What has Jamf provided for me? Hey, hey, hey. Drop. Yeah. Yeah, we on the next one. Easy. Yeah, yeah, yeah. We on the one. Easy. Never like the next. We ain't even got a flex, huh? Too easy. Easy. Easy. You ain't got to tell me. Too easy, easy. Easy. Easy. You ain' got to. Tell me. What has Jamf provided for me? A career. a career please welcome to the stage ceo of jamf beth cheetah Hello, Jamf Nation, and yeah, hello, good morning, good afternoon, and good evening to all of you streaming with us today. We are so glad you're with us, and for all of those of you right here in this auditorium with me. Welcome to Kansas City and welcome to JNUC 2026. So it's incredible to think that this is the 17th JNUCC, number 17. It had me thinking nostalgically back to my first JNUC, which was in 2018. Yep, that's me. I am less than 30 days on the job in that photo. Dean Hager, our CEO at the time, had stopped me in the hallway at work and said, hey, Beth, you know, we have a user conference in a couple weeks. A few thousand customers would love to get you on stage. You can kind of explain what's going on. I mean, Dean, you're good with public speaking. How do you feel about that? And I thought about my life choices and my career choices at that moment. And I said, yeah, Dean, of course. Public speaking, basically my love language. Yeah, I would be happy to. And that was a bold-faced lie directly to the CEO. You know, it wasn't just the stage, though, that intimidated me. It was the idea that I was going to spend a week with thousands of you who knew the product better than I did. And after 20 years in IT, it felt a bit like I was gonna be having that repeating Friday call you get at 2 o'clock. I think you know the one. Not where they're calling to see how your weekend plans are going, but to tell you the software you deployed or are about to deploy is gonna have some adverse impact on planet Earth. So I braced myself when I went into that Hyatt in Minneapolis. And you know, he told me the truth. You always have, and I am down for that. In fact, one of the first people I met at that very first JNUC was Martin Lang from SAP. And I can tell you that Martin and the SAP team, they have very high standards. They have never once lowered them to make me feel better. And that's a good thing because it means we have better products because of it. We have a better BYOD product because of that. You know, this community, you push us. you hold us accountable and you should but what I didn't expect and what I have come to love about this community is that you genuinely want each other to succeed I see it over and over again somebody spends a weekend writing scripts and someone needs help and here you go try these see if see if these will help you and it's the same whatever city you might be in sure the deployments are different. The priorities are different, but how you show up is the same. You show up to learn from each other, to hold each other accountable, and to hold us accountable. This, this right here, this community is the best community in tech. So Dean, if you're watching, yes it is. Yes, absolutely. And I was going to say, Dean, if you're watching, and I know that you are because you're a forever super fan of this community, somewhere between that first nervous JNUC and today, that lie turned true. And it is because of this room and everyone in it. So today, I'm honored to be back on the stage with you again, but this time as Jamf's CEO. Thank you. So, here's what I believe. I believe everything now lands on the end point for you. Whether it's a tool, whether it's rule, whether a policy someone is trying to figure out what to do with, it has always landed on you first. I just think with AI now, everyone is starting to really notice. And our job is to keep building for you, to make sure that what you have is going to be purpose-built for what you need and I want to show you how because in the 17 years we've been doing this two things haven't changed the awesomeness of this community and our mission so if you take a look at this in 2010 the very first JNUC you all were trying to figure out what the iPad meant for your environment skip ahead to 2013 and security breaches went from a quiet boardroom conversation to being on the nightly news and everyone asking you what your position was on security. GDPR comes in, and compliance now comes with a set of lawyers. And then ChatGPT, it drops on your Macs before anyone knew what was going on and before anyone had even contemplated what policy they might want to write. Now, this is just a sampling, but every one of those landed on you first, before the policy existed, before anyone wrote it down before the rest of the organization noticed. And now, well, AI is running on those endpoints, taking actions, updating files, writing the code, not helping to do it, doing it. And everything on the left side of that chart, well, that took a decade to get through. Everything on the right side, just a few years. Think about how much acceleration has happened in this space since the last JNUC, or since August, or since two models dropped yesterday, I believe. And still, our mission remains unwavering and unchanged. We help people do their best work on Apple. That's it. That will always