that makes the top 6% achievable — not as a project, but as steady-state IT operations. Book a demo of CapaOne Endpoint Management Platform here to see how Application Manager and Security Monitor automate the full patch lifecycle — or start a free trial and explore the platform hands-on. ### Frequently Asked Questions **What Does the 6% Statistic Actually Mean for Mid-Market IT Teams?** According to the Action1 State of Endpoint Management Report 2026, only 6% of organizations have achieved full patch automation — meaning discovery, prioritization, deployment, verification, and compliance documentation all run without manual intervention. The remaining 94% rely on manual processes for at least one of these steps, creating gaps in coverage, consistency, and audit readiness. For mid-market IT teams managing 250 to 1,000 endpoints with a team of five to twenty, manual patching is not just inefficient — it is structurally incompatible with NIS2 obligations and cyber insurance requirements. **Does CapaOne Cover Third-Party Application Patching as Well as OS Updates?** Yes. CapaOne’s Application Manager automates updates for Windows OS, macOS, Linux, and a curated catalog of third-party applications. This includes browsers, productivity tools, developer libraries, and other applications that sit outside the scope of Windows Autopatch and Microsoft Intune’s native patching capabilities. Coverage extends to offline endpoints, which receive the patch automatically when they reconnect. **How Does CapaOne Produce NIS2 Audit Evidence?** CapaOne generates device-level CSV exports covering patch status, installed versions, remediation actions, and timestamps. These exports satisfy NIS2 Article 21 documentation requirements — demonstrating that identified vulnerabilities were remediated within defensible timeframes — and support cyber insurance questionnaires and leadership dashboards without additional manual extraction. **How Long Does It Take to Go From Manual Patching to Full Automation With CapaOne?** CapaOne deploys in days, not months. A single lightweight agent per endpoint connects to the platform without VPN or on-premises infrastructure. IT administrators typically reach their first automated patch deployment within the first week. Time-to-value is measured in weeks, not quarters — with no implementation consultants required. Written by Rikke Borup CMO, CapaSystems Rikke is Chief Marketing Officer at CapaSystems, where she has led marketing and communications since 2009. With more than 17 years of experience in the IT sector — including cybersecurity, endpoint management software and IT services — she brings long-standing, practical insight into the challenges facing modern enterprise IT environments. Trained as a journalist, Rikke specializes in translating complex technical concepts into clear, easy-to-understand communications for IT decision-makers. More from Rikke Borup → LinkedIn ↗ Book a Demo → --- URL: https://capaone.com/blog/cloud-endpoint-management-platform/ Published: 2026-05-12 Summary: Moving to cloud endpoint management changes what is possible. See what a cloud-native platform delivers and what to look for. ← All articles Blog ## Cloud Endpoint Management Platform: What to Look for in 2026 Not all cloud endpoint management platforms are built the same. Here is what separates cloud-native from cloud-hosted — and the five dimensions IT teams should evaluate before choosing By Rikke Borup, CMO, CapaSystems · May 12, 2026 For most IT teams, endpoint management still means managing infrastructure. On-premises servers, local agents, manual update cycles, and fragmented consoles that require constant attention. It works — until the endpoint estate grows, the team shrinks, or compliance requirements tighten. Cloud endpoint management platforms fundamentally change the operational model. Instead of managing infrastructure that manages endpoints, IT teams manage endpoints directly — from a single cloud-based console, without servers, scripting dependencies, or the overhead of on-premises deployment. The shift is significant. But not all cloud endpoint management platforms deliver the same thing. Understanding what to look for — and what genuinely differentiates cloud-native from cloud-hosted — makes the difference between a platform that reduces complexity and one that moves it somewhere else. ### What Cloud-Native Endpoint Management Actually Means Cloud-hosted and cloud-native are not the same thing. Many endpoint management solutions describe themselves as cloud-based when, in fact, they have simply moved an on-premises architecture to a cloud server. The management overhead follows. Patching the server, managing certificates, handling upgrades — these responsibilities transfer to IT teams even if the hardware lives somewhere else. A genuinely cloud-native endpoint management platform requires no on-premises infrastructure. There are no servers to patch, no agents to update through complex deployment pipelines, and no upgrade cycles that require IT team intervention. The platform scales with the endpoint estate. New capabilities deploy automatically. IT teams consume the platform — they do not maintain it. #### The Operational Difference for IT Teams The distinction matters most in day-to-day operations: - Deployment time drops from weeks to days. A single agent installs across endpoints. Inventory syncs. Visibility begins immediately. - Coverage extends automatically. Remote workers, devices in branch offices, and endpoints across geographies all appear in the same console without VPN dependencies or regional server infrastructure. - Updates arrive without IT involvement. New features, platform security patches, and updated application catalogs are deployed in the background. - Compliance evidence is generated continuously. Patch logs, vulnerability records, and privilege access histories accumulate in real time — not assembled manually before an audit. ### Five Dimensions to Evaluate in a Cloud Endpoint Management Platform Cloud delivery is a prerequisite, not a differentiator. The platforms that genuinely reduce IT complexity and security risk deliver across five operational dimensions. #### Operational Scope The first question is coverage. Does the platform handle the full range of endpoint operations — application patching, driver management, privilege access, vulnerability monitoring, OS deployment, and mobile device management — or does it handle one or two and require additional tools for the rest? A platform that only partially consolidates has not solved tool sprawl. #### Data Sovereignty and Hosting Location Endpoint management platforms process sensitive operational data: device inventories, vulnerability exposures, and security event logs. For organizations subject to GDPR and NIS2, the location of that data processing matters. A cloud endpoint management platform built and hosted in Europe provides jurisdictional clarity that US-based alternatives cannot reliably match. #### Integration With Existing Microsoft Environments Most mid-market IT organizations run Microsoft 365, Entra ID, and, to varying degrees, Microsoft Intune. A cloud endpoint management platform should work within that environment — not require dismantling it. CapaOne adds the operational depth Intune does not natively deliver: automated third-party application patching, vendor-certified driver management, just-in-time privilege elevation, and exportable compliance evidence. Organizations without Intune can use CapaOne as a complete, standalone solution. #### Time to Value Endpoint management platforms that require weeks of configuration before delivering value transfer risk to IT teams. Most CapaOne customers are operational within days — not weeks. Inventory visibility, patch status, and vulnerability exposure appear within hours of deployment. Automation workflows are configured without scripting. #### Compliance Evidence Generation Modern IT organizations face audit requirements from multiple directions simultaneously — NIS2, ISO 27001, cyber insurance assessors, and internal governance frameworks. A cloud endpoint management platform that automatically generates compliance evidence in exportable formats removes a significant operational burden. These are not reports that IT teams produce—they are operational logs the platform generates as a byproduct of its work. ### How CapaOne Delivers Cloud Endpoint Management CapaOne Endpoint Management Platform is a cloud-native solution built in Denmark and hosted in Europe. It covers the full operational scope — application management, privilege access, vulnerability monitoring, endpoint health, OS deployment, and mobile device management — through a single agent and a single console, with no on-premise infrastructure required. For organizations running Microsoft Intune, CapaOne extends it with the capabilities that complete a modern endpoint management stack. For organizations without Intune, CapaOne operates as a complete platform that covers every endpoint operation through one unified environment. Book a demo of CapaOne Endpoint Management Platform to see cloud-native endpoint management in operation — or start a free trial and experience it directly. ### Frequently Asked Questions **What Is a Cloud Endpoint Management Platform?** A cloud endpoint management platform delivers all core endpoint operations from a cloud-native environment, without requiring on-premises servers or local infrastructure. IT teams manage all endpoints through a single web-based console, and the platform scales automatically as the endpoint estate grows or changes. **What Is the Difference Between Cloud-Native and Cloud-Hosted Endpoint Management?** Cloud-hosted endpoint management moves an on-premises solution to a cloud server. The architecture is the same; only the location changes. Cloud-native endpoint management is built from the ground up for cloud delivery — no on-premises servers, elastic scaling, and updates delivered without IT team infrastructure management. **Does a Cloud Endpoint Management Platform Work With Microsoft Intune?** Yes. CapaOne integrates with Microsoft Intune and extends it with capabilities Intune does not natively deliver. Organizations without Intune can run CapaOne as a complete standalone platform. **How Quickly Can an IT Team Deploy a Cloud Endpoint Management Platform?** CapaOne deploys within days. No on-premises servers, no complex configuration, no scripting required. A single agent deploys across endpoints and syncs inventory; IT teams gain immediate visibility into patch status, vulnerabilities, and device health. **What Should IT Teams Look for When Evaluating Cloud Endpoint Management Platforms?** Evaluate five dimensions: operational scope (does it cover patching, drivers, privilege, vulnerability, mobile, and OS deployment?), data sovereignty (where is endpoint data processed?), Microsoft integration, time-to-value, and compliance evidence generation. A platform that requires additional tools for full coverage has not eliminated tool sprawl. Written by Rikke Borup CMO, CapaSystems Rikke is Chief Marketing Officer at CapaSystems, where she has led marketing and communications since 2009. With more than 17 years of experience in the IT sector — including cybersecurity, endpoint management software and IT services — she brings long-standing, practical insight into the challenges facing modern enterprise IT environments. Trained as a journalist, Rikke specializes in translating complex technical concepts into clear, easy-to-understand communications for IT decision-makers. More from Rikke Borup → LinkedIn ↗ Book a Demo → --- URL: https://capaone.com/blog/cve-2026-32202-ntlm-zero-day-endpoint-patch-status/ Published: 2026-05-11 Summary: CVE-2026-32202 exploits Net-NTLMv2 hashes with no user click. CapaOne shows which endpoints lack the patch and limits the blast radius. ← All articles Blog ## CVE-2026-32202: Which Endpoints in Your Fleet Still Lack the Patch? A zero-click NTLM flaw is currently under active exploitation by APT28. The CISA deadline expires today — here is how CapaOne maps your exposure and limits the blast radius By CapaOne Support · May 11, 2026 The CISA Known Exploited Vulnerabilities deadline for CVE-2026-32202 expires today — May 12, 2026. Federal agencies must patch by the end of the day. But CISA KEV deadlines are also a reliable signal for every IT team in the private sector: this vulnerability is active, and attackers are already using it. The flaw is a zero-click NTLM hash leak. A user simply opens a folder containing a malicious LNK file — no interaction, no warning. Windows automatically sends the user’s Net-NTLMv2 credential hash to an attacker-controlled SMB server. APT28, the Russian state-sponsored group, is actively exploiting it against EU and Ukraine targets, according to analysis published by Akamai. The problem is compounded by history. Microsoft’s February 2026 patch for the closely related CVE-2026-21510 turned out to be incomplete. CVE-2026-32202 is the continuation of that same attack surface. Organizations that believe they patched this in February almost certainly have not. This article explains the attack path and shows how CapaOne Endpoint Management Platform identifies exactly which endpoints in your fleet still lack the critical April patch — and how Privilege Manager limits the blast radius if a hash is captured. ### What the Attack Actually Does — and Why It Survives Partial Patches NTLM hash relay is not a new technique. What makes CVE-2026-32202 notable is the delivery mechanism: a malicious Windows shortcut file (.LNK) placed inside a folder. The moment Windows Explorer renders the folder — no double-click needed — the OS attempts to resolve resources referenced by the LNK file. That resolution triggers an outbound SMB request that carries the user’s Net-NTLMv2 hash to an external server. From that point, the attacker captures the hash and uses it in a relay attack against internal services. Web applications, file shares, and internal APIs that accept NTLM authentication become accessible without ever cracking a password. The same display-is-enough pattern made the Outlook Reading Pane an attack vector for a Word flaw in May 2026. The February patch for CVE-2026-21510 blocked one vector. Akamai’s research team identified the incomplete fix and disclosed CVE-2026-32202 as a bypass. Microsoft issued the corrective patch in April 2026. Organizations that ran the February Patch Tuesday cycle and assumed NTLM hash relay was covered are mistaken — the April update is the one that matters. The ENISA Threat Landscape report consistently identifies credential theft via relay attacks as one of the highest-volume initial access methods against European organizations. CVE-2026-32202 is a textbook example of that category. ### How CapaOne Identifies Exposure Across Your Fleet The first operational question when a critical CVE drops is not theoretical — it is: how many of our endpoints are missing this patch right now? Without a unified view, IT teams pull reports from multiple tools, cross-reference patch logs, and build spreadsheets. That process takes hours. During active exploitation, hours matter — and as AI-assisted exploit development shortens the patch window, they matter more. CapaOne’s Security Monitor provides a continuously updated CVE-based vulnerability inventory across every managed endpoint. The moment the April update is indexed, Security Monitor maps which devices have received it and which remain exposed. You see the results in a single prioritized queue — filtered by severity, device group, site, or business unit. Relevant fields visible in CapaOne’s vulnerability dashboard include the installed Windows version per device, the patch date of the last cumulative update, and whether the specific KB article associated with CVE-2026-32202 is present. No manual cross-referencing. No spreadsheet. For organizations managing multiple sites or business units, filters by OS version or tag let IT administrators identify whether the problem concentrates in a particular location or device group. ### How Privilege Manager Limits the Blast Radius The goal is to patch every endpoint before the CISA deadline. It is rarely the reality for large, distributed fleets. Devices are offline. Users are traveling. Managed exceptions exist. A small percentage of endpoints will miss the patch window. This is where Privilege Manager provides a meaningful secondary control. CVE-2026-32202 exploits NTLM hash relay to authenticate to internal services. The damage depends on what those credentials can access. Accounts operating with standing local administrator rights provide attackers with substantially higher-value targets — lateral movement is easier, persistence mechanisms are broader, and privilege escalation becomes trivial. CapaOne’s Privilege Manager enforces just-in-time elevation — no user holds standing local admin rights by default. Elevation is granted by policy, scoped to a specific executable, limited in duration, and logged in full. If a hash from a standard user account is captured and relayed, the attacker operates with standard user permissions. That does not make compromise harmless, but it substantially reduces the available attack paths. The combination — patch prioritization from Security Monitor and blast radius reduction from Privilege Manager — is the operational response that aligns with ENISA’s defense-in-depth approach to credential-based attacks. ### NIS2 Reporting: Turning Remediation Evidence Into Audit Documentation For organizations subject to NIS2, CVE-2026-32202 is not just a patching task — it is a documentation obligation. NIS2 Article 21 requires organizations to maintain and demonstrate adequate technical measures to address identified vulnerabilities. Active APT28 exploitation means regulators and cyber insurers will ask: Did you know about this vulnerability, and what did you do about it? CapaOne generates exportable CSV evidence at the device level — patch date, installed version, remediation action, and timestamp. The same dataset supports NIS2 reporting, internal governance reviews, and cyber insurance questionnaires without additional manual extraction. The full audit trail from vulnerability identification through remediation confirmation is available in a format auditors can accept directly. One CVE is a test case. An auditor asks for the same trail across months of patching, and that is what endpoint patch management for audits builds. That removes the scramble that typically follows a regulator inquiry. Book a demo of CapaOne Endpoint Management Platform here to see how Security Monitor identifies exposure across your fleet — or start a free trial and explore the platform hands-on. ### Frequently Asked Questions **What Is CVE-2026-32202, and Why Does It Affect Organizations That Already Ran the February Patch?** CVE-2026-32202 is a zero-click NTLM hash-leak vulnerability in the Windows Shell. It survived the February patch for the closely related CVE-2026-21510 because that earlier fix was incomplete. Akamai’s research team identified the bypass in April 2026. The corrective patch shipped with the April 2026 cumulative update — not February’s. Organizations that only ran the February cycle remain exposed. **Does CapaOne Detect CVE-2026-32202 Specifically?** CapaOne’s Security Monitor indexes CVE-based vulnerability signals across endpoints, including OS-level patch status. Devices missing the April cumulative update — which contains the CVE-2026-32202 fix — appear in the prioritized remediation queue. The view is filterable by device group, OS version, and site. **How Does Privilege Manager Reduce Risk If Patching Is Delayed?** NTLM hash relay attacks are most damaging when the captured credential belongs to an account with standing local administrator rights. Privilege Manager removes standing local admin from all endpoints by default, granting elevation only on request, by policy, for a defined duration. A captured standard-user credential provides an adversary with significantly fewer attack paths. **Can CapaOne Export Remediation Evidence for NIS2 Compliance?** Yes. Security Monitor generates device-level CSV exports showing patch status, installed versions, and remediation timestamps. The same exports support NIS2 Article 21 documentation, internal audits, and cyber insurance questionnaires. Book a Demo → --- URL: https://capaone.com/blog/endpoint-management-consolidation-how-it-teams-eliminate-tool-sprawl/ Published: 2026-05-11 Summary: Tool sprawl slows IT teams and raises risk. CapaOne replaces 4-5-point solutions with a single endpoint management platform. ← All articles Blog ## Endpoint Management Consolidation: How IT Teams Eliminate Tool Sprawl IT teams that consolidate endpoint operations onto a single platform spend less time managing tools and more time managing endpoints. This is how it works By Rikke Borup, CMO, CapaSystems · May 11, 2026 Most IT teams do not have a tool problem. They have too many of them. Patch management runs in one console. Driver updates happen in another. Privilege access goes through a third tool. Vulnerability monitoring lives somewhere else. Mobile devices require yet another platform. Each solution does its job — but together, they create fragmentation that slows IT operations, opens security gaps, and adds cost that is difficult to justify to leadership. Endpoint management consolidation addresses this directly. Instead of stitching together point solutions, IT teams unify all endpoint operations into a single platform. CapaOne replaces 4–5-point solutions — and IT teams recover the time, control, and clarity fragmented tooling takes away. ### Why Tool Sprawl Costs More Than It Saves Point solutions feel rational when you adopt them one at a time. A patch management tool fills one gap. A driver utility fills another. A privilege access solution addresses a compliance requirement. Each purchase looks reasonable in isolation. The problem emerges over time. Every additional tool brings its own agent, dashboard, vendor contract, and update cycle. IT teams spend more time managing tools than managing endpoints. Context-switching between consoles creates blind spots — and blind spots create risk. #### The Hidden Cost of Disconnected Tools Fragmented endpoint management creates three categories of cost that rarely appear in a vendor comparison: - Operational overhead: IT staff context-switch between four to six consoles daily. Every transition costs time and attention. Routine tasks that should take minutes take longer when the data is spread across different systems. - Security gaps: Point solutions do not share data with each other. A vulnerability detected in one tool does not automatically trigger remediation in another. Around 60% of data breaches involve known, unpatched vulnerabilities — not sophisticated zero-days. The gap between detection and action is where most incidents begin. - Compliance complexity: Auditors want a unified view of endpoint posture. When patch status, privilege access logs, and vulnerability data live in separate platforms, producing that view requires manual effort — and manual effort introduces error. These costs rarely appear as a single line item. They show up as IT team capacity constraints, extended incident response times, and compliance preparation that takes weeks instead of days. #### What Consolidation Looks Like in Practice When Vordingborg Køkkenet deployed CapaOne, the dashboard revealed more than 1,000 missing updates across their endpoint estate. Within days, that number was zero — and has remained there. That is what endpoint management consolidation delivers: not a plan, but an operational state. ### What Endpoint Management Consolidation Actually Looks Like Consolidation is about unifying capability. A consolidated endpoint management platform covers the same operational ground as multiple point solutions — patching, drivers, privilege access, vulnerability monitoring, mobile device management — but delivers it through a single agent, a single console, and a single operational model. The difference in practice is significant. IT teams stop managing integrations and start managing endpoints. Workflows that previously required three tools and two handoffs are now complete in one place. Reporting that previously required data exports from multiple systems becomes a single dashboard view. #### The Operations That Belong on One Platform A unified endpoint management platform handles the full operational scope that mid-market IT teams need: - Application Manager: Automate third-party software updates, package business applications, and deploy with staged rollouts — without scripting. - Privilege Manager: Enforce least privilege across all endpoints. Deliver just-in-time elevation for users who need temporary access. Log every action for audit evidence. - Security Monitor: Surface configuration drift and known vulnerabilities are continuously monitored. Prioritize remediation by severity and blast radius. Export compliance evidence on demand. - Experience Monitor: Monitor endpoint reliability and performance in real time. Identify issues before users report them. Reduce repeat helpdesk incidents. - Provision Manager: Deploy operating systems to bare-metal devices and maintain vendor-certified, model-aware driver updates automatically. - Mobile Manager: Enroll, configure, and secure iOS, iPadOS, and Android devices at scale. Enforce compliance policies. Automate app delivery, and manage OS updates over Legacy MDM and DDM. When these operations run through a single platform, the coordination overhead disappears. A vulnerability discovered by Security Monitor triggers an automated remediation workflow through Application Manager. A new device automatically enrolls and inherits the baseline configuration. ### How CapaOne Delivers Endpoint Management Consolidation CapaOne Endpoint Management Platform unifies all these operations into a single cloud-native solution, built in Denmark and hosted in Europe. IT teams deploy a single agent across endpoints, manage everything from one console, and automate workflows that previously required multiple tools and manual coordination. The platform works as a complete standalone solution for organizations that do not run Microsoft Intune. For organizations that do, CapaOne adds the capabilities Intune does not natively cover: automated third-party application patching, vendor-certified driver management, just-in-time privilege elevation, and exportable compliance evidence. #### From Multiple Vendors to One Platform - Separate patch management tools — replaced by Application Manager, which automates third-party updates and custom application deployment from a single console. - Driver management utilities from hardware vendors — replaced by automated, model-aware driver updates requiring no manual research or download. - Standalone privilege access tools — replaced by Privilege Manager, which enforces least privilege and delivers just-in-time elevation with full audit logging. - Disconnected vulnerability scanners — replaced by Security Monitor, which surfaces CVEs, configuration drift, and compliance gaps with prioritized remediation queues. - Standalone reliability monitoring tools — replaced by Experience Monitor, which scores endpoint stability from critical events, errors, and warnings before users report issues. - Standalone MDM solutions — replaced by Mobile Manager, which handles iOS, iPadOS, and Android in the same console as Windows endpoints. IT teams that consolidate onto CapaOne stop spending time on tool coordination and start spending it on endpoint control. Patch cycles run automatically. Compliance reporting is generated from a single dashboard. Privilege escalation resolves through a self-service workflow with full audit evidence. Book a demo of CapaOne Endpoint Management Platform to see how consolidation works in practice — or start a free trial and explore the platform hands-on. ### Frequently Asked Questions **What Is Endpoint Management Consolidation?** Endpoint management consolidation involves replacing multiple, separate IT tools for patching, driver management, privilege management, vulnerability monitoring, and mobile devices with a single integrated platform. Instead of managing five or six-point solutions with separate dashboards, contracts, and workflows, IT teams operate in a single unified environment. **How Many Tools Does the Average IT Team Use for Endpoint Management?** Most mid-market IT teams run four to six separate tools for endpoint management: a patch management solution, a driver management utility, a privilege access tool, a vulnerability scanner, a mobile device management platform, and sometimes a separate monitoring tool. Each adds cost, complexity, and integration overhead. **Does Endpoint Management Consolidation Work With Microsoft Intune?** Yes. CapaOne integrates with Microsoft Intune and extends it with capabilities Intune does not natively cover. Organizations without Intune can run CapaOne as a complete standalone endpoint management platform. **What Are the Business Benefits of Consolidating Endpoint Tools?** Consolidating endpoint management tools reduces total cost of ownership, closes security gaps between disconnected tools, and reduces operational burden. IT teams spend less time context-switching between consoles and more time on work that moves the business forward. **How Quickly Can an IT Team Consolidate With CapaOne?** Most IT teams deploy CapaOne within days. The platform is cloud-native, requires no on-premises servers, and uses a single agent across endpoints. No scripting required. Inventory, vulnerability visibility, and automation workflows are available from day one. Written by Rikke Borup CMO, CapaSystems Rikke is Chief Marketing Officer at CapaSystems, where she has led marketing and communications since 2009. With more than 17 years of experience in the IT sector — including cybersecurity, endpoint management software and IT services — she brings long-standing, practical insight into the challenges facing modern enterprise IT environments. Trained as a journalist, Rikke specializes in translating complex technical concepts into clear, easy-to-understand communications for IT decision-makers. More from Rikke Borup → LinkedIn ↗ Book a Demo → --- URL: https://capaone.com/blog/ransomware-preparedness-it-management/ Published: 2026-05-04 Summary: Reducing the ransomware attack surface starts with endpoint management. Real cases from CapaSystems User Group — and how CapaOne helps. ← All articles Blog ## The Ransomware Attack Surface IT Managers Can’t Ignore Real cases from CapaSystems User Group - Skanderborg, Wednesday 29 April 2026 By Rikke Borup, CMO, CapaSystems · May 4, 2026 At CapaSystems User Group in Skanderborg on Wednesday, 29 April, Christian Ranum Spohr from Eagle Shark walked a room full of IT professionals through two real ransomware cases. No hypotheticals. No vendor slides. Just the decisions that had to be made under pressure — and what they cost. The cases were anonymized. The lessons were not. And for IT managers responsible for endpoint management and ransomware attack surface reduction, the lessons are directly operational. ### What a Real Ransomware Attack Looks Like for IT Management The first case involved a software company serving the hospitality industry. Seven servers. All fully encrypted. Email down. Phone lines were overwhelmed by customers who depended on the software to run their daily operations. The owner had 72 hours to decide whether the company would survive. Christian Ranum Spohr described the moment clearly: this was not just an IT incident. It was a full organizational crisis — with simultaneous pressure from customers, employees, the press, the Data Protection Authority, and the police. And at the center of it, one person who had to make a call without complete information, without a clear playbook, and without knowing when it would end. ### The Three Options on the Table IT managers in that situation face three paths — and none of them are good. Pay the ransom. The fastest route back to operations, statistically speaking. But it requires navigating cryptocurrency transactions, trusting criminals to deliver decryption keys, and accepting the ethical and potential legal implications. Rebuild from scratch. In this case, specialists estimated recovery at approximately one million kroner per server — with no guarantee of full recovery — and a timeline of 12 to 24 months to restore full operations. For a company whose customers depend on the software to run their business, that is not a viable path. Close the company. A real option when the financial exposure — ransom, recovery costs, legal liability, customer compensation — exceeds what the organization can absorb. The company paid. It took close to a month to fully decrypt the files due to multiple layers of encryption. They survived. ### The Decision Framework IT Managers Need Before the Attack Christian Ranum Spohr made a point that resonated across the room: most organizations are not slow because they lack technical competence. They are slow because they have not defined who decides what, when, and under what authority. When an attack hits at 11 PM on a Friday, the question is not just technical. It is organizational. Who has the authority to isolate systems without escalating to the board? Who communicates with customers? Who contacts legal counsel? Who handles the Data Protection Authority notification, which NIS2 mandates within 24 hours for significant incidents? Without those decisions pre-made, the first hours of a crisis consume the time that should go toward containment. The single most valuable action an IT manager can take before an attack is to define that decision tree. Not a 28-page policy document — a clear, actionable framework that answers the five questions that matter most when everything is on fire. ### Reducing the Ransomware Attack Surface Through Endpoint Management The ransomware cases Christian Ranum Spohr presented shared a common thread: attackers had been inside the environment for weeks or months before triggering the encryption. They mapped the infrastructure. They identified the backup systems. They waited. That dwell time is not inevitable. It exists because organizations have unpatched applications, unmonitored privilege escalation, and insufficient visibility into endpoint behavior. Endpoint management is not a reactive discipline. It operates in the space where security tooling ends and endpoint operations begin — closing exposure before it becomes an entry point, not just alerting once it already has. IT managers who consolidate their endpoint operations — patching, privilege control, and vulnerability visibility — onto a single platform reduce the attack surface ransomware relies on. They also reduce dwell time because anomalies become visible faster when all endpoint data flows through a single location. CapaOne Endpoint Management Platform provides IT managers with a consolidated view. It works alongside Microsoft Intune or as a standalone platform — and it addresses the specific gaps that ransomware exploits most: unpatched third-party applications, standing local admin rights, and blind spots in vulnerability exposure across the estate. The best crisis management decision an IT manager can make is the one that prevents the crisis from ever escalating to a board-level emergency in the first place. And if the worst happens, CapaOne stands ready to support endpoint recovery within 10 minutes — for any organization. Want to see how a consolidated endpoint view narrows the attack surface on your own estate? Book a demo of CapaOne Endpoint Management Platform. ### Frequently Asked Questions **What Should IT Managers Do First When a Ransomware Attack Hits?** Isolate affected systems immediately to stop the spread — even without full information. Activate your crisis communication plan and notify relevant stakeholders. Document everything from the first moment. The speed of containment in the first hours determines the scope of the damage. CapaOne supports endpoint recovery within 10 minutes — so IT managers have a concrete path back to operations from the moment an attack is confirmed. **Should Organizations Pay a Ransomware Demand?** There is no universal answer. Payment is statistically the fastest route back to operations, and the criminals have a professional incentive to deliver decryption keys. But the decision depends on the organization’s financial position, legal exposure, the nature of the data, and whether recovery is feasible without payment. The decision requires input from IT, legal, finance, and senior leadership — and IT managers should discuss it before an attack occurs. **How Does Endpoint Management Reduce the Ransomware Attack Surface?** Ransomware exploits specific weaknesses: unpatched applications, excessive local admin rights, and poor visibility into endpoint behavior. Organizations that patch consistently, enforce least-privilege access, and maintain real-time visibility across their endpoint estate give attackers significantly less to work with — and enable earlier detection of intrusions when they do occur. **What Is the Role of Endpoint Management in Ransomware Prevention and Recovery?