If You're Not First, You're Last

There's a scene in Talladega Nights where Reese Bobby leans across the hood of a car and tells his son: "If you ain't first, you're last." It's played for laughs — Ricky Bobby takes it as gospel, and it gets him nowhere except wrapped around a wall. But strip away the absurdity and there's something buried in that line worth taking seriously: whoever establishes the first principle first gets to define the terms everyone else has to play (and live) by.

That's exactly what happened in enterprise mobile security. And it's why, twenty years later, we're all still living inside an assumption that has quietly stopped being true.

The First Principle That Won

Long before Microsoft Intune existed, BlackBerry built its empire on a foundational belief: you can make a mobile endpoint trustworthy. Lock down the hardware, control the OS, encrypt the data at rest, manage the device end-to-end, and the endpoint becomes safe enough to hand sensitive corporate and government data to.

Microsoft didn't invent that principle. It inherited it, generalized it, and scaled it to the rest of the industry through Intune and the broader Unified Endpoint Management category. The first principle stayed the same: secure the endpoint through management, and the endpoint earns your trust.

For a long time, this was a perfectly reasonable bet. Threats were slower. Attackers needed real skill, real infrastructure, real patience. Managing your way to a trustworthy endpoint was a race you could actually win.

It was the appropriate principle — for its era. That's an important distinction, because this isn't a story about Microsoft or BlackBerry getting it wrong. It's a story about a sound first principle aging out of relevance faster than almost anyone expected.

The Ground Shifted Under the Principle

Two forces are colliding right now that the managed-endpoint model was never built to survive.

First, offensive capability has been democratized. Frontier (Mythos) and open-weight models (GLM-5.2 among them) have collapsed the skill barrier that used to separate nation-state operators from everyone else. Convincing phishing campaigns, malware variant generation, social engineering at scale: these no longer require a sophisticated adversary. They require a laptop and a jailbroken model. The economics of attack have inverted. What took a team of specialists now takes an afternoon.

Second, and equally damning: even sophisticated, well-resourced attackers have realized they don't need to beat the endpoint at all. They can go straight for the control plane that manages it.

On March 11, 2026, an Iran-linked group calling itself Handala proved exactly how devastating that shortcut can be.

Stryker: The Proof of Concept No One Wanted

The Stryker incident deserves to be studied by every security leader who still believes "managed" means "safe."

According to multiple independent reports, Handala didn't write custom wiper malware. They didn't need to. They compromised a Windows domain admin account, used it to create a new Global Administrator identity inside Stryker's Microsoft Intune environment, and then issued a native, fully authorized remote-wipe command across the fleet. Over 200,000 devices — laptops, mobile phones, virtual infrastructure — went dark across 79 countries. Tens of thousands were employees' own personal devices, enrolled in Intune for the ordinary convenience of checking corporate email on a phone they owned.

No exploit, no zero-day and no malware signature for anyone to detect. Just a trusted system doing precisely what it was built to do, on the instruction of someone who was never supposed to hold the keys.

This is the part that should keep every CISO up at night: the attack didn't fail because Intune was poorly built. It succeeded because Intune worked exactly as designed. The management layer that was supposed to be the source of endpoint trust became, in a single credential compromise, the single most efficient destruction mechanism available to the attacker. One login, two hundred thousand devices, wiped in hours, not months.

BYOD made the blast radius worse in a specific way that deserves its own mention. Employees enrolled personal devices for convenience, unaware that the same enrollment that let them read email at the airport gave a compromised admin account the standing authority to erase their family photos, their two-factor authenticator, their personal financial apps — everything — without their consent and without an exploit ever touching their phone.

The Second Front: AI Finds the Exploits Already Living on the Device

Stryker shows what happens when an attacker goes after the layer that manages the endpoint. But a second front is opening at the same time, aimed at the endpoint itself — specifically, at every application installed on it.

On April 7, 2026, Anthropic disclosed Claude Mythos: a frontier model capable of discovering and exploiting software vulnerabilities largely on its own. In pre-release testing through Project Glasswing, Mythos found more than 10,000 high- or critical-severity vulnerabilities across every major operating system and browser, including a 17-year-old remote-code-execution bug in FreeBSD and a 27-year-old flaw in OpenBSD. Engineers reported handing it a target overnight and getting a working exploit by morning — the kind of work that used to take a human red team weeks. Anthropic judged the capability dangerous enough to withhold: Mythos isn't available through any public API or self-serve channel. As of June, it's licensed to roughly 150 vetted partners under export-style controls, treated less like a product feature and more like a strategic asset.