be it. We're Apple first, and we are Apple best. And that was never the safe bet, by the way. But we made it anyway because we believe people do their best job on Apple devices. We do their work on apple devices. We've built everything around that. Now, we know your people do not only touch apple devices, They're on Android. They need help with identity and security. Being Apple first has never meant we stop there. But it does mean we go deeper on Apple than anyone. And nowhere is that depth more visible than on the Mac. Because the Mac's having a moment, unlike anything we've seen before. Demand is surging, and the hardware is a big part of the reason why. And the incredible breadth of their lineup means there's a Mac for everyone and for every job. Organizations that run entirely on Windows, they're adding a Mac or maybe switching all together. And Apple has built security and compliance into the operating system. So yeah, maybe the people that told you Mac wasn't ready or was an exception, they aren't saying that anymore. So if there's a case you've been waiting to make, this is the year to make it. And your people have never been more clear about what they want. When people have a choice, they choose Apple. Apple. And Apple Silicon is certainly at the center of this. Most developers are already on Mac, and they're certainly at at the forefront of agentic AI, and Apple's newest hardware was built for exactly that. And now, well, now AI is powering up Apple even further, and that's what makes this moment different from every other Mac moment. Now, some of the AI is going to come to you from the cloud, and some of it local, some that open wait, of it frontier. Most of you are going to want all of it, and our job is to meet you where you are. But here's the thing. To see what's happening on the device, you have to be on the device. And that's why some of what you'll see today could only be built on Apple Silicon. AI runs better on Apple, and Apple runs better on Jamf. But you still need to have someone that manages it, secures it, supports it, that's this community and you know it doesn't just happen somebody has to build it first and two blocks from here is proof of exactly that the power and light district in kansas city is a vibrant part of the city what most people don't know though is it took a couple decades to get that built there were several tries and what finally worked was when they decided to build the infrastructure first they ran the cables they stood up the grid and in 2008 they powered it on When Jamf was born, in a very similar way, there was no infrastructure for Apple in the enterprise. The Mac, yes, had a creative foothold in creatives and in classrooms and creative studios, but admins who wanted to take it further, they had to just try and stitch workarounds, lay the cables and wire it together as best they could. It wasn't built for the job. So we started as a tool for a handful of Mac admins managing a handful Apple devices. And today, we manage, wait for it, over 35 million devices for more than 78,000 organizations. The hospitals, the schools, the governments, the enterprises that run Apple, they run Jamf. Yeah. And you know what? But we built that foundation together and we keep it running, we add capabilities together and it's the grid that everything else runs on. So this year, we're going to show you what happens when we power that grid all the way up. So let's talk about what that looks like. Because powering up isn't just a metaphor for us. It's three specific things, three circuits. The first one is the API, our gateway to the whole platform. I have to tell you, I love a good API. This is true. You can ask any Jamf here. They will tell you I have contemplated changing my name from Beth and Cheetah to Beth API Cheetah. Yes. Now, here's why. Because there's no roadmap we could build for you that's fast enough or robust enough for you to meet what you might want to do with your organization. And APIs enable everything to talk to Jamf, including your agents. So an API means you don't have to wait. The next is the UI. That's an experience that we've built around how IT teams actually work. So you catch problems when they're small instead of when they become that 2 p.m. on Friday phone call. And then we have AI. Not a separate product, but interwoven into the workflows that you already run. It gets you ahead of the problems before anyone even knows they've existed. So today, you're gonna see all three circuits running underneath everything we show you, and we're gonna walk you through it the way that it actually shows up in your day. But there's one idea that ties them all together, and that's autonomous endpoint management. Your devices don't get managed, they get intelligent. They handle the routine, they surface what matters, and they give you back the time you need most. We know it's going to land on you first, so we're building this to amplify you when it does. That is what 2026 JNUC is about. We are here to power you up. And as it should, it all starts with Apple, so that's where we're gonna start too. So please give a warm Jamf Nation welcome back to the JNUX stage, the one and only Jeremy Butcher. Thank you, Beth. Thank you Jamf Nation. Very excited to be here. This