** Endpoint management platforms that consolidate patching, privilege control, and vulnerability visibility reduce the attack surface that ransomware depends on. A unified platform also reduces dwell time — the period between initial compromise and the moment the attacker triggers encryption — because anomalies become detectable faster when all endpoint data flows through a single view. And if an attack does succeed, CapaOne supports endpoint recovery within 10 minutes for any organization — reducing downtime and limiting the operational impact of an incident. Written by Rikke Borup CMO, CapaSystems Rikke is Chief Marketing Officer at CapaSystems, where she has led marketing and communications since 2009. With more than 17 years of experience in the IT sector — including cybersecurity, endpoint management software and IT services — she brings long-standing, practical insight into the challenges facing modern enterprise IT environments. Trained as a journalist, Rikke specializes in translating complex technical concepts into clear, easy-to-understand communications for IT decision-makers. More from Rikke Borup → LinkedIn ↗ Book a Demo → --- URL: https://capaone.com/blog/meet-the-capaone-team-at-v2-security-2026-endpoint-management-stand-b-188/ Published: 2026-05-01 Summary: Meet the CapaOne team at V2 Security 2026 in Copenhagen. See endpoint management that consolidates your stack — book a time at our stand. ← All articles Events ## Meet the CapaOne Team at V2 Security 2026 — Endpoint Management, Stand B-188 V2 Security is Scandinavia’s leading security conference. We’ll be there on May 6–7 at Bella Center Copenhagen. If you’re attending and endpoint management is on your agenda, here’s what to expect when you stop by — and how to make the most of it. By Rikke Borup, CMO, CapaSystems · May 1, 2026 V2 Security brings together IT and security professionals from across the Nordics for two days of focused industry conversations. It’s where the people actually running IT environments show up — and it’s the right place to have a real conversation about what’s working and what isn’t. You’ll find the CapaOne team at Bella Center Copenhagen, Center Boulevard 5, 2300 Copenhagen S — stand B-188. We’ll be there throughout both days. If endpoint management is on your agenda — whether you’re looking to consolidate tools, reduce manual work, or get a clearer picture of your security and compliance posture — we’d like to talk. If you’re not sure where to start, we’ve written a short piece on why tool sprawl in endpoint management keeps growing — and what IT teams are doing about it. ### What a Session With Us Actually Looks Like You choose what’s most useful. We’ll make either work. If you want to see CapaOne in action, we’ll run a focused endpoint management demo: how endpoint operations come together in one place, how patching, driver management, privilege control, and compliance reporting work in practice, and what it looks like to replace 4–6 point solutions with a single operational layer. If you’d rather start with a conversation, we’ll ask about your environment: how many tools you’re running, where the manual work still lives, how you’re handling compliance documentation, and whether your current setup gives you the visibility you actually need. No slides, no pitch — just 20 minutes and an honest look at your stack. Either way, you leave with a clearer picture of your environment and where the friction is. ### Who We’re Looking Forward to Meeting We work with IT teams at organizations typically running between 250 and 1,000 endpoints. If any of the following sounds familiar, it’s worth stopping by: You’re an IT administrator managing day-to-day endpoint operations across multiple tools You’re an IT manager or head of IT looking to consolidate tools and reduce operational overhead You’re a CIO or security lead focused on compliance, sovereignty, and reducing risk If endpoint complexity is something your team is dealing with right now — regardless of title — come find us. ### Reserve a Time in Advance If you want a more focused session, reach out before the event to reserve a dedicated slot at stand B-188. Tell us whether you’d like an endpoint management demo or a more open conversation about your setup — and we’ll prepare for your specific environment. Reserve a demo or a technical conversation at our booth Or simply stop by stand B-188 — the CapaOne team will be there throughout both days. Written by Rikke Borup CMO, CapaSystems Rikke is Chief Marketing Officer at CapaSystems, where she has led marketing and communications since 2009. With more than 17 years of experience in the IT sector — including cybersecurity, endpoint management software and IT services — she brings long-standing, practical insight into the challenges facing modern enterprise IT environments. Trained as a journalist, Rikke specializes in translating complex technical concepts into clear, easy-to-understand communications for IT decision-makers. More from Rikke Borup → LinkedIn ↗ Book a Demo → --- URL: https://capaone.com/blog/intune-third-party-patch-gap/ Published: 2026-04-29 Summary: Intune patches Windows — not Chrome, Adobe, Java or Zoom. Here is why the third-party patch gap persists and how CapaOne closes it. ← All articles Blog ## The Intune Patch Gap: Why Third-Party Applications Stay Unpatched Intune patches Windows — but not the applications attackers target most. By Rikke Borup, CMO, CapaSystems · April 29, 2026 Intune is a mature, capable platform. For organizations running Microsoft 365, it is the natural foundation for endpoint management — handling enrollment, compliance policies, configuration profiles, and Windows updates with reliable consistency. But there is a gap that Intune does not close. And it is one of the most exploited attack surfaces in modern enterprise environments: third-party application patching. This Intune third-party application patching gap is not a configuration issue — it is an architectural boundary. ### Understanding the Intune Patch Gap for Third-Party Applications Intune manages Windows updates through Windows Update for Business. It handles Microsoft applications through its native tooling. What it does not provide, out of the box, is an automated catalog for third-party applications — the browsers, runtimes, productivity tools, and security utilities that make up the majority of software on most endpoints. Applications like Chrome, Adobe Reader, Java, Zoom, and 7-Zip are common targets for attackers precisely because they are widely deployed and frequently outdated. An unpatched Java installation or an aging version of Adobe Reader is not an edge case — it is the reality in most enterprise environments that rely on Intune alone for patch management. Without a third-party patching solution, IT teams face three options: manual packaging and deployment for every update, a separate point solution that adds another tool to manage, or accepting the exposure gap and hoping it does not become an incident. #### Why This Matters More Than Most IT Teams Realize The impact of the third-party patch gap compounds over time. Version drift builds quietly. Applications that missed one update cycle miss the next. Devices that were not online during a deployment window fall behind and stay behind. Without continuous visibility into application versions across the estate, IT teams lose the ability to answer a simple question with confidence: which endpoints are exposed right now? Chrome vulnerabilities being exploited in the wild increased 1,840% last year. Not Windows. Not Microsoft software. The applications on every endpoint — the ones Intune doesn’t patch. Source: Action1 Software Vulnerability Ratings Report 2025 This is not a failure of Intune. It is a deliberate architectural boundary. Intune is designed to manage the Microsoft ecosystem. Third-party application coverage was never its primary purpose. ### Closing the Intune Patch Gap With Application Manager Application Manager adds what Intune does not include: an automated catalog of third-party applications, staged deployment, no-code packaging for business applications, and real-time visibility into update posture across every endpoint. It runs alongside Intune — not instead of it. While Intune handles enrollment, compliance, and configuration, Application Manager takes care of third-party patching — and it also runs on its own, without Intune. Application Manager targets the same Entra ID groups, honors the existing group structure, and delivers updates on a schedule set by IT teams. There is no parallel management layer, no additional agent complexity, and no steep learning curve. The result is a complete application update posture — Windows covered by Intune, third-party applications covered by Application Manager — without adding tool sprawl or operational overhead. ### The Operational Outcome of Closing the Gap IT teams that close the third-party patch gap consistently report fewer escalations caused by version mismatch, faster remediation when a new vulnerability is disclosed, and cleaner audit evidence when compliance reviews require proof of update posture. The gap is well-understood. The fix is straightforward. The question is how long to leave it open. Attackers do not need a new flaw when outdated software already offers a known one. ### How Does CapaOne Application Manager Work With Intune for Third-Party Patching? Application Manager adds automated third-party patching alongside Intune without replacing it. Teams without Intune run it on its own as a complete third-party patching solution. On an Intune-managed fleet, it targets the same Entra ID groups, honors existing group structure, and delivers updates on a schedule IT teams control. Application Manager closes the third-party application gap without adding tool sprawl or agent complexity. ### Frequently Asked Questions **What Is the Intune Patch Gap for Third-Party Applications?** The Intune patch gap for third-party applications refers to the lack of a native, automated update catalog in Intune for applications such as Chrome, Adobe Reader, Java, and Zoom. Intune manages Windows updates through Windows Update for Business and handles Microsoft applications natively — but leaves third-party patching to manual processes or separate tools. This gap exposes endpoints to known vulnerabilities in the applications that attackers target most. **Why Does Version Drift Happen Even With Intune in Place?** Version drift occurs because Intune does not natively automate third-party application updates. Applications that miss one update cycle tend to fall further behind over time. Devices that are offline during a deployment window are not remediated automatically. Without continuous visibility into application versions across the estate, IT teams cannot reliably identify which endpoints are exposed at any given time. **How Does CapaOne Application Manager Work With Intune for Third-Party Patching?** Application Manager adds automated third-party patching alongside Intune without replacing it. It targets the same Entra ID groups, honors existing group structure, and delivers updates on a schedule IT teams control — so the third-party gap closes without added tool sprawl. It also runs on its own, without Intune, as a complete third-party patching solution. **What Are the Operational Benefits of Closing the Third-Party Patch Gap?** IT teams that close the third-party patch gap report fewer escalations caused by version mismatch, faster remediation when new vulnerabilities are disclosed, and cleaner audit evidence when compliance reviews require proof of application update posture. Automated patching eliminates the manual effort of tracking, packaging, and deploying updates for each application across the estate. **Is Microsoft Intune Enough for Patch Management?** Intune covers Windows updates and Microsoft applications well, but it does not natively patch the third-party applications that make up most software on an endpoint — browsers, runtimes, and productivity tools such as Chrome, Adobe Reader, Java, and Zoom. For complete patch management, organizations need to close that third-party gap. CapaOne Application Manager adds an automated third-party application catalog alongside Intune, so Windows and third-party applications are kept current through a single workflow. Organizations without Intune run Application Manager on its own for the same coverage. Written by Rikke Borup CMO, CapaSystems Rikke is Chief Marketing Officer at CapaSystems, where she has led marketing and communications since 2009. With more than 17 years of experience in the IT sector — including cybersecurity, endpoint management software and IT services — she brings long-standing, practical insight into the challenges facing modern enterprise IT environments. Trained as a journalist, Rikke specializes in translating complex technical concepts into clear, easy-to-understand communications for IT decision-makers. More from Rikke Borup → LinkedIn ↗ Book a Demo → --- URL: https://capaone.com/blog/endpoint-provisioning-capaone-provision-manager/ Published: 2026-04-28 Summary: CapaOne Provision Manager delivers cloud-native endpoint provisioning — OS deployment, driver orchestration and recovery, no on-prem servers. ← All articles Blog ## Endpoint Provisioning Without On-Prem Infrastructure CapaOne Provision Manager is now available. Cloud-native OS deployment, integrated driver orchestration, and device recovery — no on-prem infrastructure required. By Rikke Borup, CMO, CapaSystems · April 28, 2026 Legacy deployment infrastructure was never built for how IT teams operate today. Imaging servers, fragmented driver packs, PXE dependencies — the tools that worked in an on-premise world create operational drag in a distributed one. And with Microsoft retiring MDT without an official replacement, the gap at the foundation of endpoint management is no longer a future problem. CapaOne Provision Manager is now generally available — built to replace that infrastructure without reintroducing its complexity. With this release, CapaOne Provision Manager establishes a fully cloud-native foundation for OS deployment, device recovery, and integrated driver orchestration — production-ready and designed for organizations moving beyond legacy deployment infrastructure. Provision Manager brings bare-metal deployment, recovery workflows, and driver management together in one consolidated product — built for operational simplicity without compromising control. ### What Is Included in CapaOne Provision Manager CapaOne Provision Manager delivers a complete foundation for modern device deployment: - Bare-metal OS provisioning for new or wiped devices - Cloud-based recovery workflows for unstable or compromised endpoints - Integrated driver orchestration, built into the provisioning workflow - A unified provisioning workflow within the CapaOne platform With Provision Manager, deployment no longer depends on maintaining local imaging servers, fragmented driver packs, or separate management consoles. ### Driver Manager Is Now Integrated Into Provision Manager As part of General Availability, Driver Manager is fully integrated into CapaOne Provision Manager. Driver handling is no longer managed separately. Instead, manufacturer-aligned drivers are applied as part of the provisioning workflow itself — ensuring devices are stable from the moment they boot. For IT managers, this integration simplifies operations: - One workflow instead of parallel processes - One operational responsibility instead of fragmented tooling - One foundation layer across the entire fleet This is more than a UI adjustment. It is structural consolidation within the CapaOne platform. ### What CapaOne Provision Manager Changes Operationally CapaOne Provision Manager is designed to remove friction at the foundation level of endpoint management. Organizations currently relying on legacy deployment infrastructure can use Provision Manager to: - Decommission on-prem imaging servers - Eliminate manual driver maintenance cycles - Standardize deployments across multi-vendor hardware fleets - Accelerate onboarding for new hires, regardless of location - Strengthen recovery capabilities for distributed devices Provision Manager transforms deployment from a fragile dependency into a predictable, scalable service layer. For IT leadership, this shift creates operational clarity. Senior engineers can focus on higher-value initiatives instead of maintaining imaging utilities. Deployment becomes aligned with a cloud-first operating model. ### Who Should Evaluate Provision Manager Now CapaOne Provision Manager is particularly relevant for organizations that: - Are replacing MDT — Microsoft retired it in late 2025 without an official replacement, leaving a bare-metal deployment gap that Intune and Autopilot do not fill - Are preparing for Windows 11 migrations - Support remote or hybrid workforces - Want to consolidate endpoint tooling within a unified platform - Need a more resilient device recovery model If deployment remains the last on-prem anchor in your environment, Provision Manager is designed to replace it. ### Built for Modern Microsoft Environments CapaOne Provision Manager establishes the foundation that modern endpoint management requires — bare-metal deployment, driver orchestration, and device recovery, all without on-premise infrastructure. For organizations running Microsoft Intune, Provision Manager delivers the layer that comes before configuration and policy enforcement begin. Together, they cover the full device lifecycle: from bare metal to user-ready endpoint. With General Availability, Provision Manager is available as part of the CapaOne Endpoint Management Platform and ready for production environments. Book a demo of CapaOne Endpoint Management Platform. ### Frequently Asked Questions **What Is Endpoint Provisioning?** Endpoint provisioning takes a device from bare hardware to a fully configured, ready-to-work state — installing the operating system, drivers, and initial setup. It comes before device management: Intune can only configure and manage a device that already runs an OS. **What Is Bare-Metal Provisioning, and When Do I Need It?** Bare-metal provisioning installs an operating system onto a device that has none — a new machine, a wiped device, or one recovered after failure or malware. Provision Manager does this over the cloud using only an internet connection, with no local imaging server or PXE infrastructure. **How Are Drivers Handled During Provisioning?** Provision Manager installs manufacturer-certified driver packs automatically during deployment, matched to each hardware model. This removes manual driver research and packaging, and it keeps drivers consistent across the estate. Driver orchestration is built into provisioning rather than handled as a separate tool. **Can I Provision Devices Without Traditional Imaging?** Yes. Provision Manager uses a single hardware-independent OS image delivered from the cloud, so teams avoid maintaining a library of per-model images and on-premise deployment servers. A device boots, connects over the internet, and receives a clean OS with the correct drivers already installed. Written by Rikke Borup CMO, CapaSystems Rikke is Chief Marketing Officer at CapaSystems, where she has led marketing and communications since 2009. With more than 17 years of experience in the IT sector — including cybersecurity, endpoint management software and IT services — she brings long-standing, practical insight into the challenges facing modern enterprise IT environments. Trained as a journalist, Rikke specializes in translating complex technical concepts into clear, easy-to-understand communications for IT decision-makers. More from Rikke Borup → LinkedIn ↗ Book a Demo → --- URL: https://capaone.com/blog/windows-deployment-after-mdt/ Published: 2026-04-28 Summary: Windows deployment after MDT: MDT is retired and Intune won't fill the gap. Here's what MDT actually covered — and how to close it. ← All whitepapers Guide ## Windows Deployment After MDT Why Intune and Autopilot don’t close the post-MDT deployment gap — and what actually does By Rikke Borup, CMO, CapaSystems · April 28, 2026 ### Introduction to the Guide In January 2026, Microsoft retired the Microsoft Deployment Toolkit without a migration guide and without an official replacement. For IT teams that relied on MDT as the foundation of their Windows deployment workflow, the message was clear: figure it out yourself. The reason MDT was retired matters. Security researchers identified vulnerabilities that allow extraction of privileged Active Directory credentials directly from MDT deployment shares. Those vulnerabilities will not be patched. Every day MDT remains in a deployment workflow, the risk remains open. At the same time, many IT teams have assumed that Intune and Autopilot fill the gap MDT left behind. They do not. This guide explains what MDT actually covered, why the post-MDT deployment gap is still real, what the options are for closing it, and how to choose the right path depending on where your organization is starting from. ### What You Will Learn - Why organizations still running MDT are exposed to a documented, unpatched security risk - What Intune and Autopilot can and cannot do at the deployment layer — and where their dependency on a working OS creates a gap - The four device scenarios that require bare-metal capability in any modern IT environment - How to evaluate your replacement options and what each involves in terms of infrastructure, maintenance, and cost - What cloud-native provisioning looks like in practice — and why it eliminates the infrastructure model that made MDT a liability ### Frequently Asked Questions #### What Replaces Microsoft Deployment Toolkit? Cloud-based provisioning platforms are the most complete replacement. They handle bare-metal OS deployment, driver orchestration, and remote recovery without requiring on-premise infrastructure. Intune and Autopilot handle device management and configuration, but do not replace MDT’s deployment capabilities. #### Can Intune Replace MDT? No. Intune requires a device to already be running Windows. It handles configuration, policy enforcement, application deployment, and patch management — but it cannot deploy Windows to a bare-metal device or recover a device that cannot boot. #### Does Autopilot Deploy Windows? No. Autopilot requires an existing, functioning OS. A device with a corrupted or missing OS cannot be enrolled through Autopilot without first being provisioned by a separate tool. #### Does Provision Manager Require Microsoft Intune? No. Provision Manager works as a standalone provisioning solution. For organizations running Intune, it provides the bare-metal OS foundation that Autopilot requires — creating a complete zero-touch experience from bare-metal boot to daily endpoint use. #### How Quickly Can Provision Manager Be Configured? The first deployment template can be configured in under one hour. There are no servers to install, no images to build, and no PXE infrastructure to configure. #### How Does Provision Manager Work With Intune? Provision Manager provides the bare-metal OS foundation required for Microsoft Autopilot. Once a device is provisioned, it hands off cleanly to Autopilot and Intune for enrollment, configuration, and ongoing management. #### What Hardware Is Supported? Provision Manager automatically identifies hardware models and applies manufacturer-certified driver packs for Dell, HP, Lenovo, and Microsoft devices. A single, hardware-independent OS image works across all supported device models. --- URL: https://capaone.com/blog/the-sovereignty-gap-starts-at-your-endpoints/ Published: 2026-04-23 Summary: Sovereignty starts at the endpoint. See why EU-hosted endpoint management matters — and how CapaOne keeps your data under European control. ← All articles Blog ## The Sovereignty Gap Starts at Your Endpoints The sovereignty gap starts at your endpoints — and most IT teams haven't looked there yet. By Rikke Borup, CMO, CapaSystems · April 23, 2026 On 14 April 2026, the Free ICT Europe Foundation published a policy paper with a pointed argument: European organizations technically own their digital infrastructure — but many lack real control over it. The foundation called this the “ sovereignty gap” — and called on the EU to formally recognize the risk embedded in European IT dependencies. The timing is not a coincidence. All 27 EU member states signed a declaration on digital sovereignty in November 2025. The European Commission proposed targeted amendments to NIS2 in January 2026. And speaking at Denmark’s OffDig conference in March, former Microsoft executive Casper Klynge said plainly what many IT leaders have been thinking privately: the Cloud Act and FISA are now more pressing concerns than GDPR — and European organizations can only trust their American technology vendors to some extent. Not all of the way. For most organizations, the sovereignty conversation starts with cloud infrastructure and productivity platforms. That is understandable. But there is a blind spot in most sovereignty strategies: endpoint management. ### Endpoints Are Where the Data Is Every managed device in your organization generates operational telemetry. Patch status. Application inventory. Driver versions. Vulnerability exposure. Privilege elevation events. Configuration drift. That data is processed through your endpoint management platform — and it flows under the jurisdiction of whoever owns and operates that platform. Amazon, Microsoft, and Google control more than 70% of the European cloud market, while European providers hold under 15% — down from 29% in 2017, according to Synergy Research Group. Endpoint management platforms sit inside that same dependency structure. Source: Synergy Research Group, reported by CNBC, 13 February 2026 — cnbc.com/2026/02/13/four-charts-europes-reliance-us-digital-infrastructure.html The Cloud Act gives US authorities access to data held by US companies, regardless of where it is physically stored. Microsoft admitted in a French court that it could not guarantee data sovereignty for European customers in the event of a US legal injunction. That is not a future risk. It is a present one. ### What European Endpoint Management Actually Means Shifting to a European endpoint management platform is not about removing American technology from the stack. Most organizations will continue to rely on Microsoft 365, Entra ID, and Intune as core infrastructure — and they should. These are mature, capable platforms. The question is what sits alongside them. A European-built, EU-hosted endpoint management platform provides IT teams with three things that US-based alternatives cannot reliably deliver. Clear data residency: operational telemetry remains within the EU, processed under European law. Predictable regulatory alignment: GDPR compliance is architectural, not a configuration option, and NIS2-aligned operations are built into the platform. Documented governance: sub-processor registers, data processing agreements, and audit-ready evidence are available without chasing a vendor headquartered four time zones away. For IT managers preparing for compliance audits, cybersecurity assessments, or internal board reviews, this level of clarity has real operational value. ### The Microsoft Question A common concern is whether a shift toward European endpoint management requires dismantling an existing Microsoft investment. It does not. The most effective approach for most organizations is additive. CapaOne is designed to strengthen Microsoft Intune — not replace it. Organizations that do not run Intune can adopt CapaOne as a complete, standalone endpoint management platform. CapaOne covers what Intune does not: automated third-party application updates, vendor-certified driver management, just-in-time privilege elevation, vulnerability visibility, and exportable compliance evidence. Intune handles policy management, enrollment, and identity. ### Where to Start The sovereignty gap identified in this week’s policy paper is not abstract. It is a set of concrete decisions about procurement, architecture, and long-term risk. For IT teams, the most immediate and actionable step is to evaluate where endpoint management sits in the current stack. Who builds it? Where it is hosted. Whose legal framework governs the data it processes. These are questions with answers. And the answers have consequences. CapaOne Endpoint Management Platform is built in Denmark, hosted in the EU, and designed for organizations that require modern endpoint operations without US jurisdictional exposure. It is GDPR-first by architecture, NIS2-aligned in operation, and built to support European data sovereignty — while working alongside Microsoft Intune or standing alone as a complete endpoint management platform. ### Have More Questions? ### What Is the Sovereignty Gap in Endpoint Management? The sovereignty gap refers to the difference between technically owning your IT infrastructure and controlling it. In endpoint management, this gap emerges when the platform processing your device telemetry — patch status, application inventory, privilege events — is owned and operated by a company subject to US law. The Cloud Act and FISA can compel US-based vendors to provide data to US authorities regardless of where that data is physically stored. Most organizations focus their sovereignty strategy on cloud infrastructure and productivity tools, leaving endpoint management as an unexamined dependency. ### Does Microsoft Intune Meet EU Data Sovereignty Requirements? Microsoft Intune is hosted and operated by a US company, which means it is subject to the US Cloud Act and FISA regardless of data residency choices. Microsoft has acknowledged in a French court proceeding that it cannot guarantee European customers’ data would never be accessible to US authorities under a legally valid injunction. For organizations in regulated sectors or those subject to NIS2, this creates a compliance risk that data residency alone does not resolve. Many European organizations address this by adding a European-built endpoint management platform alongside Intune that processes operational telemetry under EU jurisdiction. ### What Makes CapaOne a Sovereign Endpoint Management Platform? CapaOne is developed in Denmark and hosted in the EU, with all endpoint telemetry processed under European law. It operates under a documented Data Processing Agreement, maintains full sub-processor transparency, and is designed to be GDPR-first by architecture — not by configuration. CapaOne is NIS2-aligned in operation, providing vulnerability visibility, audit-ready evidence, and least-privilege enforcement through just-in-time privilege elevation. It works alongside Microsoft Intune or as a standalone platform, giving European IT teams endpoint control without US jurisdictional exposure. Learn more about CapaOne’s European sovereignty posture → ### How Does the Cloud Act Affect European Endpoint Management Decisions? The US Cloud Act (2018) empowers US law enforcement to compel any US-based company to produce data stored anywhere globally — regardless of the data’s physical location or the customer’s nationality. For European IT teams, this means that an endpoint management platform operated by a US company can be compelled to share your device telemetry with US authorities, even if that data is stored in an EU data center. This risk is structural and cannot be resolved through data residency alone. It requires choosing a vendor that is not subject to US extraterritorial law. ### Frequently Asked Questions **What Is a Digital Sovereignty Gap?** A digital sovereignty gap is the distance between where an organization believes its data sits and whose legal authority actually governs it. It opens when tools processing sensitive data run under foreign jurisdiction — so control can shift through legal orders or policy changes the organization never agreed to. **Why Do Endpoints Specifically Create a Sovereignty Risk?** Unlike a document store you can locate once, endpoint management generates sensitive telemetry continuously — exposure signals, privilege events, configuration state, and more. That constant operational flow to a platform under foreign jurisdiction makes endpoints an ongoing sovereignty exposure, not a one-time policy question. **Can You Close the Sovereignty Gap Without Removing Microsoft From Your Stack?** Yes. Moving endpoint operations to an EU-hosted platform does not mean removing Microsoft. Intune can keep handling policy, enrollment, and configuration baselines, while CapaOne processes the operational telemetry under EU jurisdiction — standalone, or alongside the Microsoft tools already in place. **What Should a European IT Team Check to Close the Gap?** Three questions decide it: who builds the endpoint platform, where it hosts the data, and whose legal framework governs that data. If the answers point outside the EU, the gap is open. CapaOne answers all three within European jurisdiction. Written by Rikke Borup CMO, CapaSystems Rikke is Chief Marketing Officer at CapaSystems, where she has led marketing and communications since 2009. With more than 17 years of experience in the IT sector — including cybersecurity, endpoint management software and IT services — she brings long-standing, practical insight into the challenges facing modern enterprise IT environments. Trained as a journalist, Rikke specializes in translating complex technical concepts into clear, easy-to-understand communications for IT decision-makers. More from Rikke Borup → LinkedIn ↗ Book a Demo → --- URL: https://capaone.com/blog/patch-management-outdated-software-security-risk/ Published: 2026-04-17 Summary: Poor patch management leaves endpoints exposed. See how CapaOne closes security gaps and keeps applications current — automatically, no toil. ← All articles Blog ## Patch Management: Stop Outdated Software Before It Stops You More than half of organizations run endpoints on outdated software. The problem is not awareness — it is the absence of automated, consistent patch management across applications, drivers, and mobile devices. By Rikke Borup, CMO, CapaSystems · April 17, 2026 A recent security report found that more than half of organizations worldwide run devices with outdated operating systems. 95 percent of analyzed applications contain at least one security weakness. And in one out of four organizations, employees have clicked on malicious links. None of this is new. IT teams have been dealing with these challenges for years — and yet they persist. Not because IT professionals lack awareness. But because the processes meant to keep endpoints current still depend on manual effort, scripts, and fragmented tools. And those approaches do not scale: a script patches what someone remembered to write it for, and the endpoint patch compliance gap opens everywhere else. ### The Problem Is Not Awareness — It Is Control Most IT teams know that outdated software is a risk. The gap is not knowledge. It is execution. Consider a typical scenario: you manage hundreds of endpoints. Every application has its own release cadence. Some patches are critical and need to be out within hours. Others are routine but cannot disrupt production. And then there are drivers and firmware sitting on outdated versions — because nothing in your current stack handles them automatically. The result is version drift. Devices run different software. Some endpoints received the patch. Others did not. And you cannot say with certainty which ones. That is where attackers find their way in. ### The Cost of Fragmented Patch Management Processes Many IT teams rely on one solution for OS patching, another for third-party applications, a third for drivers, and PowerShell scripts to hold it all together. This creates three concrete problems: Blind spots: When update status spans multiple systems, you lose a consolidated view. You cannot confidently identify which endpoints are exposed—or for how long. Operational overhead: Scripts need maintenance. Manual checks take time. And when an update fails silently, you find out later — often too late. Compliance gaps: You cannot document what you cannot see. When an auditor asks, an answer based on best estimates will not hold. Microsoft Intune covers a lot—but it does not handle third-party application updates, driver lifecycle management, or CVE prioritization across your entire endpoint estate. That is precisely where the gaps appear. ### How to Move From Reactive Patch Management to a Controlled Update Posture The solution does not require replacing your entire technology stack. It requires structure and automation in the right places. Full visibility as a foundation. At any point, you need to see which applications are running, which versions are installed, and which endpoints deviate from baseline. Without that starting point, patching is reactive — not controlled. That need turns urgent when the threat picture shifts, as Denmark’s higher threat level for destructive cyberattacks shows for endpoint teams. Automation across applications and drivers. Third-party applications should update automatically — not be manually repackaged with every new version. Drivers should stay current and model-specific, without your team spending hours researching vendor releases. Automation is not a nice-to-have. It is the only approach that scales, and how to automate Windows and app patching comes down to three principles: continuous discovery, staged rollouts, and risk-based prioritization. CVE context that prioritizes for you. Not all vulnerabilities carry equal urgency. You need a system that converts CVE data into a prioritized remediation queue — so your effort goes where it reduces exposure most effectively. Audit-ready documentation, always. Compliance is not a project you finish. It is a state you maintain. That requires the ability to export update status, version overviews, and remediation history on demand — without having to assemble them from three different systems. ### CapaOne Endpoint Management Platform: One Place for All of It CapaOne consolidates patch management, vulnerability management, and driver lifecycle management into a single platform. You get full visibility across your endpoint estate, automated updates for third-party applications, CVE-based risk views, and audit-ready documentation — from one interface. Application Manager automates updates for third-party and business applications — eliminating the manual repackaging cycle. Security Monitor delivers CVE-based vulnerability signals across OS, applications, and drivers, so you know exactly what is exposed. Closing that exposure is patch management’s job, not a security suite’s — security platforms and endpoint management platforms answer different questions. Provision Manager handles driver lifecycle automatically and model-specifically — no manual research, no outdated drivers. Mobile Manager unifies enrollment, configuration, and compliance across iOS, iPadOS, and Android — giving you the same visibility and control over mobile endpoints as across your Windows estate. The platform runs as cloud-native SaaS — no on-premises servers, no legacy agents. You are operational within days, not months. CapaOne is built in Denmark and hosted in Europe — fully aligned with GDPR and NIS2. Use it standalone, or run it alongside Microsoft Intune to automate the third-party patching a baseline deployment leaves manual. ### From Exposed to Current: What Changes in Practice IT teams that introduce automated endpoint patch management typically see: 30–50% reduction in CVE MTTR — from discovery to remediation Significant reduction in manual administration time on patch cycles Consistent version alignment across the endpoint estate Audit-ready documentation available on demand — no spreadsheets, no manual exports Compliance becomes the natural result of everyday IT operations Outdated software is not a problem solved by awareness. It is solved by structure — automation, visibility, and a single place to act from. The data confirms what many IT teams already feel on a daily basis: basic IT security lags behind, even when the fixes are straightforward. What is missing is not knowledge — it is an operational foundation that keeps patches current automatically, consistently, and with full documentation. Book a demo of CapaOne Endpoint Management Platform and see how you close your patch gaps — before someone else finds them. ### Frequently Asked Questions **Why Is Outdated Software Such a Common Breach Cause?