Fast AI, slow rollback: the risk facing Apple IT teams

There’s a big disconnect between the rate at which IT is deploying various kinds of AI-generated output and the speed with which it can roll those changes back when things go wrong, warns a new report from Fleet Device Management. It’s almost as if the rush to embrace AI has eclipsed the need to manage its deployment effectively.

The research, based on a survey of more than 250 enterprise IT practitioners managing Apple devices, is available in full via the company’s website and echoes similar concerns I’ve heard from others in the space. I spoke with Fleet founder and CEO Mike McNeil to get his take on the disconnect. 

What’s happening in the enterprise

First, some of the stats gathered in the survey:

86% of respondents allow AI-written output to reach production devices following some review.

61% used AI to author an MDM profile/configuration in the past month.

62% used it to write scripts/code.

69% can’t roll back a bad configuration within an hour; 43% need more than a day.

About a quarter (26%) can recover the same day but only with manual intervention.

McNeil stressed the challenge exposed by this data. “When one of those changes is wrong, 69% can’t undo it within an hour, and 43% need more than 24 hours,” he said. “So the exposure is real even without a count of incidents. The AI tool isn’t what gets pulled back. The configuration it produced is, and most teams do that by hand.”

The risk of moving too fast

He told me that just 7.6% of Fleet’s customers are exclusively Mac shops, confirming that most Fleet clients manage multiple platforms. It’s not a platform-specific challenge; McNeil sees this as a problem for all of them.

“I’d frame risk by two things: how much privilege the code runs with and how hard recovery is,” he explained, noting the risk of scripts running at root, which can take full control of the machine to the extent that reversion can’t undo what’s done. 

“Windows and Linux have the most scripting-heavy management, so they have the most room for script-level mistakes,” he said — but even iOS is at risk from a bad restriction or network profile, particularly when attempting to recover remotely.

He pointed out: “36% of respondents manage Apple devices through Intune, a Windows-first platform. Tooling built around one platform’s assumptions tends to be weakest at the edges of another’s.”

Why MDM is a high-risk tool

For Apple in the enterprise, the risk is inherent to device management and IT’s power to use MDM to deploy a potentially poorly crafted AI tool at scale. 

“MDM is one of the few trusted paths that can bypass the [macOS platform security] prompts, which is exactly why a bad or malicious MDM-delivered change is so consequential,” he warned. 

He continued: “Windows has a larger and older attack ecosystem, with more legacy surface area. Linux gives administrators the most freedom and the fewest guardrails. On every platform, the management channel is the high-value target, so the same controls apply — review, least privilege, a change record, and a fast revert.”

The risk is that poorly crafted AI-generated MDM profiles can set off a chain of problems that can take days to resolve, particularly in large-scale device deployments. The problem is that unless there’s a clear audit record, it’s harder to remediate errors.

“AI speeds up authoring, but review capacity stays the same,” McNeil said. “Without a gate, errors and anything malicious in a script reach production faster.”

Speed needs to be managed

Ultimately, while AI can accelerate a multitude of IT tasks, the speed of deployment must also be matched by robust review and strong rollback tools. “Speed is only an advantage if recovery keeps pace,” he said.

Fleet’s core argument is that IT needs to change how it approaches what it does. “Mac administration is an engineering discipline now, and these admins are further along than the industry thinks,” he said. “The infrastructure around them hasn’t caught up.”

How should IT approach this? McNeil suggests a succession of protections his own MDM system already supports through GitOps with YAML files, adding, “the pattern works with any tool that has an API.” 

Treat device configuration like application code. 

Profiles, scripts, and policies should live as files in a Git repository. 

A change arrives as a pull request, a second person reviews it, and automation applies it to devices. 

To undo it, you revert the commit. 

“One caveat: a revert fixes what the configuration says. It doesn’t undo a script that has already run. That’s an argument for preferring declarative configuration over imperative scripts where you can,” he advised.

Less clicking, more engineering

None of these cautions are arguments against use of AI in enterprise IT, of course. They are arguments to promote a more conscious management system around the use of it. All the same, as AI proliferates, the Fleet CEO does think IT pros must anticipate a change in their roles. “Less clicking, more engineering,” he said.

“As AI takes on more of the mechanics like creating configuration profiles, drafting scripts, and troubleshooting routine issues, admins can spend less time figuring out how to make a change and more time deciding what should change, how it affects the business and where human judgment is required,” he said.

Finally, I pointed to the ongoing dilemma between Apple and IT. Some people complain Apple doesn’t innovate in the enterprise fast enough, others say it innovates too fast. What does Fleet think?

“Keeping up with Apple’s release pace was the single most cited hardest part of the job, at 31%,” he told me. “Budget and headcount came last, at 5%. Admins aren’t complaining that Apple ships too little. They’re stretched by the yearly OS cycle, new frameworks, and deprecations.”

“My own view is that the direction is right,” he said. “Declarative Device Management and tighter platform security are good for enterprises. The pace is the issue, and it’s the main reason admins need automation and a safety net.”

Now please subscribe to my daily, human-curated Apple-related news headline feed at The Core, or follow me on BlueSky, LinkedIn, or Mastodon.ComputerworldRead More