Your mobile device management (MDM) system has access to all of your devices, with the ability to control, wipe, and push updates across them. On one hand, this makes it an invaluable tool for streamlining device management. On the other hand, it is also why MDM tools are high-value targets for attackers.
In March 2026, Stryker, a global medical technology manufacturer, had what attackers claimed were more than 200,000 systems wiped following a cyberattack. The entry point? The MDM system, Microsoft Intune. Using compromised administrative credentials, attackers gained full control of Intune and executed remote wipe commands across systems in 79 countries. The company was driven to a standstill. Employees lost the ability to communicate, emergency medical services workers in Maryland were unable to use Stryker’s Lifenet system to send patient data to hospitals, and sensitive corporate data was allegedly compromised.
Stryker is an example of what a major attack using MDM systems looks like. Now reflect on your own company and ask yourself: What if all my devices were wiped? What would it cost my organization? The average cost of a data breach in 2026 was $4.99 million USD, up 12% from 2025 and a record high. MDM systems, if compromised, pose a threat to your organization, but why aren’t they treated as critical systems?
Most IT teams can name their high-value targets, the systems security professionals call Tier 0, without hesitation: domain controllers, identity providers, group policy administration tools, the Privileged Access Management (PAM) vault. These are the systems that get isolated networks, separate admin accounts, and the strictest information security policies. Meanwhile, your MDM platform can push a script with system privileges to 1,000+ devices in seconds, revoke a warehouse’s ability to scan a pallet, or wipe every device in your hospital ward. Yet it still doesn’t always make the list of high-value targets, despite meeting the technical definition of a Tier 0 asset on both counts that matter:
1. Privilege
2. Operational criticality
In this article, we will define a Tier 0 system, explain why device management belongs in this key security category, and outline what to look for when the MDM or enterprise mobility management (EMM) platform you are buying is going to sit in your most protected tier.
What is a Tier 0 System?
A Tier 0 system is any asset whose compromise or failure would give an attacker effective control of the entire IT environment or would halt the business outright. Tier 0 assets sit at the top of the trust hierarchy and are governed with stricter isolation, access control and recovery requirements than all other infrastructure.
The term is used in two ways, and both apply to device management:
Dimension | The Tier 0 Question | Classic Tier 0 Examples |
Privilege (Security tiering) | If this is compromised, can the attacker control everything else? | Active Directory domain controllers, Active Directory Federation Services (ADFS), certificate authorities, identity providers, PAM vaults |
Criticality (Availability tiering) | If this goes offline, does the business stop? | Payment authorization, dispatch and call-routing systems, core transaction databases |
The privilege definition comes from tiered administration models, much like Microsoft's tiered access approach to Active Directory. The principle is separation, where an administrator working in Tier 2 should have no credential path into Tier 0, because a Tier 0 compromise cannot be contained by lateral-movement defenses. The system itself is the control plane.
The criticality definition comes from business continuity planning, where Tier 0 describes applications with a near-zero recovery time objective, or systems you cannot afford to have down at all, rather than systems you would prefer stayed up.
Why MDM and EMM Platforms Are Tier 0 Systems
Device management is rarely classified as Tier 0, which is exactly why it is worth examining. Four properties stand out.
1. It holds unmediated privileged control over every managed endpoint
An MDM or EMM platform can silently install and remove applications, execute scripts at system or device-owner level, change security configuration, disable hardware, relocate a device, view a screen and erase local data. It does this by design, with the device user's consent, at scale.
Functionally, that is administrative control over every endpoint in the organization from a single console. That is the defining privilege test for a Tier 0 system. A compromised device management platform is not a data breach in one system; it is remote code execution on the entire device estate, distributed through a trusted, signed channel that endpoint protection is configured not to question. The industry has already seen mass-deployment tooling used this way, such as remote management platforms becoming the delivery mechanism for ransomware and commercial spyware precisely because they offer reach and trust in one place.
2. It underwrites the identity and network controls other systems depend on
Device management platforms distribute the certificates, Wi-Fi profiles, virtual private network (VPN) configurations and enrollment identities that authenticate devices to the rest of the environment. In most Zero Trust architectures, MDM systems are the source of device-posture signals that conditional access decisions are based on.
That creates a dependency that is easy to miss during classification. If the device management platform can issue the credentials and assert the compliance state, then controlling it means being able to manufacture a trusted device. An identity system that is hardened to Tier 0 standards is only as strong as the platform feeding it device trust.