That containment held for about two months. In June, Zhipu AI released GLM-5.2, a 744-billion-parameter open-weight model, under an MIT license, downloadable by anyone. On vulnerability-detection benchmarks, GLM-5.2 performs in roughly the same range as Mythos, at an estimated $0.17 per finding versus over a dollar for comparable Claude-based workflows — no vetting, no monitoring, no partner agreement required. Whatever guardrails Anthropic built around this class of capability, the open-weight ecosystem rebuilt the capability itself and shipped it without them.

Put those two data points together and the implication for edge devices is direct. Every application installed on a managed endpoint — the expense app, the field-service tool, the line-of-business app your BYOD policy just approved — is now a target that a model like Mythos or GLM-5.2 can be pointed at, cheaply, at scale, without a human security researcher in the loop. Vulnerability discovery that used to bottleneck on scarce expert time now bottlenecks on nothing. An attacker doesn't need to find your zero-day; they need to rent or download a model that will find it for them by dinner.

This is a different attack surface than Stryker's. Stryker was about compromising the layer that manages the fleet. This is about compromising the software that lives on each device in the fleet, one app at a time, at a pace no patch cycle was built to match. Managed or not, BYOD or corporate-owned, if an exploitable app is installed locally, AI-driven vulnerability discovery will eventually find the way in, and MDM policy has nothing to say about a flaw in the app itself.

Why "Manage the Endpoint" No Longer Works as a First Principle

None of this means Microsoft or Intune are uniquely flawed. It means the first principle itself — that sufficient management renders an endpoint trustworthy — depends on an assumption that no longer holds: that defenders can manage and patch and monitor faster than attackers can find a way in.

That assumption was reasonable when the attacker's cost of innovation was high. It stops being reasonable the moment frontier models make attacker innovation nearly free and stops entirely the moment attackers realize the fastest path isn't the endpoint; it's the console that manages ten thousand endpoints at once.

Stryker wasn't an edge-case failure of endpoint management. It was a demonstration that centralized management of untrusted endpoints creates a single point of catastrophic failure precisely because it's centralized. The better you are at managing endpoints at scale, the more devastating it is when the management layer itself is the thing that gets compromised.

The First Principle That Has to Replace It

If the old first principle was "the endpoint can be made trustworthy through management," the principle that actually fits today's threat velocity is different: the endpoint is not an asset to be secured, it's a liability to be neutralized.

That's the founding assumption behind zero-trust virtual mobile infrastructure, and it's the one we've built Hypori's platform around. If sensitive data and applications never actually reside on the device — if the endpoint is rendering pixels rather than holding data, credentials, or files — then compromising the endpoint yields the attacker nothing. There's no local data to exfiltrate. No local wipe command that destroys anything of value, because nothing of value was ever there. A stolen device is a pane of glass, not a vault.

This isn't an incremental improvement on managed-endpoint security. It's a different first principle entirely, one built for a world where:

• Attacker capability is now commoditized rather than scarce — vulnerability discovery that once required scarce, expert red-team time is now something models like Mythos and GLM-5.2 do cheaply, at scale, against every app installed on an endpoint
• Management infrastructure itself is a high-value target, not just a control mechanism, because compromising the console compromises everything it manages simultaneously
• BYOD and corporate-owned devices need to be treated identically, since the device was never the trust boundary to begin with
• The threat model changes faster than patch cycles, policy updates, or compliance frameworks can keep pace with

Being First Isn't About the Calendar

Reese Bobby's line was a joke because it pretended there was no nuance — first or last, nothing in between. But there's a real version of that idea buried in how security architectures compete: the organization that identifies the correct first principle before the threat landscape forces everyone else to catch up isn't just early. It's the one setting the terms of the conversation for everyone who comes after.

Microsoft and BlackBerry were first to a principle that was right for its moment. The question worth asking now isn't whether that principle was ever valid — it clearly was. The question is whether you're willing to keep betting your organization's security on a principle that was built for a threat landscape that no longer exists.

The edge can't be trusted not because anyone built it badly, but because trust was never the right thing to try to build there in the first place.

If you're not first to recognize that, you're not just late. You're the next Stryker.