is quite a fun time of year. Not only just to be at JNUC but for us we are in the process of releasing all sorts of new products and that's always exciting. It means we end up talking to a lot of folks And as you can imagine, those conversations end up focusing on a handful of areas that repeat themselves, which is great. And so what I thought I'd do today is walk you through really the three questions that we tend to be answering a lot right now, which is, how is it going? Why do we think it's going that way? And what's next? And so with that, I'll just dive right in. The spoiler on this answer, as you might expect, is we think it's going pretty well, in large part thanks to all of you. Some really great momentum that we're seeing across business and education. A couple of things to pull out on this slide. One is that MacBook Air remains the number one laptop in business, which we're very excited about. So thank you again for all of that. And the other one that I think is quite exciting is something that was a statement that was was sort of a proclamation made a number of years ago on a JNUC stage by Jamf, which is, at the time, years ago, they predicted that we were on a track to have more Apple devices in enterprise than any other brand. And I'm very excited to tell you that that day has now happened. And there are more iPhones, iPads, Macs, Apple TVs, Vision Pros than any brand out there. And so it's just a testament to a lot of the work that all of you have done. So again, one more thank you to all of you for that awesome momentum. OK, so why is this happening? What's driving the growth? There's so many answers to this question. Awesome hardware, software services, of course. But I wanted to focus on something that you might not expect us to say, which is that I feel like we really have a unique way of investing for enterprise and education features. And what I mean by that is we have this two different levers. We have the ability to adapt features that we're building for everybody while still also focusing on creating bespoke features for businesses and schools. And so this year, this 27 set of releases has tons of those examples. So I'm going to go one by one and tell you all about them. No, we don't have the time. But I encourage you to take a look. I did want to focus on two of them, though, and explain a little bit of what I mean around adapt and create. So the first one is a capability that we've added. This is an adapt example, something that our AppleCare agents would do with our customers that call in and need help. Often we need logging. Sound familiar to any of you? And so that's not always an easy thing to walk a consumer through, as you also very well know. And so we created a way for our Applecare agents with permission from the customer to actually gather logs and send it back to AppleCare. We did that a few years ago, and this year in the 27 releases, we're bringing that via an MDM command for all of you so that when you're on the phone with AppleCare and they say, we need logs, you're like, well, it's an executive that it's going to be hard to get. They say, great, we'll fire up Jamf and use the API and push the button, and it sends a sysdiagnose back to appleCare and attaches it to your ticket really easily. So a great example of taking something that we built, adapting it slightly to make it really valuable, we hope, for all of you in troubleshooting issues going forward. So that's the first one. The second one is hopefully very familiar to many of you, which is platform SSO, platform single sign-on. This is a multi-year investment for us to bring the identity that all of your users use each and every day right into the login window on the Mac. This year, the focus was really around customization. Not only in the branding that you see on the screen here, which is kind of in your control, but also in customization around authentication methods. So on the education side, that means that a student could walk up to the Mac and hold a QR code up to a camera to log in. On the enterprise side, that's things like multi-factor off, maybe you're using your phone in addition to another factor, or maybe that's a passwordless option altogether. So lots of continued progress in this space, and hopefully you all are taking advantage of it. This isn't just a this year thing, we've been doing this for quite a while. You can see if you kind of look back, there's lots of examples of this adapt and create approach taking hold. So, what's next? The answer here is another number and another logo on that slide before, more to come. But really I think what you all expect for the answer to be is AI. This is an exciting area because we're talking to a lot of customers that are putting it into action. A lot of folks are still figuring it out, but a lot folks have. And now it's about putting it in to practice. And so that's always a very fun conversation to be a part of. And one of the biggest conversations that we are a part is sort of where it should all run. And should it be in the cloud for all its benefits? Should it be on device for its benefits. And ultimately, we think it's going to be this combination of both. And that makes us really excited because we think our platform really makes