** Attackers exploit known vulnerabilities far more often than novel ones. When a patch exists but has not reached every endpoint, the exposure stays open. Industry breach data consistently ties a large share of incidents to unpatched, publicly known flaws — making update coverage a frontline security control. **How Fast Should Endpoints Be Patched After a CVE Is Disclosed?** Speed should track risk. Known-exploited vulnerabilities warrant remediation within days, while lower-severity issues can follow a regular cycle. The practical constraint is coverage: automated patching across every endpoint closes the exposure window far faster and more reliably than manual, device-by-device updates. **Does Microsoft Intune Patch Third-Party Applications?** Intune manages operating system and Microsoft updates well, but comprehensive third-party application patching usually needs additional capability. CapaOne automates third-party updates across the estate as a complete platform on its own, or alongside Intune where teams already run it. **How Do I Prove Patch Compliance to an Auditor?** Auditors want evidence, not assurances. CapaOne records update status and history across endpoints and exports it as audit-ready reports, so teams can show which devices received which updates and when. This turns patch reporting from a manual spreadsheet exercise into a repeatable, exportable record. **What Is Patch Management?** Patch management is the process of identifying, prioritizing, deploying, and verifying software updates across all endpoints in an organization. It covers operating systems, third-party applications, and drivers. Effective patch management reduces the window of exposure between a vulnerability being discovered and it being remediated across your entire device estate. **Why Is Outdated Software a Security Risk?** Outdated software contains known vulnerabilities that attackers actively exploit. Once a CVE is published, threat actors begin scanning unpatched systems — often within hours. Organizations that rely on manual patching processes cannot keep pace with the volume and frequency of updates required, which means exposed endpoints remain exposed for days, weeks, or longer. **How Do I Automate Patch Management Across My Endpoints?** Automated patch management requires a platform that can discover installed software versions across all endpoints, identify outdated applications and drivers, deploy updates silently and on schedule, and verify successful installation. The key is eliminating manual steps — from repackaging third-party applications to research driver versions — so that updates happen consistently without depending on IT capacity. **Does Patch Management Work Without Microsoft Intune?** Yes. CapaOne Endpoint Management Platform operates fully standalone — no dependency on Microsoft Intune. For organizations that do use Intune, CapaOne adds what Intune does not cover natively: third-party application patching, driver lifecycle management, CVE-based vulnerability prioritization, and unified patch posture across Windows and mobile endpoints. **What Is the Difference Between Patch Management and Vulnerability Management?** Vulnerability management is the process of identifying and prioritizing security weaknesses across your environment — including misconfigurations, CVEs, and outdated components. Patch management is the operational execution of deploying fixes. The two are closely linked, but distinct. Without vulnerability context, patch management becomes reactive. Without patch management, vulnerability management produces findings with nowhere to act on them. **How Does Patch Management Support NIS2 and GDPR Compliance?** NIS2 requires organizations to implement appropriate technical measures to manage cybersecurity risk — and timely patching of software vulnerabilities is explicitly part of that. GDPR requires organizations to protect personal data through appropriate security measures, which includes keeping software current. A structured patch management solution with documented update status and remediation history provides the audit evidence both frameworks require. Written by Rikke Borup CMO, CapaSystems Rikke is Chief Marketing Officer at CapaSystems, where she has led marketing and communications since 2009. With more than 17 years of experience in the IT sector — including cybersecurity, endpoint management software and IT services — she brings long-standing, practical insight into the challenges facing modern enterprise IT environments. Trained as a journalist, Rikke specializes in translating complex technical concepts into clear, easy-to-understand communications for IT decision-makers. More from Rikke Borup → LinkedIn ↗ Book a Demo → --- URL: https://capaone.com/blog/capaone-user-group-april-2026/ Published: 2026-03-27 Summary: On April 29, CapaSystems brings together customers, experts, and the CapaOne team for a half-day professional program in Skanderborg, DK ← All articles Events ## When Security Is No Longer Optional — Join Us at the CapaSystems User Group The threat landscape has changed. Has your endpoint strategy kept up? By Rikke Borup, CMO, CapaSystems · March 27, 2026 The threat landscape is shifting faster than ever. On April 29, CapaSystems — the company behind CapaOne — invites all customers to a half-day program in Skanderborg, Denmark, featuring keynote speaker Christian Spohr from Eagle Shark, product updates, and real-world cases from everyday IT operations. ### IT Teams Can No Longer Manage Security Alone Ransomware. Compromised endpoints. Growing compliance requirements. IT teams today must navigate a threat landscape that is more complex than it was just two years ago — and they must do it with the resources they have. The answer is rarely more tools. It is better control over the endpoints you are already responsible for. And it requires practice — before something goes wrong. That is exactly what we are focusing on at the CapaSystems User Group on April 29 2026. ### What Is the CapaSystems User Group? The CapaSystems User Group is a bi-annual event for all CapaSystems customers — including organizations running CapaOne, which is developed and maintained by CapaSystems. A half-day program that brings together customers, experts, and the CapaSystems team for professional exchange, product updates, and honest conversations about what actually works in practice. No sales pitch. No empty slides. Just a strong professional community and a program designed to give you something to take back to work. ### The Program on April 29 The event runs from 10:00 to 15:00 at Hotel Skanderborghus in Skanderborg. - “The current IT threat landscape” — Christian Spohr, CEO & Founder, Eagle Shark - Product Roadmap — Martin Søndergaard, CEO, CapaSystems - “Apple iOS 27 is coming — what now?” — Joachim Hansen, Scrum Master & Agile Software Developer, CapaSystems - “Deployment Innovation: Cloud, Automation & Real-World Challenges” — Dennis Busk, Chief Services Officer, CapaSystems - Use case: A real customer story - “When ransomware strikes: Fast endpoint recovery” — Dennis Busk, Chief Services Officer, CapaSystems ### Meet Christian Spohr From Eagle Shark Christian Spohr is CEO and Founder of Eagle Shark — a Danish security and crisis management firm. With a background in the Danish Special Forces (Frømandskorpset), he works today with cybersecurity, threat assessment, and crisis preparedness for organizations across industries. At the CapaSystems User Group, Christian will share his perspective on the current threat landscape — and the role endpoint management plays when security matters more than ever. This is not a theoretical overview. It is an honest look at what is happening out there, and what IT teams should be prepared for. ### Are You a CapaSystems Customer? Then this event is for you. The CapaSystems User Group is reserved for existing customers, and places are limited. Registration is first-come, first-served. If you did not receive the invitation, contact us at cug@capasystems.com . Written by Rikke Borup CMO, CapaSystems Rikke is Chief Marketing Officer at CapaSystems, where she has led marketing and communications since 2009. With more than 17 years of experience in the IT sector — including cybersecurity, endpoint management software and IT services — she brings long-standing, practical insight into the challenges facing modern enterprise IT environments. Trained as a journalist, Rikke specializes in translating complex technical concepts into clear, easy-to-understand communications for IT decision-makers. More from Rikke Borup → LinkedIn ↗ Book a Demo → --- URL: https://capaone.com/blog/capasystems-user-group-2026/ Published: 2026-03-27 Summary: Meet fellow IT professionals at CapaSystems User Group 2026. Share knowledge, build your network, and explore the future of endpoint management. ← All articles Events ## CapaSystems User Group 2026 By Rikke Borup, CMO, CapaSystems · March 27, 2026 CapaSystems User Group is a bi-annual gathering for all CapaSystems customers. Over half a day, attendees connect with the CapaSystems team and peers, explore the product roadmap, and gain practical insights into endpoint management, security, and deployment — from real-world cases and expert perspectives. - Date: Wednesday, 29 April 2026, 10:00–15:00 - Venue: Hotel Skanderborghus, Dyrehaven 3, 8660 Skanderborg - Attend: Register to CapaSystems User Group ### Meet the Speakers at the Event The CapaSystems team will be at CapaSystems User Group 2026 to walk you through the latest product developments, share real-world deployment insights, and discuss how endpoint management is evolving in a security-first world. Christian Spohr CEO & Founder, Eagle Shark Christian Spohr brings a rare combination of operational experience and strategic insight to the topic of security. With a background from the Danish Navy Special Forces (Frømandskorpset), he now works with cybersecurity, crisis management, and threat preparedness for organizations across sectors. At User Group 2026, Christian will share his perspective on the current threat landscape — and the role endpoint management plays when security is no longer optional. Martin Søndergaard CEO, CapaSystems Joachim Hansen Scrum Master | Agile Software Developer, CapaSystems Dennis Busk Chief Services Officer, CapaSystems Søren Dahl Nielsen Deployment Specialist, Niras Connect with them on LinkedIn to plan your conversations in advance. #### Christian Spohr CEO & Founder, Eagle Stark #### Martin Søndergaard Chief Executive Officer, CapaSystems #### Joachim Hansen Agile Software Developer, CapaSystems #### Dennis Busk Chief Services Officer, CapaSystems #### Søren Dahl Nielsen Deployment Specialist, Niras Written by Rikke Borup CMO, CapaSystems Rikke is Chief Marketing Officer at CapaSystems, where she has led marketing and communications since 2009. With more than 17 years of experience in the IT sector — including cybersecurity, endpoint management software and IT services — she brings long-standing, practical insight into the challenges facing modern enterprise IT environments. Trained as a journalist, Rikke specializes in translating complex technical concepts into clear, easy-to-understand communications for IT decision-makers. More from Rikke Borup → LinkedIn ↗ Book a Demo → --- URL: https://capaone.com/blog/reduce-tool-sprawl-endpoint-management/ Published: 2026-03-26 Summary: Too many endpoint tools? See how CapaOne helps you reduce tool sprawl, automate operations and improve visibility across the fleet. ← All articles Blog ## Reduce Tool Sprawl in Endpoint Management For most IT teams, endpoint complexity didn't happen overnight — it crept in one tool at a time. This growing tool sprawl in endpoint management is something we see across IT teams today. Meet us at V2 Security, May 6–7, and see how to take back control By Rikke Borup, CMO, CapaSystems · March 26, 2026 Reduce tool sprawl endpoint management: It usually starts with one tool. Then a second one for patching. A third for driver management. A fourth because the security team needed visibility. Before long, your endpoint stack looks more like a patchwork than a platform — and your team is spending more time switching between systems than actually managing anything. This is the reality for many IT teams in 2026. And it’s exactly what we’ll be talking about at V2 Security — Scandinavia’s leading security conference — at Bella Center Copenhagen on May 6–7. ### The Tool Sprawl Problem Is Real — and It’s Getting Worse Endpoint management rarely starts out complex. Most environments begin with a clear structure and a manageable toolset. But operational requirements accumulate — application updates, driver and firmware management, vulnerability visibility, privilege control — and each new requirement tends to get its own solution. The result? IT teams running 4–6 different tools with separate interfaces, fragmented data, and no single picture of what’s happening across their endpoints. Compliance becomes difficult to document. Security gaps are harder to spot. And instead of improving the environment, IT is stuck maintaining it. ### The Market Has Shifted: IT Teams Want Less Complexity, Not More Features Something has changed over the past year. Conversations with IT teams are no longer about adding capabilities — they’re about reducing friction. The priorities have shifted: - Fewer tools to manage and maintain - Centralized data and workflows in one place - Consistent, automated operations across the environment - Visibility that makes compliance straightforward — not painful The goal isn’t a more powerful stack. It’s a simpler, more controlled one. ### Automation Isn’t a Nice-to-Have Anymore A large share of endpoint operations is still handled manually — patching, software deployment, troubleshooting. This creates predictable problems: inconsistency, errors, support tickets that didn’t need to exist, and engineers doing work that should be happening automatically. With intelligent automation, teams can ensure consistent updates across the fleet, reduce hands-on manual effort, and respond to issues faster — without depending on individual knowledge or manual processes to hold things together. This is where unified endpoint automation becomes critical for maintaining consistency at scale — connecting patching, deployment, and remediation into a single, automated workflow. ### CapaOne: Built in Denmark, Designed for the Full Endpoint Lifecycle CapaOne is a European-built, cloud-native Endpoint Management Platform developed in Denmark and hosted in the EU. Instead of managing endpoint operations across multiple disconnected tools, CapaOne brings them together into a single operational layer — making it easier to maintain consistency, visibility, and control across the environment. Core capabilities include: - Application updates and software deployment - Driver management - Vulnerability insights and security visibility - Privilege control and least-privilege enforcement - Compliance documentation and audit data This unified approach reduces operational overhead, eliminates context switching, and gives IT teams a clearer picture of what’s happening across their endpoints. In an environment where data sovereignty and regulatory alignment matter — and with NIS2 and DORA reshaping how European organizations approach security — having a platform built and hosted in the EU is no longer just a preference. For many, it’s becoming a requirement. ### Works With Intune — or Without It CapaOne is designed to fit where you are, not where a vendor thinks you should be. If you’re already running Microsoft Intune, CapaOne extends it — filling the operational gaps without adding yet another standalone tool to manage. If you’re not using Intune, CapaOne is a complete, standalone endpoint management platform that consolidates devices, applications, security, and compliance in one place. That’s a different design goal than a dashboard built to run dozens of separate client environments from one login — software built to manage many customers is not shaped the same way as software built to run one team’s own estate. Either way, the outcome is the same: fewer moving parts, better visibility, and an IT team that spends less time firefighting. ### Find Us at V2 Security – May 6–7, Bella Center Copenhagen V2 Security is where Nordic IT and security professionals come together to talk about what’s happening in the industry. It’s the right place to have a real conversation about endpoint complexity — not a product pitch, but a genuine look at how your environment is set up and where the friction is. At our booth, we’ll be showing how IT teams are reducing tool sprawl, automating endpoint operations, and strengthening security and compliance — with or without Intune. Stop by our booth (B - 188) for a practical walkthrough of your setup — or book a dedicated session in advance if you want a deeper technical discussion. ### Have More Questions? ### Why Does Endpoint Management Become Complex Over Time? Because each new operational requirement — patching, drivers, vulnerability management, privilege control — tends to get solved with a separate tool. Over time, this creates fragmented workflows, inconsistent data, and an environment that’s increasingly hard to manage. ### How Can IT Teams Reduce Tool Sprawl? By consolidating endpoint operations into a unified platform and automating the repetitive work. The goal is fewer systems to manage, not fewer capabilities. ### Does CapaOne Require Microsoft Intune? No. CapaOne can extend an existing Intune environment or operate as a standalone endpoint management platform — depending on what your organization needs. ### Why Does It Matter That CapaOne Is Built in Europe? Data sovereignty, regulatory alignment (NIS2, DORA, GDPR), and operational transparency are increasingly important for European organizations. A platform built and hosted in the EU gives IT teams control over where their data lives and how it’s managed. ### What Does Endpoint Automation Change? It removes the manual dependency from day-to-day operations: consistent patching, reliable deployments, faster incident response — without relying on individual knowledge or manual intervention to keep things running. ### Frequently Asked Questions **Does Reducing Tool Sprawl Mean Replacing Microsoft Intune?** No. CapaOne runs as a complete endpoint management platform on its own, and it also works alongside Microsoft Intune. Consolidation targets the four to six separate point tools most teams bolt on — patching, drivers, vulnerability views, privilege — not the Intune foundation itself. **Where Should an IT Team Start When Consolidating Endpoint Tools?** Start by mapping every tool in the endpoint stack and what each one actually does — patching, drivers, vulnerability reporting, privilege, mobile. Overlap and coverage gaps surface quickly. From there, consolidate the functions that fragment daily work onto one platform, then retire the point tools they replace. **What Operational Risks Come From Running Too Many Endpoint Tools?** With four to six separate tools, endpoint data sits in as many places, so no single view shows real posture. A vulnerability flagged in one console, its patch in another, and nothing confirming the fix reached every device — that gap between tools is where exposure persists and audits turn into manual work. **How Is Consolidating Onto One Platform Different From Buying a Suite?** A suite often bundles separate products behind one invoice, each with its own console and data model. CapaOne unifies endpoint operations in a single platform with one agent, shared inventory, and connected workflows — so patching, drivers, vulnerability insight, and privilege draw on the same data. Written by Rikke Borup CMO, CapaSystems Rikke is Chief Marketing Officer at CapaSystems, where she has led marketing and communications since 2009. With more than 17 years of experience in the IT sector — including cybersecurity, endpoint management software and IT services — she brings long-standing, practical insight into the challenges facing modern enterprise IT environments. Trained as a journalist, Rikke specializes in translating complex technical concepts into clear, easy-to-understand communications for IT decision-makers. More from Rikke Borup → LinkedIn ↗ Book a Demo → --- URL: https://capaone.com/blog/european-endpoint-management-data-sovereignty/ Published: 2026-03-24 Summary: Cloud Act and FISA now matter more than GDPR for European IT teams. Here is what it means for your endpoint stack — and what you can do today. ← All articles Blog ## European Endpoint Management and the US Dependency Problem How Cloud Act and FISA are reshaping endpoint decisions for European IT teams — and what to do about it today By Rikke Borup, CMO, CapaSystems · March 24, 2026 The conversation about European digital sovereignty has moved from policy papers to boardrooms. At Denmark’s leading public sector technology conference in March 2026, former Microsoft executive Casper Klynge said what many have been thinking privately: Cloud Act and FISA are now more pressing concerns than GDPR — and European organizations can only trust their American technology vendors some of the way. Not all of the way. We recently explored why this is no longer a future concern — but a present obligation For many CIOs and IT directors, this is no longer a theoretical discussion. It is a planning conversation. Around 160,000 European organizations are now in scope for NIS2. With enforcement actively rolling out across member states, the question of where data is processed — and under whose jurisdiction — has moved from legal theory to operational reality. European Commission / EFS Consulting, 2025 But where does that conversation start? For most organizations, the answer is closer to home than expected: European endpoint management. ### Why Endpoints Are the Blind Spot in Most Sovereignty Strategies When organizations evaluate their exposure to US technology dependency, the focus typically lands on cloud infrastructure, productivity platforms, and data storage. These are visible, contract-heavy, and board-level concerns. Endpoint management rarely gets the same attention — yet it should. Every managed device in your organization generates operational telemetry. Patch status, application inventory, driver versions, vulnerability exposure, privilege elevation events, and configuration drift are all processed through your endpoint management platform. That data flows somewhere. It is stored somewhere. And it falls under the jurisdiction of whoever owns and operates that platform. US hyperscalers control over 70% of the European cloud market. European providers hold less than 15% — down from 29% in 2017. Endpoint management platforms, which process sensitive operational telemetry from every managed device, sit inside that same dependency structure. Casper Klynge, VP EMEA Government Partnerships, Zscaler — OffDig Conference, Aarhus, March 2026 That is a documented legal reality that compliance and legal teams across Europe are actively reassessing — not a future risk, but a present one. ### What European Endpoint Management Means for NIS2 Compliance and Data Control Shifting to a European endpoint management platform is not about removing American technology from the stack entirely. Most European organizations will continue to rely on Microsoft 365, Entra ID, and Intune as core infrastructure — and they should. These are mature, capable platforms. The question is what sits alongside them. Endpoint management platforms handle sensitive operational data that deserves the same jurisdictional clarity as your core data infrastructure. A European-built, EU-hosted endpoint management platform gives IT teams three things that US-based alternatives cannot reliably provide: Clear data residency. Operational telemetry stays within EU jurisdiction, processed under European law. There are no ambiguous sub-processor chains that cross the Atlantic. Predictable regulatory alignment. GDPR compliance is architectural, not a configuration option. NIS2-aligned operations are built into the platform, not bolted on after the fact. Documented governance. Sub-processor registers, data processing agreements, and audit-ready evidence are available without having to chase a vendor headquartered four time zones away. For IT managers preparing for compliance audits, cybersecurity assessments, or internal board reviews, this level of clarity has real operational value. ### How This Fits Into Your Existing Microsoft Environment A common concern is whether a shift toward European endpoint management requires dismantling an existing Microsoft investment. It does not. The most effective approach for most organizations is additive. CapaOne works with or without Microsoft Intune. It delivers the capabilities Intune does not natively cover: automated third-party application updates, vendor-certified driver management, just-in-time privilege elevation, vulnerability visibility, and exportable compliance evidence. Organizations that do not run Intune can adopt CapaOne as a complete, standalone endpoint management platform — no Microsoft dependency required. ### The Operational Outcomes That Matter Sovereignty positioning only holds weight if the platform delivers operationally. For IT teams evaluating NIS2 endpoint management requirements and European data sovereignty, the measurable outcomes are straightforward: Around 60% of data breaches are caused by known, unpatched vulnerabilities — not sophisticated attacks. The gap between awareness and action is where most incidents begin. Automated patch management closes that gap systematically. Automox / Verizon DBIR 2025 (vulnerability exploitation as initial access vector in 20% of confirmed breaches) CapaOne delivers patch success rates above 95% across third-party applications, removing one of the most common sources of vulnerability exposure. Automated driver updates eliminate the manual research and testing cycle that consumes disproportionate administrator time. Just-in-time privilege elevation removes standing local admin rights — closing a significant attack surface without adding helpdesk friction. Consolidated endpoint visibility reduces the number of tools IT teams must context-switch between, lowering both operational overhead and the risk of coverage gaps. These outcomes stand on their own. The sovereignty positioning makes them strategically relevant to a conversation that has reached the boardroom. ### Sovereignty Starts With Infrastructure, Not Policy Klynge’s point from the Aarhus stage was not that European organizations should abandon American vendors. It was that the power balance has shifted — and that European IT leaders now have a genuine opportunity to demand better terms, stronger data controls, and clearer exit options. Klynge’s point from the Aarhus stage was not that European organizations should abandon American vendors. It was that the power balance has shifted — and that European IT leaders now have a genuine opportunity to demand better terms, stronger data controls, and clearer exit options. Casper Klynge, VP EMEA Government Partnerships, Zscaler — OffDig Conference, Aarhus, March 2026 Digital sovereignty is becoming a procurement criterion, a board-level risk category, and in some sectors, a regulatory requirement. European organizations that treat it as an operational priority — rather than a compliance checkbox — will find themselves better positioned as the regulatory landscape continues to evolve. For IT teams, the most immediate and actionable step is to evaluate where endpoint management sits in the current stack. Who builds it. Where it is hosted. Whose legal framework governs the data it processes. These are questions with answers — and the answers have consequences. Weighing them is easier against a broader set of criteria — patching depth, deployment speed, and Intune fit belong in the same comparison as hosting location. ### Strengthen Your Endpoint Strategy on European Terms CapaOne Endpoint Management Platform is built in Denmark, hosted in the EU, and designed for organizations that require modern endpoint operations without US jurisdictional exposure. It is GDPR-first by architecture, NIS2-aligned in operation, and built to strengthen Microsoft Intune — or to stand alone as a complete endpoint management platform. Explore how CapaOne supports European data sovereignty → Book a demo of CapaOne Endpoint Management Platform → ### Frequently Asked Questions **Where Is My Endpoint Data Stored With CapaOne?** CapaOne stores endpoint data in EU data centers — built in Denmark and hosted in France. The operational telemetry it processes — patch status, application inventory, driver versions, exposure signals, configuration state — stays within EU jurisdiction, under European law and European operational control. **Is Any Endpoint Data Ever Transferred to US Jurisdiction?** No. CapaOne is EU-hosted, with no transfer of endpoint data to US jurisdiction. Because the platform is built, hosted, and operated in Europe, the operational data it processes stays under EU law — the specific concern behind frameworks like the US Cloud Act and FISA. **What Does "EU-Hosted" Actually Mean in Practice?** EU-hosted means CapaOne runs in European data centers, processes data under EU law, and stays under European ownership and operation — not a US company's European region. In practice, that gives clear data residency plus documented governance: sub-processor registers and DPAs available for review. **How Does Data Residency Map to GDPR Obligations?** Keeping endpoint data in the EU addresses one of GDPR's harder questions: where data lives and which law governs it. CapaOne's GDPR-first architecture keeps that data under EU jurisdiction by default, so residency is built in rather than configured after the fact. Written by Rikke Borup CMO, CapaSystems Rikke is Chief Marketing Officer at CapaSystems, where she has led marketing and communications since 2009. With more than 17 years of experience in the IT sector — including cybersecurity, endpoint management software and IT services — she brings long-standing, practical insight into the challenges facing modern enterprise IT environments. Trained as a journalist, Rikke specializes in translating complex technical concepts into clear, easy-to-understand communications for IT decision-makers. More from Rikke Borup → LinkedIn ↗ Book a Demo → --- URL: https://capaone.com/blog/microsoft-deployment-toolkit-replacement/ Published: 2026-03-19 Summary: Microsoft Deployment Toolkit (MDT) is retiring. Learn what replaces MDT and how IT teams handle modern Windows deployment without imaging. ← All articles Blog ## Microsoft Deployment Toolkit Replacement: What Replaces MDT? MDT was retired without warning, without a migration guide, and without an official replacement. Here's what IT teams are actually choosing in 2026 — and what's worth considering before you decide. By Rikke Borup, CMO, CapaSystems · March 19, 2026 In late 2025, Microsoft quietly retired Microsoft Deployment Toolkit (MDT). No major announcement. No migration guide. No official replacement. For thousands of IT teams that relied on MDT as the backbone of their Windows deployment workflow, the message was clear: figure it out yourself. The reason MDT was retired matters. Security researchers identified vulnerabilities that allowed extraction of privileged Active Directory credentials directly from MDT deployment shares. Rather than patch the underlying architecture, Microsoft chose to end the product entirely. This means organizations still running MDT are not just using unsupported software — they are running infrastructure with known, unpatched security vulnerabilities. At the same time, many IT teams are moving toward Microsoft Intune and Windows Autopilot. But this is where a critical misconception takes hold: Intune and Autopilot do not replace what MDT actually did. They manage devices. They do not deploy them from scratch. #### ⚠️ The Core Problem MDT is gone. Intune cannot replace it. And every day you run legacy deployment infrastructure, you are running a known security risk. This article explains what MDT actually did, why no single Microsoft-native tool replaces it today, and what modern IT teams are doing instead. ### What MDT Actually Did — and Why It’s Hard to Replace MDT was the tool IT teams reached for when a device had no operating system. Not for configuration. Not for policy enforcement. For getting Windows onto a machine that had nothing on it — whether that was a brand-new device out of the box, a system corrupted by malware, or refurbished hardware being standardized before handover. In practice, MDT covered four scenarios that still occur every day in enterprise IT: - New devices arriving with no OS pre-configured for the organization - Failed or corrupted systems requiring a full rebuild - Malware recovery requiring a complete wipe and reinstall - Refurbished hardware being repurposed across departments To handle these, MDT combined PXE boot, OS images, driver injection, task sequences, and post-deployment scripting into a single workflow. It was complex to maintain — but it worked, and there was nothing comparable built into the Microsoft stack that covered the same ground. That is what makes replacing MDT genuinely difficult. The challenge is not finding a tool that mimics MDT’s interface. It is finding something that closes the same deployment gap without introducing the same infrastructure overhead that made MDT a liability in the first place. ### Why MDT Was Built for a Different Era of IT MDT was designed for an on-premise world where all devices lived inside a corporate network, deployment servers were maintained by in-house teams, and OS images were updated quarterly by hand. That model worked when the workforce was static and infrastructure was local. Modern IT environments look nothing like that. Devices are distributed. Teams are remote. IT staff are expected to provision a device for an employee in another country without ever touching the hardware. MDT’s architecture — built around imaging servers, PXE infrastructure, and deployment shares — does not scale to that reality. It requires physical proximity, server maintenance, and manual image upkeep that consumes hours of IT time per cycle. Microsoft’s retirement of MDT was not just a security decision. It was an acknowledgment that the underlying model had reached its end of life. ### Why OS Deployment Still Matters Even Without MDT A common assumption after MDT’s retirement is that modern cloud tools have simply made OS deployment unnecessary. That assumption is wrong, and it creates a dangerous gap in IT operations. Consider the scenarios that still occur regardless of how mature your Intune environment is: - A remote employee’s laptop fails completely. Without bare-metal deployment capability, the device has to be shipped back to IT — adding days of downtime and logistics cost. - A device is hit by ransomware. The entire OS needs to be wiped and rebuilt from a clean state, not just reconfigured from Intune. - New hardware arrives pre-loaded with a consumer Windows image that needs to be replaced with a corporate baseline before enrollment. - A device in a secure facility needs to be rebuilt without being connected to the internet during deployment. These are not edge cases. They are routine events in any organization managing more than a few hundred endpoints. The absence of a capable deployment tool does not make these scenarios go away — it just makes them more expensive and time-consuming to handle. ### Why Intune and Autopilot Cannot Replace MDT This is the most important misconception to address clearly: Microsoft Intune is a device management platform. Windows Autopilot is a device configuration service. Neither is a deployment tool. Windows Autopilot requires a device that is already running a supported version of Windows. It handles out-of-box experience customization, Azure AD join, and initial policy application. It does not put Windows on a machine that has no OS. It does not recover a device that cannot boot. It does not reimage a system compromised by malware. Intune fills the management layer above the OS — application deployment, configuration policies, compliance enforcement, patch management. It is excellent at what it does. But it has the same dependency: the device needs to be running Windows before Intune can do anything. #### 💡 The Gap in Plain Terms Autopilot configures a device. Intune manages a device. Neither can create a device from scratch. That is the gap MDT filled — and the gap that still needs to be filled today. ### MDT Alternatives: What Are the Real Options? Organizations evaluating MDT replacements typically land on one of four categories. Here is how they compare on the dimensions that matter most: Each option involves a trade-off. The question is not which tool is technically capable — it is which model fits where IT operations are going. Intune + Autopilot The Microsoft-native path works well for new devices that arrive with Windows pre-installed. It is simple, cloud-based, and integrates cleanly with the rest of the Microsoft stack. But it does not address bare-metal scenarios, and treating it as a full MDT replacement leaves a visible gap the first time a device needs to be rebuilt from zero. Configuration Manager (SCCM / MECM) SCCM remains the most capable option for organizations that need full deployment control — including OS imaging, PXE boot, and task sequences. But it requires significant on-premise infrastructure, dedicated