The Question Every CISO Should Be Asking Right Now

Not all Unified Endpoint Management (UEM) or Mobile Device Management (MDM) platforms are built equal. For most organizations UEM is treated as an operational tool, a way to enroll devices, push policies, and manage applications. We are living in a time of nation-state threats, tightening data sovereignty regulations and an accelerating vulnerability landscape, so the UEM platform you choose should no longer just be an IT decision. It is a strategic security decision with consequences that reach far beyond the helpdesk.

In this very moment, UEM solutions offering a cloud-first approach, that have a reliance on other platforms and solutions to provide security, are sending signals that they are not built for uninterrupted sovereign operability.

When Trust Breaks Down

This erosion of confidence is not a matter of opinion. It is documented, federally mandated, and measurable. With multiple recent CVE’s for UEM platforms such as Ivanti, Omnissa’s WorkspaceONE and Microsoft Intune, the security of these platforms has come under the spotlight. The consequences of critical CVEs for Ivanti reached the highest levels of government. On January 31, 2024, the United States Cybersecurity and Infrastructure Security Agency (CISA) issued Emergency Directive ED 24-01, ordering all Federal Civilian Executive Branch (FCEB) agencies to: "Disconnect all instances of Ivanti Connect Secure and Ivanti Policy Secure solution products from agency networks as soon as possible and no later than 11:59PM on Friday, February 2, 2024."

Microsoft Intune fell victim to a real-world scenario in March 2026 where hackers were able to exploit cloud-based identity and access management to compromise device management controls, resulting in the remote wiping of thousands of devices with the potential for mass data theft and operational disruption. Intune's management plane is deeply tied to cloud identity (Entra ID/Azure AD) and when that identity layer is compromised, attackers can inherit administrative capabilities including the ability to wipe devices, exfiltrate managed app data, and revoke access en masse.

Going forward, trust in UEM platforms such as these will be even more strained as they favor cloud-first deployments with little or no on-premises presence.

The Difference Between Enterprise and Sovereign UEM

Most UEM platforms, including Ivanti, Omnissa, and Intune were architected for enterprise convenience. They were built to scale quickly, integrate broadly, and operate in cloud-first environments. Security was layered on top, not built-in from the foundation.

Sovereign UEM is architecturally different. It is built from the ground up on the premise that data must remain protected even when everything else fails - when the OS is compromised, when cloud identity is breached, when the network is hostile.

Here is what that distinction looks like in practice:

1. Security at the Application Layer, Not the OS Layer

Most UEM platforms rely on OS-level controls to enforce security. If the underlying operating system is compromised, so too is your data.

The BlackBerry^® UEM and BlackBerry^® Dynamics™ container works differently. It provides cryptographic isolation at the application layer encryption keys managed independently of OS processes. Enterprise data such as email, documents, and communications resides in an encrypted container that remains protected even on a compromised device.

This is not a marketing claim. It is a certified, independently verified architectural design, and it is the reason BlackBerry UEM holds certifications that no other UEM platforms can match.

2. Deployment Sovereignty: Your Infrastructure, Your Rules

Enterprise UEM solutions tend to be cloud-centric or cloud-optimized with limited on-premises capability. For organizations in regulated industries, government, defense, or critical national infrastructure, this is not a viable model.

When your UEM platform lives in a vendor's cloud, your data sovereignty lives there too, subject to the vendor's security posture, their cloud provider's legal jurisdiction, and the reach of legislation such as the US CLOUD Act. This is a material risk for the estimated 69 percent of European data residing on US-provider infrastructure.

BlackBerry UEM offers full deployment flexibility: on-premises, cloud, hybrid, air-gapped dark site, or bright site. Critically, this includes BSI-verified bright site deployments, making it the only UEM platform operationally proven for environments where connectivity to any external network is not permitted.

Data Sovereignty is therefore fully maintained by the customer with BlackBerry. In the event of a US government subpoena under the CLOUD Act, BlackBerry has no visibility into or access to customer data stored on its platform and would be unable to provide any meaningful information in response to such a subpoena. All data is encrypted exclusively with the customer's own encryption keys and remains within the customer's jurisdiction, placing it entirely beyond BlackBerry's reach.

3. Regulatory Compliance

It is straightforward to claim security. It is considerably harder to prove it to the satisfaction of national security authorities. BlackBerry UEM holds the most comprehensive government certification portfolio of any UEM solution available.

Other UEM solutions have limited accreditations in the regulated space, whether they are lacking FIPS 140-2, NIAP/Common Criteria, German BSI, EAL 4+ or even NATO restricted level NIAPC. BlackBerry UEM holds all of these and many more, demonstrating that BlackBerry UEM can be trusted to deliver on true mobility security outcomes where it matters.

The BlackBerry post-quantum cryptography roadmap, aligned to NIST FIPS 203-205, helps ensure that sovereign deployments remain protected not just against today's threats, but against the cryptographic challenges of tomorrow.

4. The Commercial Reality: Customer Feedback

BlackBerry UEM customer feedback recently scored 85 on the Net Promoter Scale (NPS), amongst the highest in the software industry. In contrast, other UEM solutions score very low (28 for Ivanti) and in other cases without a score, possibly reflecting a materially different, or poorer, customer relationship. Customer feedback is clear as can be seen from the recent Gartner Peer Insights report that customers are very mixed in their appraisal for those solutions.

The BlackBerry UEM Offer: Zero Overlap. Zero Risk. Zero Compromise

BlackBerry understands the current climate and is making it easier to switch to BlackBerry UEM by removing commercial and technical barriers that would normally make such a move challenging. For organizations whose Ivanti or other UEM contract is approaching renewal, BlackBerry will help you make the switch to BlackBerry UEM today.

To learn more about BlackBerry UEM and our offer to you, visit Ivanti versus BlackBerry UEM or contact the BlackBerry team directly.

The Bottom Line

The gap between enterprise and sovereign UEM has never been wider and it has never mattered more.

Ivanti's track record, 12 critical CVEs in the past three years alone, a CISA Emergency Directive, federal disconnect mandates, eroding certifications, and declining customer confidence represents a structural pattern. A pattern that can be seen with other enterprise solutions.

BlackBerry UEM has zero major CVEs over five years, the deepest government certification portfolio in the market, app-level cryptographic isolation, and full deployment sovereignty - from enterprise cloud environments to NATO Restricted air-gapped networks.

For organizations where data sovereignty is not a preference but a legal and operational requirement, the question is no longer whether to move, rather 'how quickly can we make the transition?' BlackBerry is here to help you.

References and Further Reading

• NIST National Vulnerability Database

• Ivanti Coughs Up Exploited EPMM Zero-Days

• CISA Known Exploited Vulnerabilities Catalog

• Cyber Magazine