for the best way to do both. And that's partially because of how well we think we do on device. From performance that Apple Silicon brings, the unified memory architecture that we have, really does prove to be quite impressive from a performance perspective. The security that you all know and hopefully trust very well is all that much more important in the context of AI. And then obviously being able to run these things on device changes the economics of token costs, which in a lot of cases helps pay for the Mac in a few months, or the iPhone or the iPad. So it's quite exciting time. We've got a ton of resources available to folks. We continue to have these conversations. We look forward to working with all of you to the extent that we can to bring all this stuff to life. And that's my time today. So I'm going to turn it over to Katie to tell you about what's next. Thanks all. All right. Thank you so much, Jeremy, for being here with us today. Jamf Nation, it's awesome to be here with you. All right, we're going to start today a little bit differently because we've got just as much ground to cover as normal, but we're not going to do feature by feature, release by release. We're actually going to what Beth said. We're going to walk through how it plays out in your day, because your job definitely isn't what some org chart says it is. It's not configuration one day or troubleshooting the next. It's kind of everything all at once, and you get to piece it together with whatever you have on hand. So we're going make it real, and we're gonna spend a day in the life of your devices so you can figure out what's possible with Jamf and what to power up when you leave Kansas City. We all know the work actually starts way before your day begins. While you were asleep, a new hire in a distant time zone enrolled a new device, patches deployed to devices that were ready for them, compliance checks ran and mostly passed. None of that's luck. That's the power of the platform running under everything that we're going to show you today. That new hire and another time zone got a fully configured compliant laptop because you'd already defined your compliance state with our new standard. declarative device management. Now, for a while, it felt like a far-off distant future, but for OS 27 and for key workflows like enforced software updates, it's our only path forward. And that's why we built Blueprints. So you'd have one place to define all the settings that you need on all of your Apple devices. It stays current automatically, so you get new capabilities before the operating systems even ship. Now, a year ago, getting Blueprints to work in your environment meant making some compromises. But today, it just works. With better scoping, deeper visibility, and an audit trail you trust. Those new hires already have working, compliant laptops before you'd had your first coffee. But configuration isn't just about settings, right? It's about apps, too. And Blueprints handles that each morning. So your new hires have their software waiting for them right at first login so they can get right to work. We're going to talk a little bit about App Store apps first. Because if you've run volume purchasing at any kind of scale, you already know the bottlenecks. Assigning a license means making a request to Apple, a check-in, an installation command, another check- in. Usually, that's pretty quick. But during your busiest times of the year, like back to school or a big refresh or a new hire cohort starting on a Monday, the queues can start to back up. And the answer comes back, please wait. And your employee is stuck looking at a spinner with no idea why. We've been busy rebuilding apps and books. It's already powering Jamf School and it's coming to Jamf Pro as a Blueprints native component so that license assignment is optimized against Apple's updated APIs. So we're going to see how this looks. I'm happy to invite my friend Misha to the stage. And for the next few minutes, please imagine that Misha is part of your IT team walking through the challenges of the day like you might. Good morning. Hi, Katie. All right, Misha. So I'm looking at Jamf account, let's go ahead and use app switcher to get to Jamf Pro. Once we're here, we'll go to blueprints and we'll create a new blueprint for our productivity apps. Now you can already see a hint of it, but once we get scrolling through those components, we start seeing all of the apps that are available to us. And because Blueprints is now site aware, we're only seeing the licenses that are available in our part of the organization. So we're going to start with something pretty basic. We'll add Trello to our blueprint. And once we do, we can actually see the installation options. We can see the licenses that are available to us. Pretty easy. Good to go so far. But while we're here, there are plenty of other apps that our Mac users rely on that aren't necessarily available in the App Store. And historically, that's meant a separate process, separate tools, own set of headaches, including sitting completely outside the declarative model that everything else relies on. Today, application lifecycle management gets a major improvement with a curated catalog of non-App Store Mac titles delivered