expertise to maintain, and ongoing investment in image management. For teams moving toward cloud-first operations, it moves in the wrong direction. Imaging-based tools (e.g. SmartDeploy) Tools like SmartDeploy simplify the MDT workflow and reduce some of the overhead around image creation. They are a reasonable transitional option for organizations not ready to move to a fully cloud-native model. The underlying approach — maintaining OS images and deploying them via traditional mechanisms — still requires manual upkeep and does not scale easily across distributed environments. Cloud-based provisioning platforms The emerging category. These platforms deploy Windows from bare metal over the internet, with no on-premise infrastructure, no image maintenance, and automated driver handling. The first deployment can be configured in under an hour. Devices in any location can be provisioned or recovered without being shipped back to IT. This is where enterprise endpoint deployment is heading. ### The Real Shift: From Imaging to Cloud-Native Deployment The deeper change MDT’s retirement signals is not about finding a tool that does what MDT did. It is about recognizing that the entire imaging model — build an image, maintain it, deploy it — is being replaced. Maintaining OS images is expensive. Every application update, every Windows patch, every driver change potentially requires a new image to be built, tested, and distributed. In a fleet of thousands of devices with varied hardware, this becomes a full-time operational burden. The teams that do it well are not adding strategic value — they are managing technical debt. The modern alternative eliminates the image entirely. Instead of deploying a pre-built image, the platform pulls a clean Microsoft OS, applies the correct drivers for the specific hardware automatically, and hands the device off to Intune for configuration. No image to maintain. No infrastructure to run. No manual packaging. For IT teams, this shift has a concrete impact: the hours previously spent on image creation and driver packaging become available for work that actually moves the organization forward. ### Provision Manager - Built for the Post-MDT World CapaOne Provision Manager, part of the CapaOne Endpoint Management Platform, is designed specifically to fill the gap MDT leaves behind — without reintroducing the infrastructure complexity that made MDT a liability. It is a 100% cloud-native solution. There are no servers to maintain, no deployment shares to secure, and no images to build. A device can be provisioned from bare metal to a fully managed endpoint using nothing but an internet connection. The first deployment template can be configured in under an hour. For IT teams managing distributed workforces, the most immediately valuable capability is remote recovery. When a device fails — anywhere in the world — it can be reimaged from the cloud without being shipped back to IT. The device boots, connects to the platform, receives a clean OS with the correct drivers already installed, and hands off to Intune automatically. Downtime is measured in hours, not days. Key capabilities include: - Cloud-based bare-metal OS deployment — provision any device from scratch using nothing but an internet connection, with no local server or physical media required - Automatic driver installation using manufacturer-certified packs for Dell, HP, Lenovo, and Microsoft hardware — eliminating manual driver packaging and reducing post-deployment incidents - Remote recovery — reimage any failed device without shipping it back to IT - Universal imaging — a single hardware-independent OS image works across all device models, reducing image maintenance overhead to zero - Full Autopilot integration — provides the bare-metal foundation Autopilot requires for new or broken devices - Zero infrastructure — replaces legacy deployment servers entirely, freeing IT from server maintenance and reducing operational costs Provision Manager is available now. See how CapaOne Provision Manager replaces MDT — without the infrastructure. “The flexibility is what stood out immediately. I reinstalled a machine from remote office — no local server, no USB key, no company network. And knowing I can recover a completely bricked device from the cloud changes how I think about device failures entirely.” Lars Olsen, LEMAN → Book a demo and see it in action ### Preparing for a Post-MDT Environment For IT teams still running MDT, the priority is not just finding a replacement. It is understanding the security exposure that comes with continuing to run it. The known credential extraction vulnerabilities are not going to be patched. Every day MDT remains in your deployment workflow is a day that risk remains open. The transition path looks different depending on where you are starting from: - Teams already on Intune and Autopilot need to close the bare-metal gap. Autopilot handles configuration — it does not handle deployment from zero. - Teams running SCCM alongside MDT need to decide whether to extend their on-premise investment or begin the transition to cloud-native operations. - Teams with a mostly modern environment and occasional legacy scenarios benefit most from a cloud provisioning layer that handles the edge cases without requiring full infrastructure. The common thread is that the right time to solve this is before the next device failure, not after. ### Conclusion: What Actually Replaces MDT? Microsoft Deployment Toolkit is being retired because the model it was built on — imaging servers, PXE infrastructure, on-premise deployment shares — no longer fits how enterprise IT operates. Security vulnerabilities accelerated that decision, but the underlying direction was already clear. Intune and Autopilot fill the management and configuration layers well. They do not fill the deployment layer. That gap is real, and it becomes visible the moment a device needs to be rebuilt from scratch. The real replacement for MDT is not a tool that replicates what MDT did. It is a model that makes what MDT did unnecessary — cloud-based OS deployment that handles bare-metal provisioning, driver orchestration, and remote recovery without any of the infrastructure that made MDT difficult to maintain and ultimately impossible to secure. CapaOne Provision Manager is available now. → Request a demo ### Frequently Asked Questions **What Replaces Microsoft Deployment Toolkit (MDT)?** Cloud-based provisioning platforms are the most complete replacement. They handle bare-metal OS deployment, driver orchestration, and remote recovery without on-premise infrastructure. Configuration Manager (SCCM) suits teams that need full deployment control and can maintain on-premise servers. Intune and Autopilot manage and configure devices but do not replace MDT's deployment capabilities. **Can Intune Replace MDT?** No. Intune is a device management platform that requires a device to already be running Windows. It handles configuration, policy enforcement, application deployment, and patch management — but it cannot deploy Windows to a bare-metal device or recover a device that cannot boot. **Does Windows Autopilot Deploy Windows?** No. Autopilot requires an existing, functioning OS. It handles the out-of-box experience — Entra ID join, policy application, initial configuration — but it does not install Windows. A device with a corrupted or missing OS cannot enroll through Autopilot without a separate tool reimaging it first. **Why Was MDT Retired?** Microsoft retired MDT in late 2025 after researchers identified vulnerabilities that allowed extraction of privileged Active Directory credentials from MDT deployment shares. Rather than patch the underlying architecture, Microsoft ended the product. MDT deployments still in operation run software with known, unpatched vulnerabilities. **What Is the Best MDT Alternative for Organizations Moving to Cloud-First IT?** Cloud-native provisioning platforms that remove imaging and on-premise infrastructure entirely. These platforms deploy Windows from bare metal over the internet, install the correct drivers for the specific hardware automatically, and hand the device off to Intune for configuration — with no servers to maintain and no images to update. Written by Rikke Borup CMO, CapaSystems Rikke is Chief Marketing Officer at CapaSystems, where she has led marketing and communications since 2009. With more than 17 years of experience in the IT sector — including cybersecurity, endpoint management software and IT services — she brings long-standing, practical insight into the challenges facing modern enterprise IT environments. Trained as a journalist, Rikke specializes in translating complex technical concepts into clear, easy-to-understand communications for IT decision-makers. More from Rikke Borup → LinkedIn ↗ Book a Demo → --- URL: https://capaone.com/blog/modern-endpoint-provisioning-is-coming/ Published: 2026-03-17 Summary: Modern endpoint provisioning is coming to CapaOne. Discover cloud-native bare-metal recovery, OS deployment, and integrated driver management. ← All articles Blog ## Modern Endpoint Provisioning Is Coming A cloud-native foundation for bare-metal recovery, OS deployment, and integrated driver management — coming soon to CapaOne. By Rikke Borup, CMO, CapaSystems · March 17, 2026 Endpoint management has evolved. Provisioning hasn’t kept pace. Even in 2026, many IT teams still rely on legacy deployment infrastructure, fragile imaging workflows, and manual driver handling just to get a Windows device into a ready-to-work state. When devices are remote, bricked, or brand new, that friction turns into operational drag — and valuable IT time is lost on tasks that shouldn’t require this much effort. For organizations looking to modernize their endpoint provisioning strategy, this gap has become increasingly visible. CapaOne Provision Manager introduces a modern approach to endpoint provisioning — built to take you from bare metal to ready-to-work, without the classic on-prem tax. ### Why Modern Endpoint Provisioning Still Creates Operational Drag Modern endpoint strategies often assume the operating system is already in place. That assumption breaks down quickly. Endpoint provisioning becomes complex when: - A device needs Windows installed from scratch - A machine must be recovered after instability or compromise - Hardware models change and driver maintenance grows - Imaging depends on local servers and fragile PXE configurations - Remote employees cannot be supported without shipping devices back to IT The foundation layer is still treated as a legacy process. Provision Manager is designed to change that — and bring modern endpoint provisioning in line with the rest of a cloud-native IT strategy. ### Autopilot Needs a Working OS — Provision Manager Provides It Microsoft Autopilot is effective for configuration, policies, and user setup. But it assumes one critical condition: the operating system is already functional. Provision Manager is built for what happens before that point — when there is no working OS, when the disk is blank, or when a clean baseline must be restored. Together, the approach becomes clear: - Provision Manager establishes the foundation (OS and hardware readiness) - Autopilot and Intune complete the configuration and user experience This is not a replacement strategy. It is a completion strategy for organizations that want a fully aligned endpoint provisioning model. ### Driver Manager Becomes Part of Provision Manager Provisioning does not end when Windows boots. It ends when the device is stable and fully compatible with its hardware. For that reason, Driver Manager becomes part of Provision Manager. Instead of separating OS deployment from driver management, IT teams work within a single consolidated workflow. Drivers become a natural part of provisioning — not a separate maintenance discipline. This integration reflects a simple principle: endpoint provisioning should be complete, not fragmented. ### What You Can Expect This release is built for IT teams that want to modernize endpoint provisioning without rebuilding infrastructure around it. Provision Manager supports: - Bare-metal OS provisioning for new or wiped devices - Recovery workflows for unstable or bricked endpoints - Cloud-native provisioning designed to work across office and remote environments - Driver handling as a first-class part of provisioning For many organizations, endpoint provisioning is the last remaining on-prem anchor in their endpoint management strategy. This release is designed to remove it. ### What Happens Next Provision Manager is currently in its final testing phase with selected beta customers. The solution is being validated in real-world environments to ensure stability and operational readiness before General Availability. The product is nearly ready, and public release is just around the corner. We will share updates as we approach launch. If modern endpoint provisioning is on your roadmap, keep an eye on our website and follow CapaOne on LinkedIn for ongoing updates. Book a demo of CapaOne Endpoint Management Platform. Written by Rikke Borup CMO, CapaSystems Rikke is Chief Marketing Officer at CapaSystems, where she has led marketing and communications since 2009. With more than 17 years of experience in the IT sector — including cybersecurity, endpoint management software and IT services — she brings long-standing, practical insight into the challenges facing modern enterprise IT environments. Trained as a journalist, Rikke specializes in translating complex technical concepts into clear, easy-to-understand communications for IT decision-makers. More from Rikke Borup → LinkedIn ↗ Book a Demo → --- URL: https://capaone.com/blog/5-steps-to-strengthen-driver-compliance-and-stability-in-modern-endpoint-environments/ Published: 2026-01-15 Summary: CapaOne automates driver compliance across every hardware model — keeping drivers vendor-certified, stable, and audit-ready at scale. ← All whitepapers eBook ## 5 Steps to Strengthen Driver Compliance By Rikke Borup, CMO, CapaSystems · January 15, 2026 How IT teams strengthen stability, reduce drift, and meet emerging compliance expectations ### Introduction to the eBook Driver compliance and updates used to be a maintenance task. In modern endpoint environments, they’re a stability and compliance requirement. Hybrid work and diverse hardware models make it difficult to keep drivers vendor-approved, consistent, and traceable across the fleet. When updates rely on manual routines, scripts, or OEM utilities, drift builds quietly — and the result shows up as crashes, performance issues, recurring tickets, and weak audit documentation. This eBook introduces the Driver Update Maturity Framework — a practical 5-step approach to standardizing, automating, monitoring, and documenting driver updates so IT teams can improve stability, reduce drift, and meet rising compliance expectations at scale. ### What You Will Learn - Build continuous visibility into driver posture across hardware models - Standardize vendor-certified baselines for predictable outcomes - Detect drift and validate stability over time - Reduce crashes, performance issues, and repeat support incidents ### How CapaOne Strengthens Driver Compliance and Stability CapaOne strengthens driver compliance by bringing driver orchestration into one cloud-native platform: vendor-certified driver packs, model-aware matching, automated delivery, and audit-ready documentation across every hardware model. Driver orchestration lives in Provision Manager and works with or without Microsoft Intune — giving IT teams continuous driver visibility, predictable baselines, and compliance evidence without relying on scripts or OEM utilities. The eBook’s five-step framework maps directly to the platform: Step 1 — Visibility into driver posture: Provision Manager gives IT teams a clear overview of installed driver versions across all hardware models, making drift visible before it affects device stability. Step 2 — Standardized, vendor-certified baselines: It delivers vendor-certified, model-aware driver packs that create predictable outcomes across diverse hardware. Step 3 — Automated delivery at scale: It automates the distribution of vendor-certified driver updates, keeping devices aligned with approved baselines without manual intervention. Step 4 — Stability monitoring and drift detection: Experience Monitor surfaces crash patterns, performance bottlenecks, and stability issues following driver changes, so teams resolve problems before users report them. Step 5 — Documentation and compliance evidence: CapaOne provides centralized insight into driver versions, update events, and device-level posture — supporting NIS2-aligned compliance and audit readiness. ### Frequently Asked Questions #### Which Vendors and Models Are Supported? Broad coverage across all hardware models from major vendors. The catalog highlights when specific models are “update-ready.” #### Can We Stage Driver Deployment? Yes—use staged deployments, Entra ID targeting, and scheduled workflows. #### How Do You Verify Compatibility Before Rollout? Automated prechecks match the hardware model with the correct driver pack. #### How Are Changes Tracked for Audits? Provision Manager logs every driver change — version, device, and timestamp — in a centralized audit record. This gives IT teams a continuous, audit-ready history of driver posture across the estate, supporting NIS2-aligned documentation without manual tracking. #### Do Users Get Notified? Can We Control Reboots? Configurable prompts, and reboot handling let you minimize disruption or enforce deadlines. #### Does This Replace Vendor Tools? Yes. Provision Manager brings driver lifecycle management into the CapaOne platform — vendor-certified packs, model-aware matching, and update tracking in one place — so you can retire the patchwork of OEM utilities and manual routines. #### How Does Driver Management Connect to OS Deployment? Driver orchestration is part of Provision Manager, the same platform that handles bare-metal OS deployment. Drivers stay vendor-certified and model-matched from first provisioning through every update — one workflow, not two. #### How Does Driver Management Work With Intune? CapaOne handles driver orchestration end to end. For Intune users, Provision Manager targets your existing Entra ID groups and runs alongside Intune — which keeps enrollment, security, and policy. Driver compliance works the same with or without Intune. #### How Fast Can We Start? Typically same day: install the agent, sync inventory, select baselines, run a test, then promote to production. --- URL: https://capaone.com/blog/ios-management-setup-in-capaone-mobile-manager/ Published: 2026-01-15 Summary: iOS Management Setup in CapaOne Mobile Manager - Knowledge article from CapaOne's technical team ← All articles Knowledge Hub ## iOS Management Setup in CapaOne Mobile Manager By CapaOne Support · January 15, 2026 CapaOne Mobile Manager enables organizations to centrally manage iPhones and iPads across both corporate and BYOD environments. This guide explains how to set up iOS device management from the ground up, including the Apple Push Certificate, Apple Business Manager integration, enrollment profiles, and app distribution through VPP. By the end, you will be able to: - Enroll devices into Mobile Manager - Automatically configure corporate-owned (DEP) devices - Securely distribute apps and configurations Before starting, make sure you have: - A CapaOne account with Mobile Manager License - Apple ID (create one dedicated Account not tied to a personal user) - Access to Apple Business Manager (ABM) or Apple School Manager (ASM) - Internet access for both devices and the management console ### Prerequisites - A CapaOne account with Mobile Maneger License - Apple ID (create one dedicated Account not tied to a personal user) - Access to Apple Business Manager (ABM) or Apple School Manager (ASM) - Internet access for both devices and the management console ### Configuration / Steps #### Apple Push Certificate Setup Apple Push Notification Service (APNs) is required for Mobile Manager to communicate with iOS devices. Without it, no management commands can be sent. Steps: - Log in to the CapaOne portal. - Navigate to Apple Setup → Push Certificate. - Click Download this Push Request and save the file. - Open the Apple Push Certificates Portal: https://identity.apple.com/pushcert - Sign in with your Apple ID. - Create a certificate, upload the Push Request file, and download the issued .pem file. - Upload the certificate into CapaOne. Confirmation The certificate status should show Active with an expiration date. - Important Renew the certificate every 12 months using the same Apple ID. Apple Business Manager (DEP) Integration The Device Enrollment Program (DEP) is part of Apple Business Manager and allows devices to automatically enroll into Mobile Manager during initial setup. - Steps: - In CapaOne, go to Apple → Certificates → DEP Certificate → Update. - Download the Public Key. - In ABM, go to Settings → MDM Servers → Add MDM Server. - Upload the public key and name the server (e.g., “CapaOne Mobile Manager”). - Download the generated server token (.p7m). - Upload the token into CapaOne under DEP Token → Upload. - Confirmation CapaOne Mobile Manager is now linked with ABM. - Assign Devices in ABM - In ABM, go to Devices. - Select device(s) → Assign Device Management → assign to the CapaOne MDM server. - Result Devices now automatically enroll into Mobile Manager when activated or reset. #### Volume Purchase Program (VPP) Apps and Books A VPP token links Apple Business Manager with Mobile Manager. It enables silent distribution of apps without requiring Apple IDs. - Steps: - In CapaOne, go to Apple → Certificates → VPP Token → Update. - In ABM, go to Preferences → Payment and Billing and download the .vpptoken. - Upload the token into CapaOne. - Confirmation VPP is now successfully linked. - Purchase Apps in ABM - Go to Apps and Books in ABM. - Search and purchase apps. - Assign licenses to the correct organization location. #### Groups, Configurations & Apps - Groups - Go to Management → Groups → New. - Create a group for Supervised devices. - Create a second group for Unsupervised devices. - Groups can have configurations and applications assigned. - Note: you can use this with the enrollment profile for automated linking. - Configurations - Go to Apple → Configurations → New. - Create a Supervised configuration. - Create an Unsupervised configuration. - Assign each configuration to the matching group. - Apps - Go to Apple → VPP Licenses. - Click the settings for a VPP-licensed app → Create application. - Assign the application to the appropriate group. - Result The app is delivered automatically to the device. ### Enrollment #### Unsupervised Profile (BYOD) - Go to Apple → Enrollment → New. - Add name and description. - Add groups, configurations, and apps. - Save the profile. #### Supervised Profile (Corporate) - Go to Apple → Enrollment → New. - Add name and description. - Add groups, configurations, and apps. - Under DEP Enrollment Profile, choose authentication method. - If Azure AD integration is not enabled → select No user authentication. - Enable Skip items and select all. - Set this profile as default DEP. #### Unsupervised Devices (BYOD) - On the device, open the enrollment URL or scan the QR code. - Download the profile. - Install via Settings → General → VPN & Device Management. Result The device appears in Mobile Manager. #### Supervised Devices (ABM/DEP) - Assign the device in ABM to the CapaOne server. - Reset or unbox the device. - During setup, the device auto-enrolls into Mobile Manager. - Sign in with user credentials (if Azure AD is enabled). Result The device is supervised and fully managed with zero manual steps. The device will reset. After going through the enrollment process again, it will automatically reconnect to: - The same groups - Previously assigned apps - Existing configurations ### Maintenance & Best Practices - Renew the Apple Push Certificate annually using the same Apple ID. - Renew ABM/DEP and VPP tokens yearly. - Separate BYOD and corporate profiles. - Use DEP for all corporate device purchases. - Review compliance regularly. - Remove unused devices or licenses. Book a Demo → --- URL: https://capaone.com/blog/capaone-vordingborg-kokkenet-automation-that-makes-a-difference/ Published: 2026-01-14 Summary: Vordingborg Køkkenet, a Danish kitchen, bathroom and wardrobe manufacturer — read how they use CapaOne to automate endpoint management. ← All case studies Case Study · Kitchen manufacturing ## CapaOne & Vordingborg Køkkenet: Automation That Makes a Difference A Medium-sized Company with High Demands on IT Stability. By Rikke Borup, CMO, CapaSystems · January 14, 2026 Book a Demo More case studies → Kitchen manufacturing Industry ~200 Endpoints managed 0 Daily missing updates down from 1,000+ Removed Local admin rights Time is a crucial factor for us — we couldn’t manage all our endpoints without automating a large portion of our tasks. Thomas Holm-Frederiksen IT Manager Vordingborg Køkkenet is a Danish kitchen manufacturer headquartered in Vordingborg, producing kitchen, bathroom, and wardrobe solutions across a nationwide retail network. The IT department manages nearly 200 endpoints, and IT Manager Thomas Holm-Frederiksen relies on CapaOne to maintain security and stability with limited resources. Business Challenge ### Rising Security Requirements and Limited Time Cybersecurity demands have increased significantly, requiring timely software updates, up-to-date drivers, and restricted administrator rights. For a small IT function, meeting these requirements manually is challenging. Thomas emphasizes that with limited hours in the day, the team needed automation to ensure that no critical tasks were missed and that endpoints remained secure. The Solution ### Automation Through On-Premise CapaInstaller and CapaOne Cloud Services Vordingborg Køkkenet uses a hybrid solution combining the on-premise, CapaInstaller, from CapaSystems with several CapaOne cloud services. Third-party updates and driver updates are fully automated, reducing manual work and minimizing disruptions for end users. Key solutions include: - CapaOne Provision Manager to update drivers every evening at 18:00 - CapaOne Application Manager to update third-party software every hour - CapaOne Privilege Manager to restrict and manage local administrator rights When CapaOne was first implemented, the dashboard revealed more than 1,000 missing updates across devices. Today, the daily number is consistently zero, giving both IT and management confidence in system stability. The Outcome ### Improved Security, Fewer Errors, and a More Efficient IT Operation With automated updates and a clear dashboard overview, the IT department experiences fewer issues and greater operational calm. Security has been significantly strengthened by removing default administrator rights, while workflows ensure that essential updates run without interruption. Thomas highlights that the graphical dashboard provides reassurance not only to IT but also to leadership. The implementation process was simple, supported by an experienced CapaSystems consultant who ensured a quick and smooth rollout. The Highlights ### Key Improvements Experienced by Vordingborg Køkkenet - Fully automated updates for third-party applications and drivers - Significant reduction in manual workload - Clear dashboard insight into endpoint status - Strengthened security with restricted administrator rights - Simple implementation supported by CapaSystems consulting - Stable daily operations with fewer unpredictable tasks - Ability to focus on business-critical IT activities The Platform ### CapaOne products used #### Application Manager Simplifies packaging, accelerates deployment, and automates updates for third-party and business applications, resulting in optimal endpoint performance and a fortified security posture. Explore Application Manager #### Privilege Manager Enforces least-privilege with policy-based elevation and no standing local admin. Supports process or session elevation using existing Entra ID groups, with logging for governance. Explore Privilege Manager #### Provision Manager Automates bare-metal OS deployment and driver orchestration in a cloud-native workflow, enabling IT to provision and recover Windows devices from anywhere. Explore Provision Manager FAQ ### Questions we get asked Anything else? Talk to our team → **How Many Missing Updates Does a Typical Organization Have Before Automating?** When Vordingborg Køkkenet first implemented CapaOne, the dashboard showed more than 1,000 missing updates across roughly 200 endpoints. The daily number now sits consistently at zero. **Can You Update Applications During the Working Day Without Disrupting Users?** Vordingborg Køkkenet updates third-party software every hour and schedules driver updates for 18:00, after hours. Splitting the two keeps applications current throughout the day while the heavier driver work stays out of the way of end users. **What Changes When You Remove Default Local Administrator Rights?** Removing default administrator rights strengthened security at Vordingborg Køkkenet, and Privilege Manager now governs who gets them and when. The IT department reports fewer issues and steadier daily operations as a result. **How Do You Prove to Management That Devices Stay Secure?** Vordingborg Køkkenet uses the dashboard overview. The graphical view of endpoint status gives both the IT department and management a clear, current picture, which the IT manager describes as a source of reassurance beyond the IT team itself. ### Want results like this on your estate? See CapaOne on your own devices — standalone or alongside Intune. Most teams are up and running in under 30 minutes. Book a Demo View Pricing --- URL: https://capaone.com/blog/how-to-use-scep-in-capaone-mobile-manager/ Published: 2026-01-14 Summary: How to Use SCEP in CapaOne Mobile Manager - read the Knowledge article from the CapaOne technical team ← All articles Knowledge Hub ## How to Use SCEP in CapaOne Mobile Manager By CapaOne Support · January 14, 2026 This article explains how SCEP (Simple Certificate Enrollment Protocol) is used in CapaOne Mobile Manager and how it integrates with customer PKI environments, NDES servers, and advanced Wi-Fi configurations. By the end, you will understand the role of SCEP, what is required for it to work, and common challenges when deploying it on mobile devices. ### Prerequisites Before working with SCEP, ensure you understand: - The customer’s PKI infrastructure - The SCEP server configuration (“recipe”) - Required certificates (CA, intermediates, issuing certificates) - Network access requirements to the SCEP server - Platform limitations on Apple and Android ### Configuration / Steps 1. What SCEP Is SCEP allows a client device to retrieve a certificate from a certificate authority without user or administrator interaction. Simple Certificate Enrollment Protocol - Wikipedia Administrators configure the SCEP server to accept certificate requests from clients that supply the correct SCEP configuration (“recipe”), which differs per customer PKI environment. 2. Usage of SCEP SCEP can be used for any scenario requiring certificates, but is commonly used for establishing trust for devices and users. 3. SCEP Setup Principles - SCEP Servers and NDES Microsoft PKI environments often use NDES servers, but other implementations may exist. - Trust Issues Since SCEP servers issue certificates from internal PKI infrastructures, devices must trust: - The CA certificate - Intermediate certificates - Issuing certificates All necessary certificates must be included in the configuration. - Access to the SCEP Server SCEP servers are often located inside customer premises. Common access challenges: - Non-trusted devices reaching internal URLs - Limited-access enrollment networks - SIM/APN-based network paths - TLS certificates that are not globally trusted If the SCEP server uses internal TLS certificates, the full trust chain must be added to the configuration. - Mobile Device Trust Behavior Mobile devices often do not download certificate chains automatically. All required trust certificates must be delivered in the profile. #### 4. Requirements for SCEP Servers The SCEP server must be configured to use a static secret, because mobile devices do not support advanced negotiation. #### 5. Wi-Fi Setup Using SCEP Advanced Wi-Fi (EAP-TLS) setups may use certificates supplied via SCEP. A certificate can be either: - Pre-created and distributed, or - Generated per device using SCEP Once the Wi-Fi profile includes SSID, WPA settings, EAP-TLS parameters, and trust certificates, the device attempts connection. - Apple Devices Apple devices do not automatically renew certificates. Profiles must be reapplied to trigger renegotiation. - Android Devices Android does not natively support SCEP. Devices must use the CapaOne Agent to handle SCEP negotiation. ### Common Problems & Debugging SCEP environments can be complex due to trust and PKI chaining requirements. - Trust Chain Requirements Devices must receive the full certificate chain for: - The SCEP server (TLS) - Intermediate CAs - Root CA - RADIUS server (TLS) If the chain is incomplete, the user will be prompted to manually confirm trust before Wi-Fi connects. - Pre-Verification Open network standards require pre-verification of certificates. This must be configured within the Wi-Fi profile by linking certificate payloads to the relevant CA/issuing certificates. ### Maintenance & Best Practices - Always include the full certificate chain in SCEP and Wi-Fi profiles - Ensure SCEP server uses a static secret - Validate network access paths early - Reapply SCEP/Wi-Fi profiles before certificates expire (Apple) - Install the CapaOne Agent on Android devices that need SCEP Book a Demo → --- URL: https://capaone.com/blog/5-steps-to-secure-and-manage-mobile-devices-at-scale/ Published: 2026-01-13 Summary: Mobile Manager secures and manages iOS, iPadOS, and Android at scale — enrollment, compliance, and app delivery in one platform. ← All whitepapers eBook ## 5 Steps to Secure and Manage Mobile Devices at Scale How to secure and govern iOS, iPadOS, and Android at scale — without the drift, tool sprawl, and manual checks that slow IT teams down. By Rikke Borup, CMO, CapaSystems · January 13, 2026 ### Introduction to the eBook Mobile devices are now central to how employees access data, collaborate, and stay productive — but securing and governing them at scale has become increasingly complex. Hybrid work, multiple operating systems, and inconsistent device behavior make it difficult to maintain visibility, enforce policies, and document compliance. Manual processes and fragmented tools quickly lead to drift, support overhead, and governance gaps. This eBook introduces a practical 5-step framework for securing and managing mobile devices at scale — helping IT teams strengthen security, reduce drift, and support productivity across distributed environments without added complexity. ### What You Will Learn - Gain full visibility into mobile device posture across platforms - Enforce compliance automatically without manual checks - Reduce configuration drift and recurring support issues ### How CapaOne Strengthens Mobile Device Security at Scale CapaOne strengthens mobile device security by bringing enrollment, configuration, compliance, and app delivery into one cloud-native platform across iOS, iPadOS, and Android. Mobile Manager gives IT teams continuous visibility into device posture, automated policy enforcement, and audit-ready compliance evidence — with or without Microsoft Intune — so distributed fleets stay secure and consistent without manual checks. The eBook’s five-step framework maps directly to the platform: Step 1 — Visibility across platforms: Mobile Manager gives IT teams a unified view of device posture across iOS, iPadOS, and Android, making drift visible before it affects security or productivity. Step 2 — Standardized configuration baselines: It applies consistent configuration profiles per platform and ownership model, so every enrolled device starts from a known, compliant baseline. Step 3 — Automated app delivery: It delivers and updates managed apps through Apple and Google’s business channels, keeping required software in place without manual installs. Step 4 — Continuous compliance enforcement: Mobile Manager tracks compliance posture automatically and aligns device state with your access policies, reducing manual checks and closing gaps as they appear. Step 5 — Incident response and lifecycle control: From a single console, IT teams lock, locate, or selectively wipe devices and retire them cleanly — with audit logs for every action. ### Frequently Asked Questions #### Which Platforms and Ownership Models Are Supported? iOS, iPadOS and Android—including COBO, COPE, and BYOD—with policies tailored per model. #### Do You Support Zero-Touch Enrollment? Yes. Mobile Manager supports zero-touch enrollment through Apple Device Enrollment Program, Android Enterprise Zero-Touch, and Samsung Knox. #### How Are Apps Deployed and Updated? Mobile Manager deploys and updates apps through Apple Business Manager, the App Store, Google Play, and Managed Google Play — with mandatory installs and silent updates. #### Can We Control OS Updates? Yes. Mobile Manager lets you defer major releases and enforce minimum OS versions — through Legacy MDM or DDM on iOS 26 and earlier, and through DDM on iOS 27. #### What Data-Loss Prevention Options Exist? Managed open-in, copy/paste governance, per-app VPN, and account-scoped profiles keep corporate data in managed contexts. #### How Is BYOD Privacy Handled? Use work profiles/managed contexts for corporate data; personal apps/data remain outside IT visibility. Selective wipe removes only corporate content. #### How Does Mobile Manager Work With Intune and Conditional Access Policies? Keep Intune for identity and access decisions; Mobile Manager tracks compliance posture to align device state with access policies. #### What Device Actions Are Available for Incidents or Lost Devices? Remote lock, selective wipe, lost mode, OS update, and password control — with audit logs for each action. #### How Quickly Can We Onboard at Scale? Onboarding is typically same-day: connect Apple and Google, set baseline configurations, and enroll devices with zero-touch enrollment. --- URL: https://capaone.com/blog/capaone-niras-makes-patching-easy-and-transparent/ Published: 2026-01-13 Summary: NIRAS is one of Denmark’s largest consulting engineering companies, employing more than 3,000 people - read how they use CapaOne ← All case studies Case Study · Engineering consultancy ## CapaOne & NIRAS: Makes Patching Easy and Transparent A Global Engineering Consultancy with Thousands of Devices. By Rikke Borup, CMO, CapaSystems · January 13, 2026 Book a Demo More case studies → Engineering consultancy Industry 3,000+ Devices managed 60+ Locations 100,000+ CVEs tracked I’m not exaggerating when I say security has improved significantly. The complexity in CapaOne is low, it’s transparent, and we don’t need to navigate countless submenus to gain an overview and address security gaps across our 60+ locations worldwide. Søren Dahl Nielsen System Deployment Manager NIRAS is one of Denmark’s largest consulting engineering companies, employing more than 3,000 people across 60+ locations worldwide. The organization works in construction, sustainability, infrastructure, environment, and energy, and depends on a wide application and hardware landscape to support its global workforce. The IT department manages more than 3,000 devices and must maintain security, visibility, and consistent patching across all endpoints. Business Challenge ### Keeping Thousands of Devices Updated and Secure Updating software across 3,000+ devices was resource-intensive. Many applications required frequent security updates, while other software needed custom configurations that NIRAS preferred to handle internally. Balancing automated patching with manual packaging — without unnecessary complexity — was a key requirement. The IT team also needed better visibility and a simple way to identify vulnerabilities across their international environment. The Solution ### On-Premise CapaInstaller Combined With CapaOne Cloud Products NIRAS uses the on-premise, CapaInstaller, from CapaSystems together with several CapaOne cloud services to streamline patching and strengthen security across a global device environment. Workflows enable automated patching where it makes sense, while still allowing the IT team to manage and package custom-configured applications internally. Today, several CapaOne services play a central role in daily operations: - CapaOne Application Manager automates patching of third-party software that requires continuous security updates, while supporting custom application packaging - CapaOne Security Monitor provides clear visibility into vulnerabilities, supported by a risk score based on more than 100,000 CVEs to help prioritize the most critical issues - Endpoint inventory gives Support detailed insight into hardware, software, and drivers, improving day-to-day troubleshooting and visibility The Outcome ### Stronger Security and Better Visibility Across 60+ Locations Security has improved significantly thanks to automated patching and clearer insight into vulnerabilities. The transparent interface reduces complexity and helps the IT department avoid navigating multiple submenus when assessing risks. Support now works more efficiently due to improved visibility from the endpoint inventory. With a flexible setup, NIRAS can scale and adapt its security processes as the organization evolves. The Highlights ### Key Improvements Experienced by NIRAS - Automated patching for frequently updated applications - Flexibility to manage and package custom software internally - Significant improvement in overall security - Clear and transparent risk scoring using 100,000+ CVEs - Lower complexity and easier prioritization of issues - Improved visibility for both IT and Support teams - Scalable workflows that support a global environment The Platform ### CapaOne products used #### Application Manager Simplifies packaging, accelerates deployment, and automates updates for third-party and business applications, resulting in optimal endpoint performance and a fortified security posture. Explore Application Manager #### Security Monitor Surfaces configuration drift and vulnerability insights across endpoints, providing IT with clarity on exposure and security gaps. Explore Security Monitor FAQ ### Questions we get asked Anything else? Talk to our team → **How Do You Keep Devices Secure Across Offices in Different Countries?