The Devices That Leave the Building Are the Ones That Need a Wipe Path
A device you cannot name cannot be wiped. The fleets that leave the building are where that gap shows up.
PowerSchool's student-information incident and the Change Healthcare notifications are vendor events. The hardware a district or a clinic rolls out the door is not. Both can be true in the same month, which is why device ownership has to be boringly complete.
A cart of laptops is safe in the closet and unsafe in the parking lot. The control that travels with the cart is enrollment: an agent, a named user, encryption, and an admin who can wipe after hours. The PowerSchool note is about student data taken from a support portal. This note is about the laptop a teacher still had in the car while that letter was being drafted.
Three fleets, one test
- School staff laptops that sync student lists.
- Clinic laptops that cache eligibility or claim documents.
- Retail or field handhelds that keep customer contacts.
Pick one device from each fleet and simulate a loss. If the simulation ends in "we would call the user and hope," you do not have a wipe path. DriveStrike is the product Spearstone uses to make that simulation end in a lock, a wipe, or a locate request. Policy language lives in the MDM examples. The product still has to be installed.
Contact Spearstone to scope a fleet, or start a DriveStrike trial on a handful of devices that actually leave the building.
Keep reading
- A 2025 Survey Found Device Theft at 76% of the IT Teams Asked
- The August 2025 Advisory Is About Routers. Traveling Staff Still Carry Phones.
Questions worth answering directly
Does a vendor breach mean school laptops are already compromised?
No. A SIS intrusion and a lost laptop are different events. The laptop still needs its own control because student data is often copied onto it.
What is the minimum enrollment standard?
You can identify the device, you can encrypt it, and a named admin can lock or wipe it when it is not on your network.