through Blueprints using declarative logic that works right alongside our App Store experience. So we add an app, we scope it, it installs itself, pulling the original installation media straight from the vendor, not a repackaged copy sitting in our cloud or yours, and the app stays current on its own based on your timing with the notifications that you and your end users expect. So let's try this out, and we're going to use an app that a lot of us are relying on these days, Anthropic Cloud Desktop. So we'll go ahead and find it in our app titles and we'll schedule it to update periodically because a lot is always updating, right? So we'll go ahead and set that to daily in the noon hour. But desktop isn't the only thing we need to get done, right. What about cloud code? Now, for the first time, you can install and update binaries alongside the traditional apps hosted by third party vendors. So we'll go ahead and add that to our blueprint as well and we'll let it automatically keep up to date. We'll round out our blueprint with a video app like Cisco WebEx and we will go ahead and let the app store keep that up to data as well. And there's our productivity apps, a mix of apps from a mix sources all set up in one place. Now, this year with the 27 operating systems, Apple also gave us a set of new declarative controls so that you can decide which apps run on Mac or mobile at all. And it's enforced at the OS level with the endpoint security framework. You've already seen this as restricted software in Jamf Pro, but this new version allows for explicit allow listing and deny listing, so you can decide which apps your organization allows from day one with the new 27 operating systems, because Enterprise Ready isn't just about settings. It's every app, whether it comes from the app store or not, how reliably it gets to your devices, and whether it's allowed to run once it's there. Apps and books and application lifecycle management and blueprints are in public beta today, and if you're interested in providing feedback, please join the feedback program in Jamf Account. us in the Expo Hall booth, tell us what you think. This is just one aspect of where Blueprints is headed next. For the full picture of what we've been working on for the past year, please join us at the Platform State of the Union later this morning. We've also got a lot of deep dive breakout sessions throughout the week. Now, a device staying exactly the way you defined it is no accident. And for years, that's meant you clicking through a console, setting, one device, one exception at a time. And automating any of that meant scripting around Jamf from the outside. For years, Jamf was the platform you configured. Now it's the platform that you build on. Here's what that looks like at 9 a.m. in your day. We're about two cups of coffee in. And Misha's teammate Luke, who's probably a few more cups of coffee ahead of us, he's created a pull request to get our early adopters ready for macOS Golden Gate. So, Misha, let's take a look at our GitHub console and let's look at this pull request. When we click into it, we can actually check the file contents, and as we scroll we start to see what's in here. We've got a self-service policy, we've got blueprints, we've compliance benchmarks, all updated for macOS 27. Let's go ahead and submit our review, And we'll leave a helpful comment, and we'll approve it, submit our review, and at the bottom we'll go ahead and squash and merge. Now if you work in DevOps or platform engineering, that's the sentence you've been waiting for. Apple estate management now lives in the same Git and pipeline world as the rest of your infrastructure, not off to the side. And because it's all based on the Jamf platform API, you work in one place, not a patchwork of APIs and supporting tools. So, Misha, let's switch back to Jamf Pro and let's see what we did here. We'll start with policies. Once we get there, we can see our self-service policy. Not yet. Not yet? Let's go to the blueprint first. Got to love the demos here. It's going to be getting, by the way, switching back. It's live, right? There it is. All right. I had total confidence, by the way. Cool. Awesome. All right, so we've got our self-service policy, we've got our compliance benchmarks policy. We're in good shape so far. We got to check our blueprints, though. And once we get there, we're going to see our app settings optimized for Mac OS 27, and then our compliance benchmarks, also set up for MacOS 27, amazing. All of that work deployed and logged with a single approval. Now we are going way deeper on platform APIs at the Platform State of the Union, and we have a full track of sessions this week. So let's put it all together so far. You now have a configuration layer that's declarative, version-controlled, fully programmable, covering settings and applications. Next, we've got to think about what's keeping it running and what responds when something changes. You've seen this kind of things, like maybe a certificate expires upstream and a batch of devices falls out of compliance, or someone leaves your organization and their device needs to be locked down before the exit interview ends. Today, that kind of response involves a person and probably a bunch of