** NIRAS applies the same workflows to more than 3,000 devices spread across 60+ locations worldwide. Application Manager updates the applications that need continuous security fixes, so a device in one country meets the same standard as a device in another. **How Do You Prioritize Which Vulnerabilities to Fix First?** Security Monitor gives NIRAS a risk score built on more than 100,000 CVEs. The score points the IT department toward the most critical issues first, rather than leaving them to assess a flat list of findings. **Can You Automate Patching and Still Package Applications Yourself?** NIRAS does both. Workflows handle the applications that need frequent security updates, and the IT team retains full control over software that requires custom configuration. **How Do You See What Hardware and Software a Device Actually Has?** NIRAS gives Support detailed insight into hardware, software, and drivers on each device. Knowing what sits on the machine before troubleshooting starts shortens the daily work across more than 60 locations. ### Want results like this on your estate? See CapaOne on your own devices — standalone or alongside Intune. Most teams are up and running in under 30 minutes. Book a Demo View Pricing --- URL: https://capaone.com/blog/capaone-unveiled-a-new-chapter-in-endpoint-management-begins/ Published: 2026-01-13 Summary: With the launch of CapaOne we introduce a cloud-native endpoint management platform designed for how IT operates today ← All articles Blog ## CapaOne Unveiled: A New Chapter in Endpoint Management Begins By Rikke Borup, CMO, CapaSystems · January 13, 2026 For more than 30 years, CapaSystems has worked side by side with IT professionals, helping them manage complex endpoint environments with confidence and control. What began as a trusted on-premises solution has evolved—step by step—alongside the changing realities of modern IT. Today, that journey reaches an important milestone. With the launch of CapaOne, we introduce a cloud-native endpoint management platform designed for how IT operates today—and for the security, compliance, and operational challenges still ahead. ### From Proven Scandinavian Heritage to Cloud-Native Global Future Endpoint management has changed fundamentally. Cloud-first strategies, hybrid and distributed workforces, rising cyber threats, and increasing regulatory demands have reshaped how IT teams must operate at scale. Most organizations run a mix of tools — and quickly discover that no single one covers the full operational reality of complex, multi-vendor environments. For decades, CapaSystems has helped IT teams solve these exact challenges—long before “cloud-native” became the default. Built in Denmark with a strong engineering mindset, deep operational discipline, and a focus on reliability and security, CapaSystems earned its reputation by delivering solutions that worked in real-world enterprise environments. That heritage matters. As organizations moved to the cloud, the same operational gaps re-emerged in new forms. Managing third-party applications, drivers, vulnerabilities, assets and administrative privileges often meant running multiple point solutions alongside Intune. Over time, this approach leads to tool sprawl—where complexity grows, costs rise, and visibility suffers. CapaOne was created to change that. Built on decades of endpoint expertise, CapaOne is a fully cloud-native platform that works with Microsoft Intune, or entirely without it, consolidating critical endpoint operations into a single, unified operational layer. It allows IT teams to manage endpoints more simply, securely, and efficiently—without replacing the Microsoft ecosystem they already rely on. This is not a break from our past. It is the next evolution of everything we’ve learned—re-architected for a cloud-first, global future. ### Built for the Realities of Modern IT Operations CapaOne is designed for IT/system administrators, IT Managers, IT Support Teams, and IT Executives who need clarity, speed, and control in an increasingly complex landscape. By unifying patch management, driver updates, vulnerability handling, asset visibility, mobile device management, and privileged access control into one platform, CapaOne helps organizations: - Reduce operational complexity and tool sprawl - Strengthen security posture across diverse device environments - Lower total cost of ownership - Scale endpoint operations without adding friction Just as importantly, CapaOne is European-built and European-hosted, supporting data sovereignty and compliance with frameworks such as GDPR and NIS2. In a world of heightened geopolitical and regulatory awareness, this provides organizations with confidence—not just in their tools, but in their long-term technology strategy. ### A Clear Vision: Simpler, Smarter, More Secure Endpoint Management The launch of CapaOne is underpinned by a clear and focused vision: To be the leading experts in smart and simple endpoint management solutions. Our mission is equally practical: to create intelligent endpoint management solutions—through software, consultancy, and alliances—that reduce complexity, cut costs, and solve real operational challenges, so IT teams can focus on what matters most. This vision reflects how we believe endpoint management should work: - Smart, through automation and intelligent design - Simple, through consolidation and intuitive workflows - Secure and stable, by design—not as an afterthought ### A Complete Platform, Designed to Work as One CapaOne is a complete platform with an integrated product suite that includes: - Application Manager: Combines application packaging, distribution, and patch automation in one streamlined workflow. - Privilege Manager: Empowers IT teams with just-in-time admin access and complete audit trails to enforce least-privilege across the organization. - Provision Manager: Automates bare-metal OS deployment and driver orchestration to keep every device stable, secure, and fully compatible. - Mobile Manager: Delivers unified enrollment, configuration, and management for iOS, iPadOS, and Android devices. - Experience Monitor: Provides real-time visibility into endpoint health, performance, and user experience across your environment. - Security Monitor: Strengthens endpoint protection with policy enforcement, vulnerability detection, and automated remediation. ### A Brand Identity That Reflects Where We’re Going Alongside the launch of CapaOne, we are also introducing a new brand identity—one that reflects both our heritage and our ambition. At the heart of the new logo is a subtle but meaningful idea. The intentionally designed split “O” represents consolidation: different parts coming together to form one complete solution. It also reflects the connection between the “C” and “O” in CapaOne—reinforcing the promise of a single, unified platform that replaces multiple tools. The modern, clean look and feel signals clarity, trust, and professionalism—qualities IT decision-makers expect from the platforms they depend on. This evolution is intentional. It captures where we come from, while clearly signaling where we are going. ### Looking Ahead CapaOne represents the next stage of growth for CapaSystems—and a long-term commitment to helping IT professionals manage endpoint operations more effectively in an increasingly demanding cyber security landscape. As threats evolve, regulations tighten, and environments grow more complex, IT teams need solutions that simplify rather than add burden. With CapaOne, our goal is clear: one platform, full control, built for the future of endpoint management. This is just the beginning. So, watch this space… Read the launch press release here Written by Rikke Borup CMO, CapaSystems Rikke is Chief Marketing Officer at CapaSystems, where she has led marketing and communications since 2009. With more than 17 years of experience in the IT sector — including cybersecurity, endpoint management software and IT services — she brings long-standing, practical insight into the challenges facing modern enterprise IT environments. Trained as a journalist, Rikke specializes in translating complex technical concepts into clear, easy-to-understand communications for IT decision-makers. More from Rikke Borup → LinkedIn ↗ Book a Demo → --- URL: https://capaone.com/blog/5-steps-to-modern-application-deployment/ Published: 2026-01-12 Summary: Application Manager automates application deployment and updates across your endpoint estate — with fewer failed installs. ← All whitepapers eBook ## 5 Steps to Modern Application Deployment How IT teams standardize packaging, automate delivery, and scale application deployment — without added tools or complexity. By Rikke Borup, CMO, CapaSystems · January 12, 2026 ### Introduction to the eBook Application deployment has become one of the most time-consuming and unpredictable tasks in modern IT operations. As application estates grow and update cycles accelerate, manual packaging, scripts, and fragmented tools struggle to keep up. Even with Microsoft Intune in place, many organizations face inconsistent deployments, limited visibility, and growing operational drag — especially in hybrid environments. Tool sprawl only adds complexity and risk. This eBook introduces a practical 5-step framework for modern application deployment — helping IT teams standardize packaging, automate delivery, and create a faster, more reliable deployment model without added complexity. ### What You Will Learn - Standardize application packaging for predictable outcomes - Automate deployment and updates across the estate - Reduce deployment errors and failed installations - Scale application delivery with fewer tools and workflows ### How CapaOne Strengthens Modern Application Deployment CapaOne strengthens application deployment by standardizing packaging, automating delivery, and giving IT teams continuous visibility into deployment posture across the endpoint estate. Application Manager delivers and updates applications automatically — with staged rollouts, automatic detection and remediation, and audit-ready reporting — so software stays current and consistent, with or without Microsoft Intune. The eBook’s five-step framework maps directly to the platform: Step 1 — Standardized packaging: Application Manager standardizes application packaging with no-code PowerBricks, so every deployment starts from a consistent, predictable definition. Step 2 — Automated delivery and updates: It delivers and updates applications automatically from a maintained enterprise catalog, keeping software current across the estate without manual work. Step 3 — Detection and remediation: It detects whether each endpoint needs an install, skips compliant devices, and remediates the rest — so effort goes only where it is needed. Step 4 — Resilient rollouts: Staged test and production rollouts, automatic retries with backoff, and version rollback reduce deployment errors and failed installations. Step 5 — Scale with fewer tools: Entra ID group targeting, scheduled workflows, and a single console let IT teams scale application delivery with fewer tools and workflows. ### Frequently Asked Questions #### Which Applications Are Supported for Automatic Updates? Application Manager maintains a broad, actively updated catalog of enterprise applications — browsers, runtimes, productivity, security, and utilities. Your own business apps can be onboarded with no-code packaging. #### Can I Control Rollout Speed and Target by Group or Site? Yes. Application Manager controls rollout speed and targeting with test and production stages, Entra ID group targeting, scheduled workflows, and a globally distributed edge for fast content delivery. #### How Do You Detect Whether an Endpoint Needs an Install? Application Manager detects install state automatically. Compliant endpoints are skipped, and non-compliant endpoints are remediated. #### What Happens If an Install Fails? Failed installs are retried automatically with backoff, logged in detail in the dashboards, and can be rolled back by uninstalling a version when needed. #### Can I Package Apps Without Scripting? Yes. Application Manager uses PowerBricks for common packaging tasks with no scripting, and you can add your own PowerShell snippets for advanced scenarios. #### How Does Application Manager Work With Intune Day-to-Day? Application Manager runs alongside Intune. You keep Intune for enrollment, security, and policy, while Application Manager targets your existing Entra ID groups and publishes apps alongside your current deployments. #### What Compliance Reporting Is Available? Application Manager reports compliance posture in real time by app and endpoint, and evidence can be exported to CSV for audits. #### How Quickly Can We Start? Onboarding is typically same-day: install the lightweight agent, sync inventory, set baselines, run a test, and promote to production. --- URL: https://capaone.com/blog/5-tools-you-can-replace-with-one-platform/ Published: 2026-01-12 Summary: Tool Overload: CapaOne simplifies your daily endpoint management routine by unifying +5 tools in one platform - CapaOne ← All articles Blog ## 5+ Tools You Can Replace With One Platform Tool Overload: CapaOne simplifies your daily endpoint management routine by unifying mobile device management, application and driver deployment, and privilege access management in one platform By Rikke Borup, CMO, CapaSystems · January 12, 2026 ### Introduction: The Tool Overload Problem If your IT stack looks like a patchwork quilt of tools, you’re not alone. Most organizations running Microsoft Intune still rely on several disparate tools to fill everyday gaps — from patching and driver updates to privilege management and reporting. Each one comes with its own SLA, console, support, and update cycle. The result? - Cumbersome compliance operations - Too many consoles/interfaces - Too many agents - No single source of truth In 2024, Gartner reported that 71% of IT leaders plan to consolidate endpoint tools within the next 18 months. The question isn’t if you should consolidate — it’s where to start. And one enterprise suite is not automatically sized for a mid-market team — consolidating onto the wrong platform just changes what kind of overhead you’re carrying. ### The New Standard: Intune + CapaOne Microsoft Intune offers strong security and policy control, but it doesn’t handle every operational detail. CapaOne completes the picture — automating all the repetitive endpoint tasks Intune doesn’t cover, from patch management to privilege elevation — all within one platform. Together, they eliminate the need for multiple overlapping tools. ### The 5+ Tools You Can Replace With CapaOne 1) Patch Management Software What you’re using today: Tools like PatchMyPC, RoboPacks or Heimdal for third-party and OS patching. Why you don’t need them: CapaOne Application Manager automates patch deployment for both third-party and business applications, with or without Intune in the stack. Outcome: - Unify patch operations and visibility across all applications - Eliminate scripts from daily update operations - Skip repackaging for third-party applications - Generate compliance reports in minutes 2) Driver Management Utilities What you’re using today: Dell Command Update, Lenovo System Update, or HP Support Assistant Why you don’t need them: CapaOne Provision Manager intelligently matches the latest vendor-validated driver pack to each specific hardware model, delivering automated deployment to ensure system reliability. Outcome: - Automate driver updates end-to-end - Schedule updates with predictable timing - Improve endpoint stability and reliability - Reduce manual driver handling - Lower driver-related support tickets - Deliver a smoother user experience No more manual driver discovery, download scramble or vendor-specific workflows. 3) Privilege Management Tools What you’re using today: AdminByRequest, BeyondTrust, or CyberArk EPM. Why you don’t need them: CapaOne Privilege Manager delivers secure, time-bound administrative privileges on demand — with audit logs and automatic revocation. Outcome: - Eliminate standing local administrator permissions - Grant just-in-time (JIT) access on demand - Complete audit history for every elevation Enforce the principle of least privilege (PoLP) with zero friction. 4) Observability & Monitoring Tools What you’re using today: Lansweeper, Nexthink, or ControlUp Why you don’t need them: CapaOne Experience Monitor provides real-time visibility into endpoint health, reliability, and performance—all within a single, unified platform.” Outcome: - Proactively identify endpoint issues - Eliminate repeating incidents - Correlate changes with stability - Prioritize support workflows Unify total endpoint visibility within a single data feed. 5) Vulnerability & Security Monitoring Tools What you’re using today: SecTeer VulnDetect, Tenable Nessus, or Heimdal Why you don’t need them: CapaOne Security Monitor provides total visibility into your software estate, automatically prioritizing the risks that pose the greatest threat to your business. It delivers push-button remediation directly into your current environment, keeping your software updated and your endpoints protected – effortlessly. Outcome: - Monitor security posture across apps, drivers, and configurations - Prioritize by impact, based on scale and severity - Accelerate remediation via integrated update actions - Validate compliance with exportable, audit-ready evidence and reporting. Move beyond fragmented vulnerability data and gain clear, actionable insights into endpoint exposure. 6) Reporting & Compliance Platforms What you’re using today: Power BI dashboards, Excel exports, or proprietary solutions*.* Why you don’t need them: CapaOne centralizes audit logs, patch evidence, and endpoint metrics - EU-hosted and audit-ready. Outcome: - Generate compliance reports instantly - Eliminate the friction of complex cross-tool merges - Create live telemetry based reports - Simplify NIS2 and GDPR reporting Consolidated reporting in seconds - without the cross-tool chase ### What Consolidation Looks Like in Practice Before CapaOne: - 5+ disparate tools - 5+ different support points - Several overlapping systems - Countless patching scripts After CapaOne: - 1 unified cloud platform - 1 single support point - Automated deployments - Streamlined workflows Simplified endpoint management - with zero manual overhead ### Frequently Asked Questions **Which Endpoint Tools Can CapaOne Replace?** CapaOne consolidates the point tools teams commonly run for third-party application patching, driver lifecycle management, privilege elevation, endpoint monitoring and reliability, and mobile device management. One platform covers these functions with shared data and workflows — removing several separate consoles, agents, and vendor contracts. **Can One Platform Really Cover Patching, Drivers, Privilege, and Mobile?** Yes — and the concern behind the question is usually depth, not breadth. CapaOne runs these as full functions on one agent and one data model, not thin add-ons. Because they share the same data, an issue found in one surfaces in the others without an export or handoff. **What Happens to Existing Vendor Contracts When You Consolidate?** As CapaOne takes over each function, teams retire the matching point tools and let those contracts lapse at renewal. Most organizations phase this over time rather than all at once — validating each capability in CapaOne first, then decommissioning the tool it replaces. **Do You Lose Any Capability by Moving to a Single Platform?** Rarely the capability you use day to day. Where a specialist tool still meets a requirement no platform module matches, keep it and consolidate around it. What teams usually gain is a single view across functions that separate tools never shared — so a driver problem, an outdated application, and a privilege event show up in the same place. Less switching, fewer blind spots. Written by Rikke Borup CMO, CapaSystems Rikke is Chief Marketing Officer at CapaSystems, where she has led marketing and communications since 2009. With more than 17 years of experience in the IT sector — including cybersecurity, endpoint management software and IT services — she brings long-standing, practical insight into the challenges facing modern enterprise IT environments. Trained as a journalist, Rikke specializes in translating complex technical concepts into clear, easy-to-understand communications for IT decision-makers. More from Rikke Borup → LinkedIn ↗ Book a Demo → --- URL: https://capaone.com/blog/how-to-reenroll-apple-devices-in-capaone-mobile-manager/ Published: 2026-01-12 Summary: How to Reenroll Apple Devices in CapaOne Mobile Manager - read the knowledge article from the CapaOne technical team ← All articles Knowledge Hub ## How to Reenroll Apple Devices in CapaOne Mobile Manager By CapaOne Support · January 12, 2026 This guide explains how to reenroll an Apple device in CapaOne Mobile Manager. By the end, you will know how to reenroll a device either with or without retaining its previously assigned apps, groups, and configurations. ### Prerequisites Before re-enrolling a device, ensure you have: - Access to the device - Access to CapaOne Mobile Manager ### Configuration / Steps #### Reenrolling a Device Without Existing Apps and Configurations Use this method if you want the device to be treated as a completely new enrollment with no links to previous apps, groups, or configuration policies. - Locate the device in CapaOne Mobile Manager. - Open the device page. - Click the three dots (action menu). - Select Request → Wipe. The device will reset to factory settings. When it is enrolled again, it will be treated as a clean installation with no previous MDM associations. #### Reenrolling a Device With Existing Apps and Configurations Use this method if you want the device to reenroll and automatically re-link to the same groups, applications, and configurations as before. - On the device, go to: Settings → General → Transfer or Reset iPhone/iPad - Tap Erase All Content and Settings. The device will reset. After going through the enrollment process again, it will automatically reconnect to: - The same groups - Previously assigned apps - Existing configurations ### Maintenance & Best Practices - Use Request → Wipe when you want a completely fresh start without any inherited policies. - Use Erase All Content and Settings when you want to preserve previous app/config associations. - For DEP devices, ensure that the correct default enrollment configuration is active in CapaOne. Book a Demo → --- URL: https://capaone.com/blog/capaone-isc-consulting-engineers-isc-will-always-recommend-capa-products/ Published: 2026-01-11 Summary: ISC Consulting Engineers is an engineering and consulting firm with approximately 330 employees - they use CapaOne in the IT department ← All case studies Case Study · Engineering & consulting ## CapaOne & ISC Consulting Engineers: ISC Will Always Recommend CapaProducts A Trusted Collaboration Supporting Daily IT Operations. By Rikke Borup, CMO, CapaSystems · January 11, 2026 Book a Demo More case studies → Engineering & consulting Industry ~270 PCs managed 250 Mobile devices 2012 Customer since I will always recommend CapaSystems. They are indispensable if you, like us, have a complex environment. They deliver, meet all requirements, and then some – but the human factor, where we as customers feel heard, understood, and always experience that the task is handled with care, is truly unique. Thomas Dennig Team Lead IT, ISC Consulting Engineers ISC Consulting Engineers is a Danish engineering and consulting firm with approximately 330 employees working in construction, civil works, and infrastructure. The IT department consists of six employees who manage around 270 PCs and 250 mobile devices across the organization. ISC has been a CapaSystems customer since 2012 — a long-term collaboration that, according to Team Lead IT Thomas Dennig, is “no coincidence.” Business Challenge ### Maintaining Control, Security, and Efficiency Across a Mixed Device Landscape With hundreds of devices and increasing security requirements, ISC needed solutions that ensured consistent updates, controlled administrator rights, and reliable mobile device management. Many of these tasks can require significant manual effort, especially within a complex environment. After a CIS18 audit, it became clear that ISC would need to intensify work around security tasks and processes. Thomas highlights that having a partner who understands their system and workflows is essential as demands grow. The Solution ### On-Premise CapaInstaller Combined With CapaOne Cloud Products Since its early days, ISC has used the on-premise, CapaInstaller, as its Unified Endpoint Management solution. When CapaSystems introduced the first CapaOne cloud products, ISC was among the first to test them and provide input. Today, several CapaOne services play a central role in daily operations: - CapaOne Application Manager automatically updates third-party software through workflows - CapaOne Provision Manager ensures simple and automatic driver updates - CapaOne Privilege Manager controls privileged administrator rights - CapaOne Mobile Manager manages and secures mobile devices The Outcome ### Automation, Security, and a Partner That “has Our Back” CapaOne has reduced the amount of manual maintenance required across ISC’s device environment. Driver and software updates run automatically, privileged rights are controlled through CapaOne Privilege Manager, and mobile devices are managed efficiently through CapaOne Mobile Manager. But for ISC, the outcome is about more than software. Thomas describes CapaSystems as a partner that repeatedly proves “they have our back,” adding that this support is “invaluable and priceless.” He emphasizes the trusted relationship and the value of working with a supplier that understands their environment and can respond quickly when needed. After the CIS18 audit, ISC is working even more actively with CapaOne to meet the security requirements that lie ahead. The Highlights ### Key Outcomes for ISC Consulting Engineers - Daily automated updates of drivers and third-party software - Controlled and trackable handling of privileged rights - Mobile device security via CapaOne Mobile Manager - Tools that support work toward CIS18 security compliance - A trusted supplier relationship built on understanding, responsiveness, and collaboration - A partner that “meets all requirements — and then some” - Support that ISC describes as “invaluable” and “priceless” The Platform ### CapaOne products used #### Application Manager Simplifies packaging, accelerates deployment, and automates updates for third-party and business applications, resulting in optimal endpoint performance and a fortified security posture. Explore Application Manager #### Privilege Manager Enforces least-privilege with policy-based elevation and no standing local admin. Supports process or session elevation using existing Entra ID groups, with logging for governance. Explore Privilege Manager #### Provision Manager Automates bare-metal OS deployment and driver orchestration in a cloud-native workflow, enabling IT to provision and recover Windows devices from anywhere. Explore Provision Manager #### Mobile Manager Unifies enrollment, configuration, compliance, and app delivery across iOS, iPadOS, and Android. Gives IT clear posture visibility and essential remote actions in one place. Explore Mobile Manager FAQ ### Questions we get asked Anything else? Talk to our team → **How Does a Six-Person IT Team Manage 270 PCs and 250 Mobile Devices?** Six IT employees cover roughly 270 PCs and 250 mobile devices at ISC Consulting Engineers. Automation carries the recurring load: workflows keep third-party software and drivers current, Privilege Manager holds administrator rights in check, and the mobile half runs through Mobile Manager. That leaves the team its hours for work that needs judgment. **How Does Endpoint Management Support a CIS18 Audit?** After a CIS18 audit, ISC Consulting Engineers intensified its work on security tasks and processes. Automated updates and controlled, trackable handling of privileged rights support that work directly, and the firm now uses CapaOne more actively to meet the requirements ahead. **How Fast Should a Vendor Respond When Endpoint Management Breaks?** A supplier that already knows the environment removes the explaining before the fixing starts. ISC Consulting Engineers has worked with CapaSystems since 2012 and points to responsiveness as a reason the collaboration lasted. **Do You Need a Separate Tool for Mobile Device Management?** ISC Consulting Engineers runs roughly 270 PCs alongside 250 mobile devices — close to an even split — and manages both through CapaOne. Mobile Manager covers the mobile half, so the IT team avoids running a second product alongside the one handling Windows. ### Want results like this on your estate? See CapaOne on your own devices — standalone or alongside Intune. Most teams are up and running in under 30 minutes. Book a Demo View Pricing --- URL: https://capaone.com/blog/capaone-lattec-security-significantly-enhanced/ Published: 2026-01-11 Summary: Lattec strengthened endpoint security by removing local admin rights with CapaOne. Read how this technology organization gained control. ← All case studies Case Study · Agricultural technology ## CapaOne & Lattec: Security Significantly Enhanced A One-person IT Department Supporting 60 Employees. By Rikke Borup, CMO, CapaSystems · January 11, 2026 Book a Demo More case studies → Agricultural technology Industry 60 Employees 1 person IT team 2× daily Update checks I more or less use the entire CapaOne suite and am particularly fond of the workflow functionality. Every day at 10 a.m. and 2 p.m., CapaOne checks that all drivers and applications are up to date — and if they’re not, it’s handled automatically. Users don’t notice it, and I know everything is under control. Thomas Fest IT System Administrator Lattec A/S is a Danish technology company located in Lillerød, specializing in advanced software and sensor solutions for the agricultural sector, with a strong focus on dairy production. IT System Administrator Thomas Fest joined in 2024 with the goal of elevating IT operations and supporting 60 colleagues as a one-person IT department. To achieve this, he relied on CapaSystems solutions from day one. Business Challenge ### Managing Security, Updates, and Daily Operations Alone As the sole IT resource, Thomas needed a setup that could automate routine tasks, strengthen security, and ensure stable operations across all devices. Key recurring responsibilities included keeping applications and drivers updated, ensuring compliance, and maintaining a secure environment for employees working both in-office and remotely. Lattec required a solution that minimized manual work and ensured consistent protection against vulnerabilities and attacks. The Solution ### Automation and Visibility With On-Premise CapaInstaller and CapaOne Cloud Products Lattec uses the on-premise, CapaInstaller, as its Unified Endpoint Management solution with several CapaOne cloud products to automate daily operations and maintain compliance. Thomas highlights the value of workflow automation, which checks for updates twice daily at 10:00 and 14:00 and handles them automatically. Key solutions include: - CapaOne Provision Manager to update drivers automatically - CapaOne Application Manager to ensure applications stay up to date - CapaOne Privilege Manager to manage user permissions securely - CapaOne Security Monitor to provide continuous insight into security posture Implementation was straightforward, supported by CapaSystems consulting. CapaOne’s web-based platform and intuitive workflows made setup quick, and automation now runs reliably without manual intervention. The Outcome ### High-Level Automation, Improved Security, and Peace of Mind CapaOne has significantly reduced the manual work required to maintain security and compliance at Lattec. Devices remain protected against vulnerabilities through continuous updates of drivers and applications. Privilege Manager simplifies the process of scaling permissions up or down, supporting a secure IT environment. Security Monitor ensures the necessary overview to maintain compliance with security standards. Automation has created stability and enabled Thomas to focus on more critical tasks, regardless of whether employees work on-site, remotely, or abroad. The Highlights ### Key Improvements Experienced by Lattec - Significantly enhanced security through continuous updates - Automated checks and updates twice daily - Reduced manual work for a one-person IT department - Quick and simple system implementation - Secure management of user permissions through Privilege Manager - Compliance supported through Security Monitor - Stable and efficient IT operations across all devices The Platform ### CapaOne products used #### Application Manager Simplifies packaging, accelerates deployment, and automates updates for third-party and business applications, resulting in optimal endpoint performance and a fortified security posture. Explore Application Manager #### Privilege Manager Enforces least-privilege with policy-based elevation and no standing local admin. Supports process or session elevation using existing Entra ID groups, with logging for governance. Explore Privilege Manager #### Provision Manager Automates bare-metal OS deployment and driver orchestration in a cloud-native workflow, enabling IT to provision and recover Windows devices from anywhere. Explore Provision Manager #### Security Monitor Surfaces configuration drift and vulnerability insights across endpoints, providing IT with clarity on exposure and security gaps. Explore Security Monitor FAQ ### Questions we get asked Anything else? Talk to our team → **Can One Person Handle IT Security for 60 Employees?** Lattec runs endpoint operations for 60 employees with a single IT administrator. Automated workflows handle driver and application updates, Privilege Manager controls permissions, and Security Monitor provides the overview needed to maintain security standards. **How Often Should You Check Devices for Missing Updates?