3. For frontline operations, downtime is an immediate business stoppage
In a warehouse, hospital, store or delivery fleet, the managed device is not just a productivity tool; it is the operational interface. Picking, scanning, dispatch, triage, proof of delivery and point of sale all run through it.
When the management platform is unavailable, an organization cannot provision replacement devices for the next shift, cannot push the app update that fixes a broken workflow, cannot remotely recover a locked or misconfigured device and cannot enroll the seasonal hires starting Monday. The tolerance for that outage is measured in hours at most. That is a Tier 0 recovery time objective, whether or not the platform has been formally assigned one.
4. It carries Tier 0 privilege with a Tier 2 exposure profile
This is the structural problem. Domain controllers can be placed on isolated networks and reached only from hardened admin workstations. A device management platform cannot. It must be reachable by devices checking in from delivery vans, third-party warehouses, hotel Wi-Fi and cellular networks anywhere in the world.
The platform combines the privilege level of an identity system with the Internet exposure of a public web service, and it is usually administered by an endpoint team using ordinary corporate credentials on ordinary corporate laptops. Classifying it correctly is what closes that gap.
Four Things to Look for in a Tier 0 Device Management Vendor
If device management belongs in Tier 0, then the evaluation criteria change. Feature checklists and per-device pricing matter less than architecture, control and durability. Four areas deserve direct questions during vendor selection.
1. Can you place the control plane inside your own trust boundary?
Tier 0 classification usually carries requirements about isolation, data residency, network segmentation and administrative access paths. A cloud-only platform decides those things for you.
When selecting a Tier 0 vendor, ask whether the vendor supports on-premises, hybrid and cloud deployment of the same product (not a reduced legacy edition) and whether you can run it in a segmented or disconnected environment if your security architecture, regulator or customer contracts require it. For organizations in defense, government, emergency services, healthcare, utilities and manufacturing, the ability to keep the control plane inside a controlled boundary is often the difference between a platform that can be classified Tier 0 and one that cannot.
2. How granular is privileged access inside the platform?
The relevant question is not whether the console supports single sign-on (SSO) and multifactor authentication (MFA). It is: who is able to wipe your organization’s devices at 2 a.m. and what stops them?
Look for role-based access control granular enough to separate help desk actions from destructive ones, scoping that limits administrators to specific sites, regions or device groups, and a tamper-resistant audit trail that records who changed what and when. Tier 0 administration models depend on being able to tier admins inside the tool, not just around it.
3. What happens to your operation when the platform is unreachable?
Every Tier 0 system needs a documented answer to this, and vendor claims vary widely.
Test three things specifically. First, degraded-mode behavior: do enrolled devices continue to enforce cached policy, lockdown and app configuration when the server is unreachable, or do they fail open or fail closed? Second, break-glass recovery: can you restore configuration, policy sets and enrollment records to a known-good state, and how long does it take? Third, diagnostics: when a device fails in the field, can you determine root cause remotely, or does recovery depend on physically retrieving it? A platform that gives you device-level telemetry and remote remediation shortens every incident you will ever have.
4. Will the vendor still be around in 10 years, and will it still support your devices?
Tier 0 systems are not re-platformed casually. Migrating a device management platform across a large frontline estate is a multi-year program, so vendor durability is a security and continuity concern rather than a procurement preference.
There are two questions that need to be asked.
First, are the vendor's ownership and roadmap stable, or has the product changed hands, been spun out or been folded into a larger suite? This industry has seen a great deal of that, and each transition has meant re-architecture and support disruption for customers.
Second, how deep does support go for the devices you actually run? Rugged handhelds, industrial printers, scanners and purpose-built devices need firmware-level and original equipment manufacturer (OEM)-level integration, not generic mobile operating system coverage. A vendor whose support for your hardware is one release behind is a vendor whose Tier 0 system blocks your device refresh.
Classify It Before Someone Else Does
The practical next step is small: pull your Tier 0 asset inventory and check whether device management is on it. If it is not, the classification exercise is worth running. The privilege model, the recovery objective and the exposure profile will not have changed, only your visibility into them.
SOTI works with organizations whose frontline devices are the business, and whose device management platform is treated accordingly—deployed on-premises, in the cloud or hybrid, with the access controls, resilience and OEM-level device support that a Tier 0 classification demands. If you are running that exercise now, we would be glad to help you pressure-test it.
