NBFC
One management plane for every endpoint: OpenIY MDM at the core of a lender's security programme
Financial Services — Non-Banking Financial Company (NBFC). OpenIY MDM (unified endpoint management), patch management, application security (SAST/DAST/OSS), identity & SSO, and Zero Trust network access.
BUSINESS REQUIREMENT
What the client needed
Our client — a non-banking financial company in growth mode — had the security problem that scale creates: a device fleet spread across Windows, Linux, macOS, Android, and iOS, a distributed workforce touching regulated customer data, and a compliance posture that lived in policy documents rather than in the infrastructure. When a device was lost, offboarded, or fell out of policy, the organization found out later — if at all. Audits meant reconstructing evidence instead of exporting it. The client didn't want five point tools stitched together. They wanted a security programme with a single, defensible foundation.
WHAT WE FOUND
Findings on the ground
- Fleet sprawl across five platforms: A device estate spread across Windows, Linux, macOS, Android, and iOS — with a distributed workforce touching regulated customer data and no single management plane.
- Compliance lived in documents: The compliance posture lived in policy documents rather than in the infrastructure. When a device was lost, offboarded, or fell out of policy, the organization found out later — if at all.
- Audit by reconstruction: Audits meant reconstructing evidence instead of exporting it — no live view of fleet encryption, OS currency, or policy adherence.
- Point-tool stitching: The client didn't want five point tools stitched together. They wanted a security programme with a single, defensible foundation.
WHAT WE DID
The engineering response
Mekosha Technologies designed the programme around OpenIY MDM — our unified endpoint management platform — as the management plane for the entire fleet, with the surrounding security services building on that foundation rather than working around it. This is the OpenIY MDM philosophy in practice: provable policy enforcement rather than documentation-only compliance. Managed doesn't mean restricted — it means every device can be trusted, and that trust can be demonstrated.
- OpenIY MDM — every device, one console: Zero-touch enrollment brought corporate and BYOD devices across all five platforms — Windows, Linux, macOS, Android, and iOS/iPadOS — under centralized management. Compliance policies for encryption, passcode strength, OS version, and jailbreak/root detection are enforced by the platform, not requested by a memo.
- Provable policy enforcement: App allowlisting plus USB and Bluetooth data-transfer controls close everyday exfiltration paths. Lost, stolen, or offboarded devices are remotely wiped — fully or selectively — with the action logged. The live compliance dashboard answers "what is the state of our fleet right now?" with a screen, not a survey.
- Phased rollout that de-risked adoption: Discovery and policy design first, a client-nominated pilot next, policies tuned on real feedback — then batch enrollment of the full fleet, admin training, and complete runbook handover. Acceptance bar: every in-scope device enrolled and reporting compliance, a signed-off device policy, and a successful remote-wipe test performed live.
- The programme around the platform: With OpenIY MDM as the base layer: systematic patch management with staged pilot-to-broad rollouts; SAST, DAST, and open-source licence governance in the development pipeline; centralized identity with SSO, MFA, and conditional access; and Zero Trust Network Access replacing flat VPN — with device posture checks from the managed fleet feeding access decisions.
OUTCOMES
What changed
Five operating systems, one management plane
the entire endpoint estate visible, policy-enforced, and reportable from a single OpenIY MDM console.
Compliance became demonstrable
Compliance became demonstrable: encryption status, OS currency, and policy adherence enforced by the platform and exportable as audit evidence on demand.
Lost-device risk neutralized
Lost-device risk neutralized: remote and selective wipe, tested and proven during acceptance.
Endpoint management became the trust anchor for patch compliance and Zero Trust access decisions informed by real device posture
Endpoint management became the trust anchor for patch compliance and Zero Trust access decisions informed by real device posture.
The client's IT team owns it: admin training, runbooks, and a live dashboard handed over
a capability transferred, not a dependency created.
RELATED STORIES
No trusted device, no access — OpenIY MDM Zero Trust
Zero Trust access built on OpenIY MDM — live device posture at the point of access, identity-bound enrollment, and an exportable audit trail of every allow-or-deny decision.
Read the case study →From paper logs to a connected factory
Four SMT lines on a unified Industrial IoT platform — live OEE, QR lot-to-board traceability, station interlocks, and SAP integration.
Read the case study →Bring us a line, a fleet, or an audit finding. We'll bring the architecture.
A discovery workshop with our solutions engineers — your assets on a whiteboard, no generic pitch deck.