** Lattec checks twice daily, at 10:00 and 14:00. If drivers or applications fall behind, the workflow updates them automatically, and users do not notice the process running. **How Do You Secure Devices for Employees Working Remotely or Abroad?** Lattec applies the same automated updates and permission controls regardless of where the device sits. Continuous driver and application updates keep endpoints protected whether employees work on-site, remotely, or from another country. **How Do You Raise and Lower User Permissions Safely?** Privilege Manager lets Lattec scale permissions up or down as needed, rather than leaving users with standing local administrator rights. The single IT administrator adjusts access when the work requires it and removes it again afterward. ### Want results like this on your estate? See CapaOne on your own devices — standalone or alongside Intune. Most teams are up and running in under 30 minutes. Book a Demo View Pricing --- URL: https://capaone.com/blog/how-to-migrate-apple-devices-to-capaone-mobile-manager/ Published: 2026-01-11 Summary: How to Migrate Apple Devices to CapaOne Mobile Manager - read the knowledge article from the CapaOne technical team ← All articles Knowledge Hub ## How to Migrate Apple Devices to CapaOne Mobile Manager By CapaOne Support · January 11, 2026 This guide explains how to migrate Apple devices (DEP-enrolled, running iOS 16 or higher) from your current MDM solution — such as CapaInstaller or another provider — to CapaOne Mobile Manager. By the end, you will be able to prepare your CapaOne environment, assign devices to the new MDM server in Apple Business Manager, and verify migration of all eligible devices. ### Prerequisites Before starting, make sure you have: - Devices enrolled in Apple Business Manager or Apple School Manager (ABM/ASM) - Devices running iOS 16 or higher (Apple requirement) - Access to ABM/ASM for both your current MDM server and CapaOne - Your desired apps, profiles, and configurations prepared in CapaOne - A default DEP enrollment configuration (recommended) Tips before migrating: - Start the migration by migrating a single device and ensuring that your setup in CapaOne matches your desired requirements before migrating a large number of devices. - All configurations and apps will stay on the device after migration. They will only be overwritten when new configurations and apps of the same type are applied in CapaOne. - For a guide on DEP setup, see: How to Enroll DEP Devices in CapaOne Mobile Manager ### Configuration / Steps #### 1. Plan Your Migration 1. Inventory Devices in Your Current MDM Note the following: - Device models - iOS versions - Which devices are Supervised or Unsupervised 2. Communicate with Your Users Users will receive prompts during migration. Inform them in advance. 3. Ensure Apple Business Manager Access You must have access to the ABM account connected to both the old MDM server and the CapaOne MDM server. 4. Test with a Single Device Before migrating at scale: - Migrate one device or enroll one device directly into CapaOne - Verify that apps, Wi-Fi profiles, VPN, email, restrictions, and other settings behave as expected #### 2. Prepare CapaOne for Migration 1. Recreate Assets in CapaOne Review configurations and applications applied in your current MDM setup and recreate equivalents in CapaOne. For general Apple setup in CapaOne, see: iOS Management Setup in CapaOne Mobile Manager 2. Create a Default Enrollment Configuration (Recommended) - Navigate to Enrollment. - Create a new enrollment configuration. - Add required applications. Select apps to be automatically installed after migration. - Add required configurations, such as: - Wi-Fi profiles - VPN - Email settings - Restrictions - Other policies needed after enrollment - Assign groups. Link groups to ensure apps and policies deploy immediately after enrollment. - Save and verify the configuration. 3. Set as Default DEP Enrollment Configuration Mark the new enrollment configuration as default for DEP devices. This is done from the action menu on the enrollment profile. #### 3. Migrate Devices to CapaOne - Log in to Apple Business Manager and navigate to Devices. - Search and select devices to migrate. - Click the action button (top right) → Assign Device Management → choose CapaOne. - Set a migration deadline: - Click + Add Deadline and set an enrollment deadline - Click Continue through the steps Note: The deadline button is disabled if the device does not meet Apple’s migration requirements. Apple Business Manager may take time to acknowledge new OS updates. #### 4. Verify Migration in CapaOne 1. Confirm DEP Synchronization Navigate to: CapaOne Apple → Endpoints → DEP Check that the device’s serial number appears. If the device does not automatically sync, click Synchronize. 2. Automatic Enrollment Behavior If you have set a default DEP enrollment profile, the device will: - Automatically receive the new enrollment request, and - Prompt the user to start the migration If the user declines, the device will migrate automatically at the set ABM deadline. 3. If the Device Was Previously Enrolled in CapaOne You must manually assign an enrollment profile: - Go to Endpoints → DEP - Open the Action menu for the device - Select Assign Enrollment - Choose the desired enrollment configuration ### Maintenance & Best Practices - Validate all apps/configurations on a test device before mass migration - Ensure all devices run iOS 16 or higher - Monitor the DEP list in CapaOne during the migration phases - Plan migration deadlines so users are prepared for prompts - Always set a default DEP configuration to streamline migration Book a Demo → --- URL: https://capaone.com/blog/executive-brief-digital-sovereignty-in-endpoint-management/ Published: 2026-01-10 Summary: Digital Sovereignty: Learn why EU-hosted, automation-first endpoint platforms are becoming critical to IT resilience ← All articles Blog ## Executive Brief: Digital Sovereignty in Endpoint Management By Rikke Borup, CMO, CapaSystems · January 10, 2026 Why EU-hosted, automation-first endpoint platforms are becoming critical to IT resilience. Europe’s IT leaders are facing a new kind of risk — one not defined by malware or downtime, but by data dependency. Cloud and endpoint management platforms built and hosted outside the EU often handle sensitive operational data — device telemetry and operational logs — across jurisdictions. With the introduction of NIS2 this model is under increased scrutiny. ### The Regulatory Shift New EU directives are transforming IT operations into compliance-critical functions. GDPR: Protects the privacy and personal data of individuals within the EU. NIS2: Sets a high common level of cybersecurity for critical infrastructure and essential services across the EU. DORA: Ensures digital operational resilience for the financial sector and its critical ICT providers. CRA: Establishes uniform cybersecurity requirements for hardware and software products throughout their entire lifecycle. Together, these frameworks have significantly increased expectations around data residency and audit transparency. IT leaders are increasingly exposed when relying on cloud providers that store and process endpoint data outside the EU — even when the data is considered non-personal. The same exposure follows ownership as much as location — an enterprise vendor’s ownership can matter more than its hosting region. ### The Challenge: Control Vs. Convenience Endpoint management has historically favored global SaaS models optimized for scale, not data sovereignty. These models come with trade-offs: - Endpoint telemetry often stored or mirrored outside the EU - Compliance reporting often designed around non-EU regulatory frameworks - Complex vendor chains with opaque sub-processor policies This creates risk exposure — both regulatory and reputational. For the public, financial and healthcare sectors, the question isn’t whether data sovereignty matters, but how quickly expectations are rising. ### The CapaOne Advantage: Sovereignty by Design Pillar | What It Means | How CapaOne Delivers | Data Residency | Endpoint management data is processed and stored within Europe. | EU-hosted infrastructure, operated under European jurisdiction. | Operational Transparency | Clear visibility into endpoint management actions. | Centralized logs and reporting for application updates, driver updates, and privilege elevation. | Zero-Trust Alignment | Alignment with modern least-privilege and zero-trust principles. | Works with or without Microsoft Intune, adding policy-based privilege control and visibility. | Automation With Control | Reducing manual effort while maintaining operational control. | Automated updates and governed workflows that support consistent operations. | ### Executive Takeaway: Resilience Is Regional Endpoint resilience is no longer just a technical metric — it’s a cornerstone of strategic sovereignty. By choosing EU-hosted, automation-first platforms like CapaOne, organizations gain: - Greater confidence that endpoint management data and operational logs are processed within Europe - Improved readiness for evolving EU regulations, including GDPR, NIS2, and CRA - Stronger alignment with the EU’s long-term digital autonomy goals ### Frequently Asked Questions **What Is Digital Sovereignty in Endpoint Management?** Digital sovereignty in endpoint management is control over which jurisdiction can legally reach your endpoint data — not just where that data physically sits. It applies to device telemetry, operational logs, and configuration data, not only personal data. The distinction matters because a data center in Frankfurt does not put data beyond the reach of the law that governs the provider operating it. CapaOne removes that ambiguity: endpoint management data is processed under European jurisdiction, EU-hosted, with no transfer of endpoint data to US jurisdiction. **Does EU Data Residency Alone Guarantee Digital Sovereignty?** No — residency and sovereignty are not the same thing. Data residency tells you where data is stored; sovereignty tells you whose law can compel access to it. A foreign-owned provider can be legally required to disclose data held in an EU data center, so residency without jurisdictional control is only a partial answer. Real sovereignty needs EU hosting plus European ownership, European operation, and a transparent sub-processor chain. CapaOne is Danish-built and EU-hosted, operated under European jurisdiction, so endpoint data stays under European control. **Why Does Non-Personal Endpoint Data Fall Under Sovereignty Concerns?** Because an inventory of your device estate, OS versions, and unpatched software is effectively a map of where an organization can be attacked — whether or not it counts as personal data. Endpoint telemetry and operational logs carry exactly that picture. When a non-EU platform stores or mirrors this data across jurisdictions, it becomes reachable by foreign legal demands, creating regulatory and reputational exposure even with zero personal data involved. This is why sovereignty-conscious organizations govern where all endpoint data is processed. CapaOne processes endpoint management data within Europe. **How Does CapaOne Support Digital Sovereignty?** CapaOne is Danish-built and EU-hosted, operated under European jurisdiction, with no transfer of endpoint data to US jurisdiction — sovereignty is a property of the architecture, not a setting bolted on later. Centralized logs and reporting give clear visibility into application updates, driver updates, and privilege elevation, and policy-based privilege control aligns with zero-trust principles. The platform works with or without Microsoft Intune, so an organization can run it as its primary endpoint platform or bring EU-jurisdiction control to an existing setup. **How Do NIS2, DORA, and the CRA Shape Endpoint Management Decisions?** They turn endpoint management from an operational detail into a board-level responsibility. NIS2 makes management personally answerable for cybersecurity measures across essential services, DORA holds financial organizations to strict operational-resilience standards, and the CRA sets security obligations across a product's entire lifecycle. All three raise the bar on data residency, audit transparency, and provable posture — pushing organizations toward endpoint platforms that process data within Europe and produce audit-ready evidence from everyday operations. CapaOne is EU-hosted and built to support that posture. **Is Digital Sovereignty Only a Concern for the Public Sector?** No — it has moved from a public-sector preference to a commercial due-diligence requirement. Government bodies led, but financial services, healthcare, and any organization inside a regulated supply chain now face the same scrutiny. Partners, investors, and auditors increasingly ask organizations to prove where their data is processed before signing — which makes sovereignty a procurement question across sectors, not a niche. CapaOne gives organizations in every regulated sector an EU-hosted, automation-first option. Written by Rikke Borup CMO, CapaSystems Rikke is Chief Marketing Officer at CapaSystems, where she has led marketing and communications since 2009. With more than 17 years of experience in the IT sector — including cybersecurity, endpoint management software and IT services — she brings long-standing, practical insight into the challenges facing modern enterprise IT environments. Trained as a journalist, Rikke specializes in translating complex technical concepts into clear, easy-to-understand communications for IT decision-makers. More from Rikke Borup → LinkedIn ↗ Book a Demo → --- URL: https://capaone.com/blog/capaone-ishoj-municipality-an-indispensable-piece-of-the-it-puzzle/ Published: 2026-01-09 Summary: Ishøj Municipality’s IT department consists of 21 employees, 14 of whom work directly with IT operations and support - and CapaOne is their tool ← All case studies Case Study · Municipal government ## CapaOne & Ishøj Municipality: An Indispensable Piece of the IT Puzzle A Large Municipal IT Department Managing Thousands of Devices. By Rikke Borup, CMO, CapaSystems · January 9, 2026 Book a Demo More case studies → Municipal government Industry 2,500+ Devices managed 21 IT team 2008 Using CapaInstaller since Today, CapaOne is an essential part of our IT preparedness. It ensures that our devices are always updated and ready for use. We’ve left much manual work behind. Everything operates automatically — especially Mobile Manager, which has made a huge difference for us. CapaOne takes care of updates without us lifting a finger. Especially with frequent browser updates, we wouldn’t have been able to keep up without automation. Victor Bjørke IT Systems Administrator, Ishøj Municipality Ishøj Municipality’s IT department consists of 21 employees, 14 of whom work directly with IT operations and support. They manage more than 2,500 devices across the municipality, making automation and consistency essential to maintaining stability and security. CapaOne has become a central part of daily operations, reducing manual effort and improving oversight, according to IT Systems Administrator Victor Bjørke. Business Challenge ### Reducing Manual Work While Maintaining High Security Managing thousands of devices required extensive manual work related to updates, configurations, and device onboarding. The team needed to ensure compliance with the Center for Cyber Security guidelines while supporting a large and varied device landscape. Frequent browser and software updates, driver updates, and mobile device configurations were particularly time-consuming. Ishøj Municipality needed a solution that could automate these workflows, reduce manual tasks, and strengthen IT security. The Solution ### Unified Endpoint Management Enhanced With CapaOne Cloud Services Since 2008, Ishøj Municipality has relied on the, on-premise product, CapaInstaller as its Unified Endpoint Management solution. Over time, they expanded their setup with several CapaOne cloud products to increase automation and visibility. Workflows now handle updates for drivers, third-party software, and browsers — ensuring compliance and reducing manual effort. Key solutions include: - CapaOne Provision Manager to update drivers automatically via workflows - CapaOne Experience Monitor to provide real-time insight into device status - CapaOne Mobile Manager to manage Android, iOS, and iPadOS devices Group-based configuration has made onboarding new mobile devices significantly easier: Support places a new device in the correct group, and the system automatically handles configuration and updates. Using Experience Monitor, the IT department can quickly generate reports on unstable devices, making it easy to take action and provide a better experience for end users. The Outcome ### Automation, Stability, and Clear Return on Investment CapaOne has reduced the amount of manual work required to keep devices updated and compliant. Automated browser, software, and driver updates ensure the municipality meets security requirements. Mobile device management has become more predictable and efficient, saving time across the IT department. The municipality has achieved a tangible return on investment, especially in its iPhone management workflows. Reset and onboarding processes no longer rely on users, significantly reducing both workload and frustration. CapaSystems Support is also highlighted for its value, offering personalised assistance from a team that understands Ishøj’s specific setup. The Highlights ### Key Improvements Experienced by Ishøj Municipality - Significant reduction in manual work through automation - Improved compliance with security guidelines - More efficient onboarding and management of mobile devices - Real-time visibility into device stability through Experience Monitor - Time savings on browser and software updates - Tangible ROI from streamlined iPhone management - Strong support experience due to supplier familiarity with the environment The Platform ### CapaOne products used #### Provision Manager Automates bare-metal OS deployment and driver orchestration in a cloud-native workflow, enabling IT to provision and recover Windows devices from anywhere. Explore Provision Manager #### Mobile Manager Unifies enrollment, configuration, compliance, and app delivery across iOS, iPadOS, and Android. Gives IT clear posture visibility and essential remote actions in one place. Explore Mobile Manager #### Experience Monitor Provides real-time reliability and performance analytics across endpoints, empowering IT to detect and resolve crashes, bottlenecks, and instability proactively. Explore Experience Monitor FAQ ### Questions we get asked Anything else? Talk to our team → **How Do You Onboard a New Mobile Device Without Manual Configuration?** Ishøj Municipality uses group-based configuration. Support places a new device in the correct group, and the system then applies configuration and updates automatically. The approach removed the manual steps from onboarding across more than 2,500 devices. **How Do You Keep Browsers Patched Across Thousands of Devices?** Workflows handle browser, software, and driver updates at Ishøj Municipality. The automation matters because browser releases arrive frequently — the IT department states that manual handling could not have kept pace. **Can Mobile Device Management Deliver Measurable Return on Investment?** Ishøj Municipality reports tangible return on investment, particularly in iPhone management. Reset and onboarding no longer depend on the end user, which lowers both the workload on IT and the frustration for employees. **How Do You Find Unstable Devices Before Users Report Them?** Experience Monitor gives the IT department real-time insight into device status and lets them generate reports on unstable devices. That makes it possible to act on a pattern rather than wait for individual tickets. ### Want results like this on your estate? See CapaOne on your own devices — standalone or alongside Intune. Most teams are up and running in under 30 minutes. Book a Demo View Pricing --- URL: https://capaone.com/blog/hidden-costs-tool-sprawl/ Published: 2026-01-09 Summary: Tool sprawl drains IT budgets and multiplies risk. See where the hidden costs hide — and how CapaOne removes them through consolidation. ← All articles Blog ## The Hidden Costs of Tool Sprawl By Rikke Borup, CMO, CapaSystems · January 9, 2026 Every IT department knows the pain of tool overload. Patching tools. Driver tools. Remote access tools. Permission elevation tools. Mobile Device Management solutions. Reporting modules. Each one purchased with good intent — yet, over time, they multiply and overlap. This “tool sprawl” now silently drains IT budgets, increases compliance risk, and slows operations. What once looked like flexibility has become complexity — and it’s costing far more than most organizations realize. ### What Exactly Is Tool Sprawl? Tool sprawl happens when IT teams stack point solutions across similar use cases — each one added to fill a gap the existing stack left open. For example, an organization with a core device management platform may add: - A third-party patching tool for non-Microsoft updates - A driver management utility for hardware consistency - A privilege access management tool for user rights - A module for endpoint telemetry or reliability metrics - A tool to handle packaging and application deployment Each tool might solve one problem, but together they create fragmentation and frustration. The result? Multiple vendors, frustrated employees, and duplicated data. IT teams spend as much time managing the management tools as they do managing endpoints. ### The True Cost of Tool Overlap You can’t see it in one invoice — but the cost of tool sprawl hides in four places: licenses, workload, training, and risk. #### License Overlap and Redundancy Licenses overlap first. Two tools bought by different teams end up doing the same job, and every renewal pays for both. Licenses nobody uses stay on the invoice, because nobody owns the decision to cancel them. If three tools manage patches, two manage application deployment, and two collect telemetry, the budget waste compounds fast. #### Integration and Maintenance Overhead Every extra tool means additional maintenance. Agent lifecycle management, cross-platform correlation, and integration governance. Admin hours increase, ticket queues expand, and every system change demands revalidation. Keeping those integrations alive takes time every week — time not spent on modernization or security. #### Training and Context Switching With multiple consoles, even simple actions require learning different interfaces, operations, and approval paths. Every switch between consoles costs focus, and that cost repeats every working day. Training new team members becomes a continuous cost. Each new hire requires certifications or shadowing for multiple systems. #### Audit Complexity and Compliance Risk When auditors request patch evidence, vulnerability logs, or privilege access reports, the data sits scattered across different consoles. Auditors rarely fault the patching itself; they fault the missing evidence, which is why endpoint patch management for audits starts with the record, not the rollout. Instead of one consolidated compliance view, teams chase CSV exports and screenshots. Every fragmented dataset introduces risk — gaps in evidence, delays in audits, and inconsistent reporting chains. ### The Hidden Cost Multiplier: Slow Decision-Making Beyond money, tool sprawl creates decision friction. With fragmented visibility, IT leaders lack a single version of truth for endpoint health, patch compliance, and security posture. That uncertainty ripples upward: - Delayed compliance sign-offs - Inconsistent reporting to finance and audit teams - Missed opportunities for optimization In short, tool sprawl creates fog where clarity should reign. ### Consolidation: The Simpler, Smarter Alternative Consolidation means bringing your endpoint management under one cohesive umbrella — fewer vendors, happier employees, and one data source. CapaOne Endpoint Management Platform replaces the point tools in that list with one cloud-native platform: one agent, one console, and one data model. Capability | What CapaOne does | Application Patching | Automating software updates across third-party and business applications | Application Management | Simplifying packaging and application deployment | OS Deployment and Drivers | Provisioning devices and orchestrating driver updates | Privilege Elevation | Enabling safe, time-bound admin access | Endpoint Insights | Providing visibility into endpoint reliability and performance | Mobile device governance | Unifying enrollment, configuration, and app deployment across iOS, iPadOS, and Android | With CapaOne, endpoint operations run on one platform and require one vendor relationship — offering IT consistency and clarity without multiple tools. CapaOne is a complete endpoint management platform — designed to work with Microsoft Intune, or entirely without it. Organizations that already run Intune keep it and retire the point tools around it. That is a different fix than folding everything into one enterprise suite sized for a much larger estate — enterprise platforms and mid-market platforms serve different teams, and consolidation only helps when the platform actually matches the team running it. ### What This Means for IT Leaders Lower Total Cost of Ownership (TCO). Consolidation reduces overlapping license costs and streamlines vendor management. You maintain one relationship instead of many. Simpler Oversight and Audit Readiness. Unified telemetry and clear reporting make audits faster and reduce operational stress. Improved Team Productivity. With one platform and standardized operations, onboarding becomes easier and automation takes over repetitive tasks. Improved Operational and Security Posture. Automation keeps application updates, driver updates, and privilege elevation consistent and documented — reducing reliance on disconnected tools. ### Quick Cost Model: What You Could Save Use the CapaOne pricing estimate to model your own figures. ### From Fragmentation to Focus Endpoint management should not be a patchwork of disconnected systems. It should be a unified, data-driven operation that reduces risk, simplifies compliance, and empowers your IT team to focus on strategic work. The cost of tool sprawl is real — but so is the opportunity to eliminate it. With CapaOne, IT teams gain simplicity, security, and strategic clarity — all in one platform. ### Frequently Asked Questions **How Much Does Tool Sprawl Actually Cost a Mid-Market IT Team?** For most mid-market teams, the hidden costs outweigh the license fees. The dominant driver is staff time — administrators moving between consoles, reconciling data, and repeating work across tools. Coverage gaps add a second, harder-to-see cost: exposure that surfaces only when something breaks. **What Hidden Costs Beyond Licenses Come From Multiple Tools?** Five recur: integration and maintenance work to keep tools talking; repeated training as staff learn each console; duplicated data entry across systems; time spent reconciling conflicting reports; and manual evidence-gathering at audit time. Each is small alone and significant combined. **How Do I Calculate the Total Cost of Ownership of My Current Stack?** Add three layers. First, every tool's annual license and renewal cost. Second, the staff hours each tool consumes — administration, reporting, troubleshooting — multiplied by a loaded hourly rate. Third, integration, training, and the risk cost of coverage gaps. That total is your real TCO baseline. **How Quickly Does Consolidation Typically Pay Back?** Two things drive payback: how many tools the platform retires and how much manual work it automates. Returns show first in reclaimed staff time and dropped renewals, then in fewer incidents and faster audits. CapaOne deploys in days, so the clock starts early. Written by Rikke Borup CMO, CapaSystems Rikke is Chief Marketing Officer at CapaSystems, where she has led marketing and communications since 2009. With more than 17 years of experience in the IT sector — including cybersecurity, endpoint management software and IT services — she brings long-standing, practical insight into the challenges facing modern enterprise IT environments. Trained as a journalist, Rikke specializes in translating complex technical concepts into clear, easy-to-understand communications for IT decision-makers. More from Rikke Borup → LinkedIn ↗ Book a Demo → --- URL: https://capaone.com/blog/mobile-governance-is-now-a-leadership-issue/ Published: 2026-01-09 Summary: Learn how regulation and rising accountability are redefining mobile security and compliance - Mobile Governance is a leadership issue ← All articles Blog ## Mobile Governance Is Now a Leadership Issue How regulation and rising accountability are redefining mobile security and compliance. By Rikke Borup, CMO, CapaSystems · January 9, 2026 Across Europe, leadership teams are introducing a new set of expectations for IT — and these questions are no longer optional: - Are we compliant with current and upcoming regulations? - Do we have full governance of mobile data? - Can we document our controls for audits? - Are we aligned with the requirements of NIS2? These concerns reflect a shift in responsibility. Data protection, mobile governance, and operational resilience have become executive-level obligations. When governance responsibility shifts upward, the pressure to deliver transparent, compliant, and consistent mobile controls moves directly to IT — and many organizations discover that their mobile environments are not governed with the same level of maturity as the rest of their security stack. Mobile governance can no longer be postponed. ### Why Mobile Devices Represent a Growing Governance Risk Mobile devices access business-critical systems, hold sensitive information, and follow employees everywhere they work. When they are inconsistently governed or entirely unmanaged, organizations face: - Compliance gaps under GDPR, NIS2, and sector regulation - Insufficient documentation, complicating audits and incident response - Security drift, as devices deviate from approved configurations - Increased risk in BYOD, remote, and frontline environments - Unclear accountability, especially where mobile data flows across systems Weak Mobile Device Management (MDM) is no longer a technical issue — it is a business risk. ### A More Mature Model for Mobile Device Management Choosing an MDM solution is not about features — it is about selecting a governance model that supports: - Mobile security compliance - Predictable, consistent configurations - Audit readiness and documentation - Clear accountability for mobile endpoints - Structured, scalable endpoint operations Before evaluating vendors, three strategic criteria should guide the decision — the three S’s: Specialist Competence Mobile governance requires expertise, not generic tooling. Organizations need a partner capable of advising, structuring, and operationalizing compliant mobile environments. Security First Security controls must be consistent and enforced centrally — across corporate, frontline, and BYOD devices. Sustainable Support Governance only succeeds when genuine specialists, not ticket-deflection workflows, deliver support. These criteria ensure that leadership can trust the maturity of the organization’s mobile device posture. ### A Governance-Driven Approach to Mobile Device Management Mobile Manager, part of the CapaOne Endpoint Management Platform, delivers a governance-focused approach to Mobile Device Management (MDM) — built for organizations that need clarity, compliance, and operational predictability. It provides: - Consistent policy enforcement across all mobile devices - ensuring predictable and compliant configurations across all device types. - Full visibility into compliance, configurations, and device status - enabling IT to detect drift and respond before issues become operational risks. - Structured onboarding for remote, hybrid, and frontline workers - ensuring controlled setup and governance from day one. - Predictable, secure application control - reducing shadow IT and ensuring only approved apps are used. - Lower operational burden through automation and unified workflows - simplifying repetitive tasks and keeping mobile operations consistent. - European data governance and EU-based hosting - ensuring mobile data remains under EU jurisdiction with clear oversight. Mobile Manager stands out by offering a comprehensive and reliable solution for managing and securing mobile devices — addressing our organization’s need for efficiency, security, and scalability. - Kofoeds Skole Mobile Manager removes fragmentation and provides a stable, end-to-end governance model — without hidden modules or additional licensing layers. ### A Stronger Foundation for Compliance and Control Regulatory expectations are increasing, and mobile devices are becoming a focal point in both audits and security assessments. Organizations that strengthen their MDM strategy now reduce avoidable risk and build a more resilient operational foundation. Mobile governance is no longer an IT initiative — it is an organizational requirement tied directly to compliance, security, and leadership accountability. ### Strengthen Your Mobile Governance With CapaOne See how the CapaOne Endpoint Management Platform and Mobile Manager support secure, compliant, and predictable Mobile Device Management (MDM) across your organization. Let’s align your mobile governance strategy with today’s regulatory landscape. ### Frequently Asked Questions **What Is Mobile Governance?** Mobile governance is the set of policies, controls and documentation that decides how mobile devices access and handle business data, and who is accountable for them. It covers configuration, app control and data protection across corporate, frontline and BYOD devices. Where a device inventory tells you what you have, governance tells you whether those devices are run to an agreed standard. **Why Is Mobile Device Management Now a Leadership Issue?** Data protection and operational resilience have become executive-level obligations, and mobile devices now access business-critical systems and hold sensitive data. With regulation such as GDPR and NIS2 in view, leadership teams ask IT whether mobile data is governed and whether controls can be documented. An inconsistently governed device is therefore a business risk, not only a technical one. **What Should Leadership Look for When Choosing an MDM Solution?** Look for a governance model rather than a feature list. Three criteria help: specialist competence to advise on and operationalize a governed mobile environment, security controls enforced centrally across corporate, frontline and BYOD devices, and sustainable support from genuine specialists. Then check that the platform delivers consistent policy enforcement and full visibility into device status. **How Does CapaOne Support Mobile Governance?** CapaOne Mobile Manager enforces consistent policies across iOS, iPadOS and Android devices, gives IT full visibility into compliance, configurations and device status, and controls which apps are used. It is part of the CapaOne Endpoint Management Platform: EU-hosted, with no transfer of endpoint data to US jurisdiction. Written by Rikke Borup CMO, CapaSystems Rikke is Chief Marketing Officer at CapaSystems, where she has led marketing and communications since 2009. With more than 17 years of experience in the IT sector — including cybersecurity, endpoint management software and IT services — she brings long-standing, practical insight into the challenges facing modern enterprise IT environments. Trained as a journalist, Rikke specializes in translating complex technical concepts into clear, easy-to-understand communications for IT decision-makers. More from Rikke Borup → LinkedIn ↗ Book a Demo → --- URL: https://capaone.com/blog/5-steps-to-maintain-a-secure-and-predictable-application-update-posture/ Published: 2026-01-07 Summary: Application Manager keeps applications continuously updated across the estate — reducing version drift and strengthening audit-ready governance. ← All whitepapers eBook ## 5 Steps to Maintain a Secure and Predictable Application Update Posture How IT teams reduce version drift, automate updates, and strengthen governance — for a secure, predictable application update posture. By Rikke Borup, CMO, CapaSystems · January 7, 2026 ### Introduction to the eBook For most IT organizations, application deployment is no longer the hard part. Keeping applications continuously updated is. Modern IT teams must maintain hundreds of applications across distributed endpoints — while update cycles accelerate and new vulnerabilities emerge. Manual updates, scripts, and fragmented workflows quickly lead to version drift, growing exposure, and rising operational effort. This eBook introduces a practical 5-step framework for maintaining a secure, predictable application update posture — helping IT teams reduce drift, automate updates, and strengthen governance without constant firefighting. ### What You Will Learn - Reduce version drift across the application estate - Automate application updates without scripts or manual effort - Maintain continuous visibility into application versions - Strengthen governance and audit readiness ### How CapaOne Strengthens Your Application Update Posture CapaOne strengthens your application update posture by automating updates, reducing version drift, and giving IT teams continuous visibility into which application versions run across the estate. Application Manager keeps applications current automatically — with staged rollouts, automatic detection and remediation, and audit-ready reporting — so exposure stays low and governance holds, with or without Microsoft Intune. The eBook’s five-step framework maps directly to the platform: Step 1 — Reduce version drift: Application Manager keeps applications on current, known-good versions across the estate, so drift does not accumulate between manual update cycles. Step 2 — Automate updates: It updates applications automatically from a maintained enterprise catalog, removing the scripts and manual effort that let updates fall behind. Step 3 — Continuous version visibility: It reports which application versions run on each endpoint in real time, so gaps are visible before they become exposure. Step 4 — Detection and remediation: It detects endpoints that fall out of compliance, skips those already current, and remediates the rest automatically. Step 5 — Governance and audit readiness: Real-time posture by app and endpoint, with evidence exportable to CSV, gives IT teams the record auditors ask for. ### Frequently Asked Questions #### Which Applications Are Supported for Automatic Updates? Application Manager updates a broad, actively maintained enterprise catalog — browsers, runtimes, productivity, security, and utilities. Business apps can be onboarded with no-code packaging. #### Can I Control Rollout Speed and Target by Group or Site? Yes. Application Manager uses test and production stages, targets Entra ID groups with scheduled workflows, and delivers content through a globally distributed edge architecture. #### How Do You Detect Whether an Endpoint Needs an Install? Application Manager detects endpoint state automatically. Compliant endpoints are skipped, and non-compliant endpoints are remediated. #### What Happens If an Install Fails? Application Manager retries automatically with backoff, records detailed logs in the dashboard, and can uninstall versions when needed. #### Can I Package Apps Without Scripting? Yes. Application Manager packages common tasks with built-in PowerBricks, and you can add your own PowerShell snippets for advanced scenarios. #### How Does Application Manager Work With Intune Day-to-Day? Application Manager runs alongside Intune. You keep Intune for enrollment, security, and policy, while Application Manager targets your existing Entra ID groups and publishes apps alongside your current deployments. #### What Compliance Reporting Is Available? Application Manager reports compliance posture in real time by app and endpoint, and evidence can be exported to CSV for audits. #### How Quickly Can We Start? Most teams start the same day. Install the lightweight agent, sync inventory, set baselines, run a test, and then promote. --- URL: https://capaone.com/blog/capaone-holbaek-municipality-operations-and-support-use-the-same-tool/ Published: 2026-01-07 Summary: Holbæk Municipality manages approximately 5,500 PCs across education, administration, and municipal services using CapaOne ← All case studies Case Study · Municipal government ## CapaOne & Holbæk Municipality : Operations and Support Use the Same Tool A Municipality with Shared IT Responsibilities Across Departments. By Rikke Borup, CMO, CapaSystems · January 7, 2026 Book a Demo More case studies → Municipal government Industry ~5,500 PCs managed ~30 IT team None Default admin rights The Reliability dashboard provides a quick and clear starting point for troubleshooting, allowing us to focus. Having to look at the same dashboards is a real advantage for us. Nicklas Parbst Sørensen IT Specialist, Holbæk Municipality Holbæk Municipality manages approximately 5,500 PCs across education, administration, and municipal services. Around 30 IT employees work across Digitalization, Operations, and Support. Regardless of department, the teams use the same system and the same dashboard, enabling a shared understanding of the IT environment. Business Challenge ### Creating a Common Foundation for Operations and Support With several departments involved in endpoint management, Holbæk Municipality needed a shared system that allowed employees to look at the same data and use the same terminology. The IT team also faced recurring tasks related to updating third-party software, identifying device issues, and managing administrator rights — areas where manual work could be time-consuming. Security requirements are increasing continuously, and the municipality must maintain a restrictive approach to administrator permissions and overall endpoint management. The Solution ### On-Premise CapaInstaller Combined With CapaOne Cloud Services Holbæk Municipality has used the on-premise product, CapaInstaller, since 2020 and later expanded to a hybrid setup that includes several CapaOne SaaS products: - CapaOne Application Manager to automate updates for third-party software via workflows - CapaOne Experience Monitor to gain an overview of potential device issues - CapaOne Privilege Manager as a PAM solution, particularly for the municipality’s schools The municipality follows a restrictive security model: employees do not have local administrator rights by default. Approved applications can be installed through the CapaInstaller software catalog; other installations require Support. The shared Capa environment strengthens collaboration across the department. The Outcome ### Shared Dashboards, Better Insight, and Earlier Detection of Issues CapaOne Experience Monitor gives Holbæk Municipality real-time insight into device status, making it easier to identify recurring problems across machines. This helped the IT department link a repeated Windows error to a specific third-party program by observing how often the issue appeared across devices. The reliability dashboard offers a clear starting point for troubleshooting and helps prioritize efforts quickly. Holbæk Municipality also uses CapaOne’s endpoint insights to see which devices require feature updates or have other update needs. The common dashboard ensures that Municipality’s Operations and Support teams speak the same language and base decisions on the same data. The Highlights ### Changes Experienced by Holbæk Municipality - Shared dashboard across IT departments for consistent understanding - Automated updates for third-party software - Real-time detection of device issues through Experience Monitor - Easier identification of recurring errors across machines - Restrictive security model supported through CapaOne Privilege Manager - Clear insight into update and feature-update needs - More efficient troubleshooting through unified data The Platform ### CapaOne products used #### Application Manager Simplifies packaging, accelerates deployment, and automates updates for third-party and business applications, resulting in optimal endpoint performance and a fortified security posture. Explore Application Manager #### Privilege Manager Enforces least-privilege with policy-based elevation and no standing local admin. Supports process or session elevation using existing Entra ID groups, with logging for governance. Explore Privilege Manager #### Experience Monitor Provides real-time reliability and performance analytics across endpoints, empowering IT to detect and resolve crashes, bottlenecks, and instability proactively. Explore Experience Monitor FAQ ### Questions we get asked Anything else? Talk to our team → **Should IT Operations and Support Use the Same Dashboard?** Holbæk Municipality gives both teams the same system and the same dashboard. Around 30 IT employees across Digitalization, Operations, and Support look at identical data, which means they use the same terminology and base decisions on the same picture. **How Does a Municipality Manage 5,500 PCs Without Default Admin Rights?** Holbæk Municipality follows a restrictive model: employees hold no local administrator rights by default. Approved applications install through the CapaInstaller software catalog, and any other installation goes through Support. Privilege Manager supports the model, particularly across the municipality's schools. **Why Does the Same Windows Error Keep Coming Back on Different Devices?** Experience Monitor shows Holbæk Municipality what happens on each machine as it happens. By observing how often the same issue appeared on different machines, the IT department traced a repeated Windows error to a specific third-party program. **What Does a Reliability Dashboard Change for Troubleshooting?** It gives the IT department a defined starting point. Holbæk Municipality uses the dashboard to spot recurring problems early and prioritize which devices need attention first, rather than investigating each report in isolation. ### Want results like this on your estate? See CapaOne on your own devices — standalone or alongside Intune. Most teams are up and running in under 30 minutes. Book a Demo View Pricing --- URL: https://capaone.com/blog/executive-editorial-data-sovereignty-today/ Published: 2026-01-07 Summary: Learn why data sovereignty is no longer a future concern — but a present obligation. CapaOne has published an Executive Editorial. ← All articles Blog ## Executive Editorial: Data Sovereignty Today Why data sovereignty is no longer a future concern — but a present obligation. By Rikke Borup, CMO, CapaSystems · January 7, 2026 European organizations are not preparing for a shift in digital risk — they are already operating in the center of it. Regulatory pressure is increasing, political conditions are shifting rapidly, and cross-border legal claims are forcing leadership teams to reconsider where responsibility for data sovereignty truly lies. This is no longer an IT discussion. It is a governance responsibility — one that directly affects accountability, operational resilience, and long-term strategic control. The fundamental question is clear: Who has legal authority over your data — and can that authority change without your consent? When sovereignty is uncertain, so is everything built on top of it: compliance, continuity, and trust. This is why data sovereignty is not a technical preference. It is a core leadership decision with direct implications for legal exposure and organizational stability. ### Why European Infrastructure Is Essential for True Data Sovereignty Cloud platforms are not neutral. They embody the laws, obligations, and political realities of the jurisdictions in which they operate. When infrastructure is governed outside the EU, organizations face risks they cannot fully control: - Foreign legal access, where non-EU authorities can request or mandate insight - Policy changes, capable of altering data rights overnight - Compliance complexity under GDPR, NIS2, and industry regulation - Operational uncertainty, driven by shifting geopolitical conditions This is why more organizations are turning to solutions built on EU-controlled infrastructure, where governance, access, and oversight are aligned with both data sovereignty and the broader European agenda for digital sovereignty. Ownership sits underneath every one of those risks — where a vendor is owned is a governance question, not just a hosting detail. ### What an EU-Aligned Cloud Partner Delivers EU Data Hosting Your data remains within the EU, in accordance with European law, thereby eliminating ambiguity regarding jurisdiction or third-country access. Sovereignty-by-Design A cloud model built for data sovereignty and digital sovereignty ensures that information cannot be accessed or inspected under foreign legal mandates. Stable, Predictable Conditions Clear, transparent terms. No surprise policy shifts. No need for exit strategies. You build on a foundation that remains consistent over time. ### A Strategic Commitment — Not a Technical Adjustment Choosing EU-based cloud infrastructure is not a technology choice. It is a commitment to organizational control and long-term resilience. A sovereignty-aligned environment ensures: - Greater governance control, keeping decisions internal - Higher resilience, shielded from geopolitical volatility - Simpler compliance, aligned with European regulation - Long-term trust, strengthening both customer confidence and internal assurance This is not preparation for the next regulatory wave. It is alignment with the realities of today’s digital landscape. ### Strengthening Your Organization for What Comes Next Security, compliance, and sovereignty will continue to shape Europe’s digital future. By adopting a cloud model designed around data sovereignty and grounded in European governance, organizations reduce avoidable risk, protect sensitive information, and ensure that their digital operations remain stable — regardless of external developments. ### How the CapaOne Endpoint Management Platform Supports Data Sovereignty If your organization is evaluating how to strengthen data sovereignty, governance, and operational control, we are ready to support that journey. The CapaOne Endpoint Management Platform is built for European organizations that need modern endpoint operations on EU-hosted infrastructure, with no transfer of endpoint data to US jurisdiction — supporting compliance work, data protection, and long-term predictability. Explore how a sovereignty-aligned cloud foundation and a platform engineered for European governance can strengthen your organization — today and in the years ahead*.* For the operational perspective on what this means for your endpoint stack — and where to start — read our latest analysis: European Endpoint Management and the US Dependency Problem → Written by Rikke Borup CMO, CapaSystems Rikke is Chief Marketing Officer at CapaSystems, where she has led marketing and communications since 2009. With more than 17 years of experience in the IT sector — including cybersecurity, endpoint management software and IT services — she brings long-standing, practical insight into the challenges facing modern enterprise IT environments. Trained as a journalist, Rikke specializes in translating complex technical concepts into clear, easy-to-understand communications for IT decision-makers. More from Rikke Borup → LinkedIn ↗ Book a Demo → --- URL: https://capaone.com/blog/5-steps-to-implement-an-effective-privileged-access-strategy/ Published: 2026-01-06 Summary: CapaOne Privilege Manager: time-bound, policy-based privilege elevation with audit-ready evidence and no standing local admin rights. ← All whitepapers eBook ## 5 Steps to Implement an Effective Privileged Access Strategy How to strengthen endpoint governance and meet modern compliance requirements By Rikke Borup, CMO, CapaSystems · January 6, 2026 ### Introduction to the eBook Privileged access has become a critical focus area for modern security and compliance teams. Regulations such as NIS2, ISO27001, and CIS Controls now require organizations to clearly control, document, and justify how administrative privileges are used across endpoints. Yet many organizations still rely on permanent local admin rights, informal elevation, and undocumented exceptions to keep daily operations running — creating unnecessary risk and audit exposure. This eBook introduces a practical 5-step framework for establishing time-bound, policy-driven privileged access that strengthens governance without slowing down IT operations. ### What You Will Learn - Eliminate standing local administrator rights without slowing operations - Implement time-bound, policy-based privilege elevation - Document every elevation event with audit-ready evidence - Establish clear governance for exceptions and approvals ### How CapaOne Strengthens Privileged Access Governance CapaOne turns the five-step framework into daily practice through Privilege Manager, the platform’s least-privilege engine. Privilege Manager removes standing local admin rights and replaces them with time-bound, policy-based elevation that stays consistent across every endpoint. The eBook’s five-step framework maps directly to the platform: Step 1 — Establish a Clear Least-Privilege Baseline. Privilege Manager defines acceptable privilege levels across user groups, roles, and devices, removes standing local admin rights, and identifies the legacy applications that still require elevation. Step 2 — Implement Time-Bound, Policy-Based Elevation. Users elevate only for approved tasks and only for the time needed, with every request limited in duration and tied to a justification. Step 3 — Introduce Structured Approval and Exception Workflows. Standard elevation follows automated policy, while non-standard or high-risk requests route to a documented approval, so exceptions stay controlled and reviewable. Step 4 — Monitor and Document All Elevation Events. Privilege Manager records who elevated, when, for how long, and why, building an audit-ready evidence trail. Experience Monitor adds operational context when elevated tasks affect endpoint reliability. That evidence trail is what turns elevation into governance — see how continuous logging and drift detection turn least privilege into something you can prove to an auditor. Step 5 — Consolidate Privileged Access Alongside Intune. CapaOne runs privileged access, endpoint visibility, and device-level governance in the same operational model you already use with Intune — fewer tools, consistent workflows, and predictable governance across endpoints. ### Frequently Asked Questions #### How Does Elevation Work in Practice? With Privilege Manager, a user requests elevation for a specific executable, and policy decides whether to auto-approve or deny it. Admin rights apply only to that executable and expire automatically. #### Can We Block Risky Tools by Default? Yes. Privilege Manager can deny-list risky tools such as shells or unsigned installers by default, requiring an explicit policy exception before they run. #### Do We Need to Keep Some Users as Local Admins? No. Best practice is to keep no standing local admin: routine tasks run through policy, and rare exceptions use break-glass elevation. #### What's Captured for Audits? Privilege Manager records each elevation event — the user, endpoint, binary details (executable name and app path), time, duration, and outcome — in an audit-ready log that is exportable for audits. #### How Do We Prevent Elevation From Lasting Too Long? Elevation is time-bound: set a short duration, and Privilege Manager auto-revokes admin rights when it expires. #### How Does Privilege Manager Work With Intune Day-to-Day? Privilege Manager runs alongside Intune. It targets elevation policies through your existing Entra ID groups and respects your current group structure, while your Intune compliance and configuration continue to run unchanged. #### What Happens Offline? When an endpoint is offline, Privilege Manager can apply cached policy decisions for low-risk tasks under strict time limits, then sync the queued logs once the device reconnects. #### Can Support Staff Grant Elevation Without Sharing Admin Creds? Yes. Support staff can authorize a scoped, time-bound elevation for a user without sharing or exposing local admin credentials. #### How Quickly Can We Roll This Out? Rollout is typically fast because the core configuration is simple. Most organizations follow a phased approach: remove standing local admin rights, apply standard policies to a set of test endpoints, then scale to departments with measured guardrails and reporting. --- URL: https://capaone.com/blog/efficient-software-deployment/ Published: 2026-01-06 Summary: Reduce complexity, eliminate hidden costs, and standardize application delivery across every endpoint - learn about efficient software deployment ← All articles Blog ## Efficient Software Deployment Reduce complexity, eliminate hidden costs, and standardize application delivery across every endpoint. By Rikke Borup, CMO, CapaSystems · January 6, 2026 Most IT departments are familiar with deploying applications. That’s not where the real challenge lies. The real problems sit around the process — hidden costs, extra tooling, consultant hours, and the ongoing effort needed to maintain workflows that should be straightforward. As endpoint environments grow, even routine deployment tasks become harder and more expensive. Many solutions promise efficiency but introduce long implementation cycles, oversized feature sets, or dependencies on specialists the team doesn’t have. More modules under one login is not the same fix as fewer manual steps — a wider module suite and less manual work are not the same thing. Meanwhile, compliance and security demands keep rising, even when budgets don’t. There is a more efficient way to manage application deployment — one that keeps the process simple, predictable, and cost-effective. And that’s where Application Manager, part of the CapaOne Endpoint Management Platform, makes a real difference. ### Why Application Deployment Still Drains Time and Budget Even with modern management tools, many IT departments still run workflows that are unnecessarily complex and expensive. Over-engineered systems, fragmented tools, and processes requiring specialist skills all introduce operational overhead — without improving efficiency. This leads to recurring issues: - Hidden costs tied to consultants, implementation projects, and ongoing maintenance - Unnecessary complexity caused by features the team never uses - Operational friction, where deployment tasks require too many steps or too much specialist knowledge - Limited visibility into deployment and compliance across endpoints - Increased security and compliance risk due to inconsistent or outdated deployment processes For many organizations, application deployment becomes a costly, time-consuming process that slows endpoint operations down instead of supporting, endpoint management. ### The More Efficient Way to Manage Application Deployment CapaOne Application Manager simplifies and automates the entire application lifecycle — from creation and customization to deployment, updating, and retirement. Integrated into the CapaOne Endpoint Management Platform, it removes complexity, hidden costs, and dependencies on specialists. Instead of relying on consultant-heavy setups or tools that require constant rebuilding, CapaOne Application Manager provides a cloud-based workflow built for consistency and efficiency. ### With Application Manager, IT Teams Can: - Deploy applications efficiently across all devices with a predictable, automated workflow - Create and customize applications without coding, scripting, or complex packaging tools - Access a continuously updated library of pre-packaged applications, reducing operational burden and security risk - Edit and redeploy instantly, without rebuilding packages from scratch - Improve visibility with real-time monitoring of deployment and compliance - Reduce operational costs by removing consultant reliance and minimizing maintenance effort This creates a more predictable, transparent, and cost-effective deployment process — one that supports modern endpoint operations without unnecessary complexity. We needed a way to deploy applications and scripts without relying on consultants or granting extended access to our existing console. Application Manager gave us exactly that. It’s stable, easy to work with, and has simplified deployment across all our devices — even outside our network. - Finnmark Fylkeskommune ### Strengthen Your Deployment Strategy Efficient application deployment becomes even stronger when supported by the broader CapaOne ecosystem. Explore related capabilities that enhance endpoint consistency and operational efficiency: - Privilege Management removes risky admin rights, controls elevated access, and ensures secure application execution - Mobile Compliance & Lifecycle Control keeps mobile and frontline devices aligned, compliant, and up to date - Unified Endpoint Visibility brings automation and real-time insights together across all endpoints. ### Modern Endpoint Management, Simplified Modern endpoint environments demand more than fast deployment — they require predictability, security, and a way to operate without relying on specialist skills or external services. This is where the CapaOne Endpoint Management Platform stands out. By standardizing how applications move from packaging to production, CapaOne Application Manager helps organizations shift from reactive troubleshooting to proactive operations. Instead of rebuilding packages, maintaining custom scripts, or coordinating with consultants, IT teams gain a stable, automated workflow they can trust day after day. The impact goes beyond deployment: - Operations become more predictable, with fewer surprises and less rework - Compliance becomes easier, supported by consistent deployment behavior - IT capacity increases, because teams can focus on optimization rather than maintenance - Costs stay under control, with no hidden infrastructure or implementation overhead We deployed our first custom package in 30 seconds — no scripts, no errors, no waiting. The ability to edit and redeploy instantly has completely changed how we manage updates. — Leman, IT Administrator ### Experience It Yourself Start modernizing your endpoint operations with Application Manager, part of the CapaOne Endpoint Management Platform — and experience efficient application deployment without hidden costs or unnecessary complexity. Spend less time maintaining tools and more time driving real IT efficiency. ### Frequently Asked Questions **How Do I Automate Ongoing Third-Party Application Updates?** CapaOne automates third-party application updates from a continuously maintained catalog — as vendors release new versions, the platform updates them across targeted endpoints without repackaging. That turns update posture from a recurring manual task into a standing, automated process. **How Do I Deploy Applications Efficiently Across a Large Estate?** CapaOne pushes application deployments across the whole estate from one console, using shared inventory and grouping to target the right devices. Cloud-native delivery reaches distributed and remote endpoints without local infrastructure, so scale does not add servers or manual steps. **How Do I Reduce Failed Installs and Rollbacks?** Predictable, staged deployment cuts failures at the source: teams validate an application on a pilot group before wider release, and the platform reports success and failure per device. Real-time visibility into what installed and what did not replaces guesswork and repeated attempts. **How Do I Keep Application Versions Consistent Across All Endpoints?** Version drift builds up when updates reach some devices and miss others. CapaOne applies the same catalog and update policy across every targeted endpoint and reports which versions are live, so teams can see and close gaps before they become support tickets or exposure. Written by Rikke Borup CMO, CapaSystems Rikke is Chief Marketing Officer at CapaSystems, where she has led marketing and communications since 2009. With more than 17 years of experience in the IT sector — including cybersecurity, endpoint management software and IT services — she brings long-standing, practical insight into the challenges facing modern enterprise IT environments. Trained as a journalist, Rikke specializes in translating complex technical concepts into clear, easy-to-understand communications for IT decision-makers. More from Rikke Borup → LinkedIn ↗ Book a Demo → --- URL: https://capaone.com/blog/how-to-enroll-dep-devices-in-capaone-mobile-manager/ Published: 2026-01-06 Summary: How to Enroll DEP Devices in CapaOne Mobile Manager - read the knowledge article from the CapaOne technical team ← All articles Knowledge Hub ## How to Enroll DEP Devices in CapaOne Mobile Manager By CapaOne Support · January 6, 2026 This guide explains how to enroll iOS devices using Apple’s Device Enrollment Program (DEP) through Apple Business Manager/Apple school manager and link them to an enrollment configuration in CapaOne Mobile Manager. By the end, you will be able to assign DEP devices to Mobile Manager, synchronize them into the platform, link enrollment profiles, and complete supervised setup on the device. ### Prerequisites Before starting, make sure you have: - A device already enrolled in Apple Business Manager / Apple School Manager (ABM/ASM) - Access to CapaOne Mobile Manager - Access to Apple Business Manager / Apple School Manager (ABM)/(ASM) - The device is available for setup or reset ### Configuration / Steps #### 1. Assign the Device to CapaOne Mobile Manager in ABM/ASM Log in to Apple Business Manager. Select Devices from the left panel Locate the desired device and click the three dots in the top-right corner Select Edit MDM Server and assign the device to CapaOne Mobile Manager Server. #### 2. Synchronize DEP Devices in CapaOne In the CapaOne portal, open the Apple endpoint page Select the DEP tab and click Synchronize (bottom-right corner) If new devices is added, click Refresh. #### 3. Link an Enrollment Configuration In the DEP device list, click the three dots next to the device’s serial number. Select Link enrollment. Choose the appropriate enrollment configuration for the device. The profile status should now show as Assigned. Replace the Application ID with the native Samsung Settings App ID: com.android.settings Configure the usual app settings. Change the app name to “Settings”. ### Enrollment #### 4. Set Up the Device - Start the device and select language and region. - On the layout screen, tap Continue. - Choose Set Up Without Another Device. - Connect to a WiFi network. #### 5. Register the Device - The device will automatically download the assigned DEP configuration. - When prompted, tap Register this iPad/iPhone. #### 6. Register the Device - If Microsoft authentication is enabled in the enrollment configuration: → Sign in using an Azure AD–synced user. - If authentication is not enabled: → The device will enroll automatically and appear in Mobile Manager with the Supervised tag. ### Maintenance & Best Practices - Ensure devices are synchronized in CapaOne before linking an enrollment configuration. - Always verify the device is assigned to the correct MDM server in ABM/ASM. - Reset the device if enrollment does not trigger automatically. - Use DEP for all corporate-owned devices to ensure consistent supervision. Book a Demo → --- URL: https://capaone.com/blog/capaone-folketidende-gruppen-ensuring-all-systems-are-green/ Published: 2026-01-05 Summary: Folketidende Gruppen is a media and communications company - using CapaOne to optimize the IT environment. ← All case studies Case Study · Media & communications ## CapaOne & Folketidende Gruppen : Ensuring All Systems Are Green A Local Media Company with a Small, Efficient IT Team. By Rikke Borup, CMO, CapaSystems · January 5, 2026 Book a Demo More case studies → Media & communications Industry 65 Employees 2 people IT team 2× daily Third-party updates CapaOne is so intuitive that we figured it out ourselves. It’s like having a self-driving car — you let go of the wheel, and it drives itself. Thomas Nyborg Hansen IT Manager, Folketidende Gruppen Folketidende Gruppen is a media and communications company in Lolland-Falster. The organization includes newspaper and magazine production, digital platforms, advertising tasks, and a distribution network. The company has 65 employees supported by an IT department of two people. This setup makes it necessary to maintain stable systems with as little manual work as possible. Business Challenge ### Manual Updates and Limited Time With only two IT staff, keeping systems updated manually required significant time. This included tracking updates for third-party software, packaging applications, maintaining drivers, managing administrator rights, and securing mobile devices. Several of these tasks repeated frequently, leaving limited time for other responsibilities. Folketidende Gruppen needed a way to automate regular updates and reduce manual processes. The Solution ### Use of CapaOne Cloud Services Folketidende Gruppen has used the On-Premise solution, CapaInstaller, for many years. Over a year ago, the IT department added several CapaOne services: - CapaOne Application Manager to automate updates for third-party software - CapaOne Provision Manager to check and update drivers automatically - CapaOne Privilege Manager to manage local administrator rights - CapaOne Mobile Manager to secure and update mobile devices Third-party software is now updated twice daily, and driver checks run three times a week. The implementation was handled internally without external consultants. The Outcome ### Reduced Manual Work and More Automation CapaOne has reduced the amount of manual work related to software updates and driver maintenance. Routine tasks now run automatically, and the IT department can allocate time to other tasks. The systems remain updated, and mobile devices are managed through CapaOne Mobile Manager. Folketidende Gruppen also participates in the CapaInstaller User Group, which provides input and contact with other users and CapaSystems. The Highlights ### Changes Experienced by Folketidende Gruppen - Automated updating of third-party software - Automatic driver checks three times per week - Reduced manual tracking of updates and packaging tasks - No external consultants needed for implementation - Local administrator rights managed through CapaOne Privilege Manager - Mobile devices secured and updated through CapaOne Mobile Manager - Regular knowledge sharing via the User Group The Platform ### CapaOne products used #### Application Manager Simplifies packaging, accelerates deployment, and automates updates for third-party and business applications, resulting in optimal endpoint performance and a fortified security posture. Explore Application Manager #### Privilege Manager Enforces least-privilege with policy-based elevation and no standing local admin. Supports process or session elevation using existing Entra ID groups, with logging for governance. Explore Privilege Manager #### Provision Manager Automates bare-metal OS deployment and driver orchestration in a cloud-native workflow, enabling IT to provision and recover Windows devices from anywhere. Explore Provision Manager #### Mobile Manager Unifies enrollment, configuration, compliance, and app delivery across iOS, iPadOS, and Android. Gives IT clear posture visibility and essential remote actions in one place. Explore Mobile Manager FAQ ### Questions we get asked Anything else? Talk to our team → **How Does a Two-Person IT Team Keep 65 Employees' Devices Updated?** Folketidende Gruppen removes the manual steps from application updates. Application Manager updates third-party software twice daily, so the two-person IT department no longer tracks releases or packages applications by hand. The time saved goes to other responsibilities. **How Do You Keep Device Drivers Current Without Manual Work?** Automatic driver checks run three times per week through Provision Manager. Folketidende Gruppen no longer maintains drivers by hand, which removed one of the recurring tasks that used to consume the two-person team's time. **Can a Small IT Team Implement Endpoint Management Without Consultants?** The IT department handled the implementation internally, without external consultants. Folketidende Gruppen added Application Manager, Provision Manager, Privilege Manager, and Mobile Manager to an existing CapaInstaller setup. **Can One Tool Replace Separate Tools for Patching, Drivers, and Admin Rights?** Folketidende Gruppen runs all four areas through CapaOne. Application Manager handles third-party updates, Provision Manager checks drivers, Privilege Manager manages local administrator rights, and Mobile Manager secures and updates mobile devices. ### Want results like this on your estate? See CapaOne on your own devices — standalone or alongside Intune. Most teams are up and running in under 30 minutes. Book a Demo View Pricing --- URL: https://capaone.com/blog/how-to-create-samsung-default-apps-in-capaone-kiosk-mode/ Published: 2026-01-05 Summary: How to Create Samsung Default Apps in CapaOne (Kiosk Mode) - read the knowledge article from the CapaOne technical team ← All articles Knowledge Hub ## How to Create Samsung Default Apps in CapaOne (Kiosk Mode) By CapaOne Support · January 5, 2026 This guide explains how to enable Samsung’s native Phone, Messages, and Settings apps for devices running in Kiosk Mode in CapaOne Mobile Manager. By the end, you will be able to create Google Play app entries that point to Samsung’s native application IDs and make them available inside a Custom Launcher setup. ### Prerequisites Before proceeding, ensure: - The device is configured in Kiosk Mode - Custom Launcher is enabled in the Kiosk Mode Configuration - Device Settings is enabled in the Kiosk Mode Configuration - You have access to Managed Google Play in CapaOne ### Configuration / Steps #### 1. Create Samsung Messages (Native App) - Create a new Google Play app in CapaOne. - Search for Messages. - Select Google Messages from the list. - Replace the Application ID with the native Samsung Messages App ID: com.samsung.android.messaging - Configure the usual app settings. - Change the app name to “Messages”. #### 2. Create Samsung Phone (Native App) - Create a new Google Play app in CapaOne. - Search for Messages. - Select Google Messages from the list - Replace the Application ID with the native Samsung Phone App ID: com.samsung.android.dialer - Configure the usual app settings. - Change the app name to “Phone”. #### 3. Create Samsung Settings (Native App) - Create a new Google Play app. - Search for Settings. - Select Quick Settings for Android from the list. - Replace the Application ID with the native Samsung Settings App ID: com.android.settings - Configure the usual app settings. - Change the app name to “Settings”. ### Enrollment No additional enrollment steps are required. After creation, the Samsung-native apps can be assigned to: - Groups - Individual endpoints Devices will receive apps based on the Assigned groups or directly applied apps. ### Maintenance & Best Practices - Ensure that Custom Launcher and Device Settings remain enabled for Kiosk Mode. - Always verify that Application IDs are correct before saving. - Test new Kiosk app setups on a single device before rolling out widely. - Rename the app to the native name (Phone, Messages, Settings) for clarity in the launcher. Book a Demo → --- URL: https://capaone.com/blog/simplify-application-deployment/ Published: 2026-01-04 Summary: Deploy, update, and maintain applications consistently across every endpoint - learn how to simplify application deployment ← All articles Blog ## Simplify Application Deployment Deploy, update, and maintain applications consistently across every endpoint — without scripts or manual workflows. By Rikke Borup, CMO, CapaSystems · January 4, 2026 Managing applications across multiple environments shouldn’t slow your IT team down. Yet for many administrators, packaging, testing, and deploying software still takes hours — sometimes days — and every manual step introduces risk. In modern endpoint operations, the ability to deploy, update, and maintain applications consistently is core to both efficiency and compliance. That’s where Application Manager, part of the CapaOne Endpoint Management Platform, makes the difference. ### The Challenge: Too Many Tools, Too Little Time Every time an app is updated or patched, IT must repeat the same tasks — build, test, deploy, verify. Even with Intune in place, you often need external scripts, third-party tools, or complex packaging processes just to push out a simple update. This creates three major issues: - Time lost to manual packaging and troubleshooting - Inconsistent deployments that introduce errors and version drift - Lack of visibility into which devices run what — and whether they’re compliant. Manual workflows waste time and create exposure. The fix isn’t faster packaging — it’s automation and visibility. Bolting on another module doesn’t close that gap either — more modules under one login does not mean fewer manual steps. ### The Solution: CapaOne Application Manager CapaOne Application Manager unifies creation, deployment, and updating of applications in one place. It replaces manual scripting and fragmented tooling with a cloud-based, automation-first platform that works with Intune, or entirely without it. With Application Manager, you can: - Create and customize applications - build custom apps visually with drag-and-drop — no scripting required - Deploy software at scale push updates across all devices and users in minutes - Use a library of pre-packaged applications - apps are maintained and updated automatically - Edit and redeploy instantly — changes take effect immediately - Monitor deployment health and compliance - real-time visibility and clear audit trails across all endpoints. Everything runs through the CapaOne Endpoint Management Platform, giving IT one unified control point. ### Automation That Frees Your Team Instead of chasing failed installs or version mismatches, your team can focus on improving systems and user experience. Application Manager automates not only deployment but the full application lifecycle — from creation to retirement. Combined with other modules like CapaOne Privilege Manager and CapaOne Mobile Manager, it ensures every endpoint stays consistent, secure, and compliant. No extra integrations. No infrastructure to maintain. Just one platform that keeps everything in sync — automatically. ### Built for Real-World IT Beta users have already seen how Application Manager transforms software deployment: “We deployed our first custom package in 30 seconds — no scripts, no errors, no waiting. The ability to edit and redeploy instantly has completely changed how we manage updates.” — Leman, IT Administrator This kind of speed isn’t convenience — it’s operational confidence. ### Modern Endpoint Management, Simplified CapaOne Application Manager brings everything you need for modern software deployment into one Intune-aligned platform: - Full lifecycle management — build, deploy, update, retire. - Real-time visibility across all devices. - Continuous compliance through automation. - 100% cloud-based delivery — no servers, no overhead. Because in endpoint operations, control isn’t just about configuration — it’s about consistency. ### Experience It Yourself Start automating application management with Application Manager, part of the CapaOne Endpoint Management Platform. Spend less time packaging and patching — and more time driving IT efficiency and stability. ### Frequently Asked Questions **How Do I Package an Application for Deployment?** Application Manager includes a UI-based packager and a catalog of pre-packaged third-party applications, so most deployments need no manual packaging at all. For business applications, teams build and adjust packages in the interface — without scripting or specialist packaging tools. **Can I Deploy Applications Without Scripting?** Yes — including the installs that traditionally forced teams into scripting. Custom parameters, sequencing, and install conditions are configured in Application Manager rather than written in PowerShell. Teams that leaned on scripts can retire them, removing the most fragile step in most deployment workflows. **How Do I Target Deployments to Specific Groups or Rings?** CapaOne deploys applications by group or individual endpoint, so teams can stage a rollout — a pilot ring first, then wider groups once the pilot succeeds. Targeting uses the same inventory and grouping the rest of the platform relies on, not a separate list. **How Long Does It Take to Get Started With Application Deployment?** CapaOne is cloud-native and deploys in days, not months — there is no on-premise infrastructure to stand up first. Teams can configure a first application deployment quickly, using the pre-packaged catalog to push common third-party applications from day one. Written by Rikke Borup CMO, CapaSystems Rikke is Chief Marketing Officer at CapaSystems, where she has led marketing and communications since 2009. With more than 17 years of experience in the IT sector — including cybersecurity, endpoint management software and IT services — she brings long-standing, practical insight into the challenges facing modern enterprise IT environments. Trained as a journalist, Rikke specializes in translating complex technical concepts into clear, easy-to-understand communications for IT decision-makers. More from Rikke Borup → LinkedIn ↗ Book a Demo → --- URL: https://capaone.com/blog/compliance-beyond-paperwork/ Published: 2026-01-03 Summary: Compliance Beyond Paperwork is all about turning Endpoint Operations into Everyday Security - Read the CapaOne Blog Post ← All articles Blog ## Compliance Beyond Paperwork Turning Endpoint Operations into Everyday Security. By Rikke Borup, CMO, CapaSystems · January 3, 2026 In today’s IT landscape, endpoint operations sit at the core of compliance. Every laptop, update, and admin right represents a potential risk — and keeping up with policies, audits, and reports can feel endless. But compliance isn’t just documentation. It’s the foundation for real security — protecting systems, users, and data from the vulnerabilities that paperwork alone can’t close. ### Where Compliance Really Happens If you’re managing endpoints across Intune and hybrid environments, you already know that compliance lives in the details: - Who has access to what - Which apps and drivers are up to date - How quickly vulnerabilities are detected and patched. These aren’t theoretical controls — they’re everyday operational decisions. When processes are manual, those controls are hard to enforce, errors slip through, and compliance becomes reactive instead of proactive. That’s where automation transforms the equation. ### From Documentation to Action Traditional compliance management is often about producing reports, not proving control. IT teams spend more time documenting compliance than enforcing it. Modern endpoint management changes that. With CapaOne’s Endpoint Management Platform, compliance is built into daily operations — automated, monitored, and enforced in real time. The platform automates the policies and processes that compliance frameworks depend on: - Patch and update automation keeps systems current across Microsoft and third-party applications - Privilege management limits elevated rights to what’s necessary and logs every action - Vulnerability monitoring provides visibility long before auditors ever ask for evidence. Logging every privilege action is a start, not the whole picture — elevation control and continuous governance of that control are two different things, and the gap between them is where drift creeps back in. The result: compliance moves from a manual checklist to a continuous, verifiable process. ### Closing the Gaps — Automatically Every IT team faces the same gaps: missing updates, outdated drivers, and inconsistent configurations. These gaps are what attackers exploit — not the missing signatures on your compliance reports. By automating endpoint operations with the platform, you close those gaps before they become security incidents. Patch automation, access control, and asset visibility come together in one place — giving you both real-time protection and documented proof of compliance. ### The Real Value of Compliance Compliance isn’t about ticking boxes or gathering evidence after the fact. It’s about building a security posture that holds up every day — not just on audit day. When your controls are automated and your environment is consistent, compliance becomes a natural outcome of how you run IT. The real value comes from resilience: a stable, predictable endpoint environment that reduces risk, strengthens trust, and produces evidence on demand. Instead of spending time proving compliance, your team can focus on strategic improvements that move the organization forward. Compliance isn’t the goal — it’s the result of operating with visibility, consistency, and control. ### See Compliance in Action Explore how CapaOne Endpoint Management Platform automates security and compliance across your devices, applications and user access — with or without Microsoft Intune. Compliance beyond paperwork starts with visibility, automation, and control. It starts with CapaOne. Written by Rikke Borup CMO, CapaSystems Rikke is Chief Marketing Officer at CapaSystems, where she has led marketing and communications since 2009. With more than 17 years of experience in the IT sector — including cybersecurity, endpoint management software and IT services — she brings long-standing, practical insight into the challenges facing modern enterprise IT environments. Trained as a journalist, Rikke specializes in translating complex technical concepts into clear, easy-to-understand communications for IT decision-makers. More from Rikke Borup → LinkedIn ↗ Book a Demo → --- URL: https://capaone.com/blog/5-steps-to-avoid-the-most-common-pitfalls-in-vulnerability-management/ Published: 2026-01-02 Summary: CapaOne Security Monitor delivers CVE-based risk scoring, ranked remediation queues, and audit-ready vulnerability evidence across endpoints. ← All whitepapers eBook ## 5 Steps to Avoid the Most Common Pitfalls in Vulnerability Management How modern security teams reduce exposure, stay compliant, and maintain a predictable security posture — without adding complexity. By Rikke Borup, CMO, CapaSystems · January 2, 2026 ### Introduction to the eBook Vulnerability management has become one of the most challenging disciplines in modern IT security. Threat volumes continue to rise, compliance requirements grow stricter, and security teams are expected to demonstrate not just activity — but control, prioritization, and documented outcomes. Despite investments in security tooling, many organizations still struggle with the same foundational problems: fragmented visibility, manual remediation, unclear prioritization, and insufficient documentation for audits and compliance reviews. This eBook introduces a practical, 5-step vulnerability maturity framework designed for organizations that rely on Microsoft Intune but require deeper visibility, automation, and risk context across endpoints. Rather than adding more tools or complexity, the framework focuses on building a predictable, scalable, and risk-driven vulnerability management program — one that aligns security and IT operations while supporting modern regulatory demands such as NIS2, ISO27001, and CIS Controls. ### What You Will Learn - Identify and avoid the common vulnerability management pitfalls - Reduce exposure through risk-based prioritization - Automate remediation without losing control or governance - Build audit-ready documentation for NIS2 and internal audits ### How CapaOne Strengthens Vulnerability Management CapaOne turns the five-step framework into daily practice through Security Monitor, the platform’s vulnerability posture engine, backed by automated remediation across the platform. Security Monitor gives security teams CVE-based risk scoring and a single, prioritized view of exposure across every endpoint. The eBook’s five-step framework maps directly to the platform: Step 1 — Gain Full Visibility. Security Monitor consolidates installed software, vulnerable applications, configuration drift, patch status, and device exposure into one real-time view, so no vulnerability or misconfiguration goes unnoticed. Step 2 — Automate Remediation. Application Manager automates third-party application updates and packaging, turning ranked findings into consistent remediation without manual effort. Step 3 — Prioritize Vulnerabilities Based on Risk. Security Monitor scores vulnerabilities by CVSS, exploitability, and exposure impact, producing ranked remediation queues that focus effort where it reduces risk most. Step 4 — Establish Governance and Documentation. Security Monitor builds audit-ready vulnerability evidence — actions taken, vulnerabilities resolved, and remaining risk — to support NIS2, ISO 27001, and internal audits. Step 5 — Choose a Scalable Security Posture Model. CapaOne runs vulnerability posture, remediation, and reporting in the same operational model you already use with Intune — consolidated tooling and consistent posture metrics across every device. ### Frequently Asked Questions #### Where Does the Vulnerability Data Come From, and How Often Is It Refreshed? Security Monitor aggregates authoritative feeds, such as vendor advisories and NIST/NVD, and refreshes them regularly to keep risk context current. #### Does It Detect Vulnerabilities in Third-Party Apps and Drivers? Yes. Security Monitor's posture spans common enterprise applications and relevant driver components, with version context at the endpoint level. #### How Are Issues Prioritized? Security Monitor prioritizes issues by severity, exploitability, and blast radius (the number of affected endpoints), producing ranked remediation queues. #### How Do We Remediate From Here? You trigger update actions from Security Monitor through the platform's integrated deployment workflows. #### How Does Security Monitor Work With Intune Day-to-Day? Security Monitor runs alongside Intune and validates that your security policies are correctly enforced. Dashboards and summaries highlight any areas that may need action. #### Can We Cover Line-of-Business Software? Yes. Security Monitor automatically scans installed software, so both line-of-business apps and catalog titles can be tracked. #### What Reports Are Available for Audits and Leadership? Security Monitor provides posture snapshots and change evidence that are exportable to CSV and can be scheduled. #### What Happens With Offline or Rarely Connected Devices? For offline or rarely connected devices, Security Monitor retains findings, and remediation tasks queue and resume when the device reconnects. --- URL: https://capaone.com/blog/how-to-create-a-managed-configuration-in-capaone-for-android/ Published: 2026-01-02 Summary: How to Create a Managed Configuration in CapaOne for Android - read the knowledge article from the CapaOne technical team ← All articles Knowledge Hub ## How to Create a Managed Configuration in CapaOne for Android By CapaOne Support · January 2, 2026 This guide explains how to create and use a Managed Configuration for a Google Play application on Android devices in CapaOne Mobile Manager. By the end, you will know how to locate an app, edit its Managed Configuration, and link it to endpoints or groups. ### Prerequisites Before creating a Managed Configuration, ensure you have: - Access to CapaOne Mobile Manager - A Google Play app that supports Managed Configuration (not all apps do) ### Configuration / Steps #### 1. Open the Android Applications Section - Go to capaone.com 2. Navigate to Android → Application. #### 2. Select the App You Want to Configure - Find the Google Play app that requires a Managed Configuration. 2. Click the three-dot menu next to the app. 3. Select Edit Managed Configuration. Note: Managed Configuration is only available for apps where the developer supports it. If the option is not visible, the application does not support Managed Configuration. #### 3. Create or Edit the Managed Configuration - Modify the available configuration fields according to your requirements. - Click Save to apply the Managed Configuration. The configuration is now ready and can be linked to: - Individual endpoints - Groups ### Enrollment No enrollment-specific steps are required. The Managed Configuration will automatically apply to devices once the associated app is installed and the configuration is linked to the device or group. ### Maintenance & Best Practices - Always verify that an app supports Managed Configuration before planning configuration policies. - Review developer documentation for apps with complex configuration schemas. - Test Managed Configurations on a single Android device before applying them widely. - Revisit configurations after app updates, as new options may become available. Book a Demo → # Other pages --- URL: https://capaone.com/careers/ Summary: Join CapaOne. We make the digital world simpler and safer. See our open positions in Taastrup, Denmark, and build your career with us. Careers ## Join our team We are CapaOne — built for simplicity, driven by a unified purpose. Evolved from CapaSystems, we've turned 30 years of on-premise IT management expertise into a modern, cloud-based platform. Our Purpose To make the digital world simpler and safer. Our Vision To be the leading experts in smart and simple endpoint management solutions. What We Value ### The values we share #### Obsess Over Customers We focus on creating genuine value — listening closely, measuring outcomes, and acting on what we learn. #### Win Together We own our results, collaborate in the open, and keep our work visible so the whole team can move as one. #### Stay Curious We keep learning and push boundaries — curiosity is what fuels better decisions and better products. #### Raise the Bar We pursue excellence in every detail, from the smallest UX touch to platform-wide reliability. Open Positions ### Roles we're hiring for No open positions right now. Follow us on LinkedIn to hear about new roles as they open. ### Don't see the right role? If you believe you can strengthen CapaOne — technically, commercially, or strategically — we want to hear from you. Send an unsolicited application --- URL: https://capaone.com/events/user-group-2026/ Summary: A half-day gathering for all CapaSystems customers — product roadmap, expert speakers, and peer networking at Hotel Skanderborghus. ← All events User Group ## CapaSystems User Group 2026 — Event & Registration A half-day gathering for all CapaSystems customers — product roadmap, expert speakers, and peer networking at Hotel Skanderborghus. Wednesday, April 29, 2026 Hotel Skanderborghus, Dyrehaven 3, 8660 Skanderborg This event has passed The CapaSystems User Group is a bi-annual half-day gathering for all CapaSystems customers. Connect with the team and peers, explore the product roadmap, and gain practical insights into endpoint management, security, and deployment. Date: Wednesday 29 April 2026, 10:00–15:00 Location: Hotel Skanderborghus, Dyrehaven 3, 8660 Skanderborg ### Agenda highlights - The current IT threat landscape — Christian Spohr, CEO & Founder, Eagle Shark (background in Danish Special Forces) - Product Roadmap — Martin Søndergaard, CEO, CapaSystems - Apple iOS 27 is coming — what now? — Joachim Hansen, Agile Software Developer, CapaSystems - Deployment Innovation: Cloud, Automation & Real-World Challenges — Dennis Busk, Chief Services Officer, CapaSystems - Customer use case presentation — Søren Dahl Nielsen, Deployment Specialist, NIRAS - When ransomware strikes: Fast endpoint recovery — Dennis Busk, CapaSystems ### Registration Places are limited and reserved for existing CapaSystems customers on a first-come, first-served basis. If you haven’t received an invitation, contact cug@capasystems.com . Register your place — limited seats available for CapaSystems customers. --- URL: https://capaone.com/events/user-group-october-2026/ Summary: Join CapaSystems User Group on 21 October. The theme is automation, and a customer describes the move from CapaInstaller to CapaOne. ← All events User Group ## CapaSystems User Group, October 2026: Automation in Practice Join CapaSystems User Group on 21 October. The theme is automation, and a customer describes the move from CapaInstaller to CapaOne. Wednesday, October 21, 2026 CapaSystems, Roskildevej 342C, 2630 Taastrup This event has passed CapaSystems User Group gathers customers twice a year to compare notes on endpoint management, see what the product teams work on next, and hear how other organizations solve the same problems. The autumn meeting runs on Wednesday 21 October 2026 at CapaSystems in Taastrup, and the theme is automation. The day circles one question: which work can systems take over, and what actually holds up in production today? Four talks approach it from different directions — a customer who has completed a migration, a consultant putting AI to work in daily operations, a read on what IT teams ask for right now, and the product roadmap. ### From CapaInstaller to CapaOne, Seen from the Customer Side Kim Byrresen, sysadmin at Vordingborg Køkkenet, has taken that route and describes it openly — particularly how the packages came across, and what his team automated along the way. He handles the work himself day to day, so you can ask him directly during the break. That kind of account is hard to get from a datasheet. Migrations rarely fail on the technology; they stall on the details nobody wrote down. Kim talks about both. ### On the Program - Kim Byrresen, Sysadmin, Vordingborg Køkkenet — from CapaInstaller to CapaOne, focused on converting the packages - Mark Bønnelykke Rasmussen, Consultant, CapaSystems — From Prompt to Production: When AI Meets CapaOne and CapaInstaller - Simon Højlund, Vice President Sales, CapaSystems — What’s Happening Out There? An open conversation about what IT teams raise right now - Dennis Busk Nyehuus, Chief Services Officer, CapaSystems — Product Roadmap & Tech Talk: what arrives, and when The program is preliminary. We are adding a couple of items and will announce them once we have them in place. ### Practical Details for CapaSystems User Group The day starts at 10:00 and ends at 15:00 at CapaSystems, Roskildevej 342C, 2630 Taastrup. Lunch is part of the day, and so is time to talk shop between the talks. Attendance costs nothing. The meeting welcomes all CapaSystems customers, whether or not you belong to the user group. We hold a limited number of seats and allocate them first come, first served. The day runs in Danish, and so do the talks, the questions, and the conversations during the breaks. Register for CapaSystems User Group The announcement post covers Kim Byrresen’s migration and the rest of the program in more detail. Working with a colleague who handles deployment or automation? Forward the invitation — the program covers ground they will recognize. Questions, or anything we should know about lunch? Write to cug@capasystems.com. --- URL: https://capaone.com/events/v2-security-copenhagen-2026/ Summary: CapaOne is at V2 Security Copenhagen — meet the team, see a live endpoint management demo, and talk through your environment at stand B-188. ← All events Conference ## V2 Security Copenhagen 2026 CapaOne is at V2 Security Copenhagen — meet the team, see a live endpoint management demo, and talk through your environment at stand B-188. Wednesday, May 6, 2026 – Thursday, May 7, 2026 Bella Center, Center Boulevard 5, Copenhagen This event has passed V2 Security Copenhagen is one of Scandinavia’s leading conferences for cybersecurity and IT professionals. In 2026 the event returns to Bella Center on 6–7 May with expert talks, case examples, and hands-on conversations around compliance, endpoint protection, and the evolving threat landscape. ### Find CapaOne at Stand B-188 The CapaOne team will be at stand B-188 throughout both days. Stop by for: - A focused endpoint management demo — see how patching, privilege control, provisioning and mobile management consolidate into a single operational layer - A 20-minute technical conversation — no slide deck, just a frank discussion about your current tooling, the gaps, and what a consolidated platform would look like in your environment ### Who you’ll meet - Claus H. Andresen — Chief Commercial Officer - Simon Højlund — Head of Partnerships - Tonny Møgelvang — Key Account Manager ### Reserve a slot Email can@capasystems.com to book a demo or conversation at the booth in advance. Or simply walk up to stand B-188 — the team is there for the full two days. Attending V2 Security? Reserve your demo slot or just come find us at B-188. --- URL: https://capaone.com/privacy-policy/ Summary: How CapaOne and CapaSystems A/S collect, process, store, and protect your personal data — including cookies, retention periods, and your rights. Legal ## Privacy Policy How we collect, process, and protect your personal data. ### Cookies When visiting the CapaOne website, we collect data about your visit in order to customize and improve our content. This is done using cookies, as described in our Privacy Policy. A large number of company websites use cookies to optimize the user experience on these sites. Cookies are text files that are stored on your computer, mobile device etc., and their purpose is to recognize the computer or device, remember settings, perform statistics and display targeted content. Unlike viruses, cookies cannot contain harmful code. You can delete or block cookies. If you choose to delete or block cookies, the displayed content may change and / or appear more frequently. In addition, you may risk that the site does not work optimally and that you may be unable to access certain content. ### Personal Data #### General info Personal data is any kind of information that may be attributed to you to some extent. When you visit our website, we collect and process a variety of such information. Among other things, this is done when accessing content – for instance, when you subscribe to our newsletter, sign up for events, download white papers etc. #### Which information? We typically collect and process the following type of information: Technical data about your computer, tablet or mobile phone, your IP number, geographical location, which pages you click on and possibly professional interests. To the extent that you explicitly consent to and enter the information yourself or following contact by phone, we also process the following: Name, job position / function, company, phone number and e-mail. This is typically done when you download materials or register for events, subscribe to news e-mails or telephone contact. We neither disclose nor sell any personal data to any third parties. #### Purpose The information is used to identify you as a user and display the content most likely to be relevant to you. It also enables us to deliver any services requested by you, such as sending you newsletters and marketing our services. #### Retention period The information is stored for the period specified below. The period depends on the type of information and the basis for retaining it. You may contact us at any time via e-mail at info@capasystems.com and request us to delete your information. #### Newsletters and other website materials If you provide contact information when downloading materials from our website or subscribing to newsletters, we will record this contact information. The purpose of recording this information is to deliver the relevant materials and marketing to you. We will retain the information until you cancel all services and for a period of 2 years thereafter, or in the event of subsequent contact, for 2 years after your last contact. #### Events When you sign up for events, we record your contact information as well as other information that may be relevant to the event. We retain and use your contact information in order to do follow-ups and marketing later on. The information is stored for 2 years after your last contact. #### Phone contact During telephone contact, we will sometimes record your contact information. When we record your information, you will be notified during the call. We retain and use your contact information in order to do follow-ups and marketing later on. The information is stored for 2 years after your last contact. #### Customer relationships In connection with customer relationships, we record contact information about relevant employees at the customer in order to issue service announcements about our product to the persons concerned. This information is stored, but can be deleted by sending a request to info@capasystems.com. #### Registering at CapaSystems' initiative In some cases, CapaSystems A/S may register contact information relating to a person we consider relevant in terms of communication and who may benefit from services offered by CapaOne. The person in question will always be informed that he or she is being registered and may request to be deleted at any time. The information is stored for 2 years after your last contact. #### Use of subcontractors We use a number of services for storing and processing data. These services solely process information on behalf of us and may not use it for their own purposes. Any disclosure of personal data, such as your name and e-mail address, will only take place in accordance with applicable data protection legislation and on a lawful basis. #### Insight and complaints According to applicable law, you have the right to be informed about the personal data we process about you, as outlined in our Privacy Policy. You may at any time object to the usage of any information and revoke your consent to record information about you. If the information processed about you is incorrect, you may ask us to correct or delete it. To request this, please use our contact form under the 'Contact Us' menu item. ### Publisher and Data Manager This website is owned and published by: CapaSystems A/S Roskildevej 342C DK-2630 Taastrup Phone: +45 70 10 70 55 E-mail: info@capasystems.com --- URL: https://capaone.com/roi-calculator/ Summary: Estimate the time and money CapaOne frees up for your IT team — enter endpoints, staff and tickets to see hours saved and your ROI. ROI Calculator ## See what CapaOne gives back One platform for patching, deployment, provisioning, privilege control and monitoring means far less manual work. Enter a few numbers about your environment to estimate the hours your team gets back — and the money that follows. Like having a self-driving car — you let go of the wheel, and it drives itself. - 30+ years endpoint experience - 150,000+ endpoints managed - Danish-built, EU-hosted - GDPR-first & NIS2-aligned 📊 ### Your environment Rough numbers are fine — you can adjust anything. How many Windows endpoints do you manage? How many IT admins / technicians? Sets how much of your team's capacity the saved hours represent. Support tickets per month Average loaded IT hourly cost (EUR) Salary + overhead per hour. Adjust to your region. 🪟 ### Microsoft 365 licensing optional Keep users on the cheaper E3 plan. Microsoft 365 E5 costs more than E3. If the main reason you'd pay for E5 is to manage and secure your devices, CapaOne already does that — so those users can stay on the cheaper E3 plan. Enter how many users, and we'll show what you'd save. How many users could stay on E3 instead of E5? Leave at 0 if Microsoft licensing isn't part of your decision. How much more is E5, per user each month? (EUR) Roughly the E3-to-E5 gap on Microsoft's price list (E5 lists at USD 60 vs E3 at USD 39) — about EUR 20. Adjust to your own agreement. ### Where the time comes back Estimated IT hours saved each month, by area. Automated patching & vulnerability remediation Security Monitor + Application Manager – Automated app packaging & deployment Application Manager – Zero-touch provisioning & onboarding Provision Manager – Self-service privilege elevation (fewer tickets) Privilege Manager – Faster troubleshooting from one console Experience Monitor – Estimated net savings – Per year, after your CapaOne investment – IT hours saved / month – Full-time staff freed up – Total savings / year – CapaOne cost / year Get a tailored quote Book a demo Estimates only, in EUR excl. VAT. Your actual savings depend on your environment and workflows. Why you can trust these numbers ### Grounded in 30 years of endpoint experience These estimates are shaped by three decades of managing endpoints for European organizations — and by the 150,000+ devices we keep running today. They're deliberately conservative, and every assumption behind them is shown in full below. Treat this as a careful starting point, not a guarantee: for a figure built on your real environment, book a demo and we'll model it together. - 30+ years of endpoint management - 150,000+ endpoints under management - EU built & hosted · GDPR-first **How we calculate this** These are conservative, transparent estimates — not a promise. Every figure is derived from your inputs using the assumptions below. Your real numbers will vary with your tools, processes and team. - Automated patching & remediation: ~5 minutes of manual effort per endpoint per month removed once patching and vulnerability remediation run automatically. - Automated app packaging & deployment: ~3 minutes per endpoint per month saved on packaging, testing and rollout. - Zero-touch provisioning & onboarding: around 2% of your fleet is rebuilt or newly provisioned each month, saving ~1.5 hours per device versus manual imaging. - Self-service privilege elevation: roughly 30% of tickets are admin-rights related; about 70% of those are removed by just-in-time self-service, at ~0.4 hours each. - Faster troubleshooting: a single console with live endpoint insight shaves ~0.1 hours off the average ticket. - Money: hours saved × your hourly cost × 12. Full-time staff freed up assumes 160 productive hours per month. - Microsoft licensing (optional): only counts if you tell it to. If endpoint privilege and third-party app management are why you'd step users up from Microsoft 365 E3 to E5, CapaOne covers that need today — so the estimate is users you'd otherwise upgrade × the E3→E5 step-up cost × 12, using a figure you control. The ~EUR 20 default reflects Microsoft's published E3 vs E5 list prices — USD 60 vs USD 39 per user/month, about USD 21 more, effective July 1, 2026. It is not a claim that CapaOne replaces everything in E5 (Defender, compliance, identity and voice are unaffected). - CapaOne cost: the Windows Bundle at EUR 3 / endpoint / month with the same volume discounts as our pricing page, and the EUR 1,500 minimum annual contract. ### Common questions #### Are These Numbers Guaranteed? No — they're a directional estimate built on conservative, industry-typical assumptions. We keep them modest on purpose. Book a demo and we'll model your real environment together. #### Why Focus on Hours, Not Just License Cost? The biggest cost in endpoint management is skilled staff time. Automating patching, deployment and provisioning frees that time for higher-value work — which is where most of the return comes from. #### What Is "Full-Time Staff Freed Up"? The monthly hours saved expressed as a share of one full-time employee (assuming 160 productive hours a month). It shows how much team capacity you get back — to redeploy, not necessarily to cut. #### How Is the CapaOne Cost Estimated? Using the CapaOne Windows Bundle at EUR 3 per endpoint per month, the same volume discounts as our pricing page, and the EUR 1,500 minimum annual contract. For an exact figure, request a quote. #### Does This Replace Microsoft Intune? CapaOne works with Intune or entirely without it. Many of these savings come from completing an Intune setup — automated third-party patching, provisioning and privilege control that Intune alone doesn't cover. #### How Does the E3 vs E5 Saving Work? If endpoint privilege control and third-party application management are the reason you'd move users from Microsoft 365 E3 to E5, CapaOne delivers those today — so those users can stay on E3. The optional licensing field estimates that avoided step-up. It's not a claim that CapaOne replaces E5's security, compliance, identity or voice features. #### Can I Adjust the Assumptions? You can already tune the biggest driver — your hourly cost. For a fully customized model with your own figures, talk to a CapaOne specialist. ### Turn those hours into a plan Talk to a CapaOne specialist — we'll model the return for your exact environment. Book a Demo See pricing --- URL: https://capaone.com/security/ Summary: Who is responsible for security at CapaOne, and how to report a vulnerability or a security concern to CapaSystems A/S. Trust ## Security at CapaOne Who is responsible for security, and how to reach us. ### Responsibility CapaOne is developed by CapaSystems A/S in Taastrup, Denmark, and hosted in the EU. Overall responsibility for the security of CapaOne lies with: Martin Gudme Søndergaard Chief Executive Officer, CapaSystems A/S ### Report a vulnerability or security concern If you believe you have found a vulnerability in CapaOne, or have a security question about the platform, write to security@capasystems.com. We read reports in English and Danish. To help us act on a report quickly, please include: - a description of the issue and where you found it, - the steps needed to reproduce it, - what an attacker could achieve by exploiting it, as far as you can tell. Please give us a reasonable chance to fix an issue before you share it with others, and do not access, change or delete data that is not yours while you investigate. A machine-readable version of this contact information is published at /.well-known/security.txt. ### Assurance reports #### ISAE 3000 Assurance Report 2025–26 Independent auditor’s ISAE 3000 report with limited assurance on information security and measures pursuant to the data processing agreement for the CapaOne platform, covering 1 July 2025 to 28 August 2026. Issued by PKF Munkebo Eriksen Funch. ### Download the report Fill in the form and we'll take you straight to the PDF. Our ISAE 3402 report will be published on this page once it is available. ### Other questions For questions that are not about security, contact CapaSystems A/S at info@capasystems.com or +45 70 10 70 55. CapaSystems A/S Roskildevej 342C DK-2630 Taastrup, Denmark