tickets, but somebody's got to notice. They've got to act and follow up. Multiply that across thousands of devices, and it's easy to see why we always feel one step behind. Here's how you get ahead of it. An automation layer that watches for events in your environment and responds automatically without waiting for someone to notice, like every time a new device enrolls. And you've already automated a lot of this, right? you've already done automated device enrollment, you've done a curated preload list. That's about as routine as IT gets. But plenty of your work still happens by hand. Does your team get an alert when your user did zero touch enrollment? That's the kind of connection that Jamf can make for you automatically with no code required with Jamf Routines. There There we go. All right. So, Misha, let's switch to our routines console. And we're going to start with a workflow for that new user who enrolled overnight. And ideally, they got their Mac drop shipped, they had a smooth identity and setup experience, and now it's enrolled and we know everything we need in inventory, except we don't have their warranty information yet. And it would be great to get that automatically so that your team didn't have to chase it down manually, right? All right, so we've got a workflow started here, and we can see that it starts off the Jamf Pro trigger of a device getting enrolled. We can see it brings in the computer details and we've the get info for the device. So let's go ahead and add to our workflow. We'll look through our integration notes and we'll find Apple business. We'll find apple care contracts information. And we'll go ahead and configure it with variables from that device information, return from the Jamf Pro server. And when we do a test, we can actually see the AppleCare warranty status and the expiration date returned immediately. Great. So we'll add it to our workflow, and we'll hit execute. And we will see it run from beginning to end, got all the green boxes, we're in good shape. And you'll notice that we've brought a really flexible UI to what is traditionally a very code heavy automation task. Okay. We've got another system we need to talk to. And we wanted to get a Slack notification, right? So we'll go ahead and look in our node list and we're going to look for Slack to send a message. And while Misha's here, he's going to be pasting in some preformatted text. He's talking to the demo gods channel because we definitely need a little bit of help with that today. And again, we're getting variables from that device information so that it comes back in our message. Great. And so it's added to our workflow, and we're going to execute it, and if we see a test message, there it is. Awesome. Okay. We're making it look easy, but we've got one more system to talk to, and that's our asset spreadsheet, right? we're going to do one last integration, and we're gonna find our Google spreadsheets, Google Sheets, and go ahead and append a row to our asset information. And again, do a quick bit of formatting here, make sure it lands right. Cool. But we actually need this information to go to two systems simultaneously. So we can actually just pull it right out of the flow, redraw our arrows. Look, that was pretty easy. All right. Let's run it again. Here we go. And we should get another test message. There it is. Awesome. Awesome. With Jamf for Teams, you use the same builder mentality that we in the Apple admin community have had for decades. It's just extended. so you can connect to your own systems with no coding required. And it's so easy to get started for both Mac and mobile. Please check out the dedicated breakout session this week to learn more. Misha, thanks for supercharging the team. Appreciate your help. Good luck. All right. Let's step back and look at everything we got done, and it's not even lunch yet. Blueprints defined what every device and every app in your environment should be. The API made that definition something your team can review and ship like code, ready for the 27 operating systems and well beyond. And routines took care of some of your daily work, keeping you, your team, and the rest of your IT systems in the loop. Now, every single one of those moments had something in common. They were all reactions. Something happened. An app updated. A new device enrolled. a form came in, and the platform responded. And that's really cool, but it makes you think, what if the platform could see not just what's happening across your environment, but how your devices are doing? And to tell you more about what makes that possible, please welcome my teammate, Matt Begnaud, to the stage. Thanks, Katie. we just watched routines execute a workflow without a human in the loop how do we know that it actually worked you see the more that you automate the more trust that you're putting in things that you are not actually watching acting on what happens is kind of the easy part the hard part is knowing what's actually happening for a person sitting in front of a computer That is the digital experience of the people that you support, and it's still unsolved. Take Maya. Maya's getting ready for a customer call. She's got a proposal that's almost finished. She's just checking over her notes, making a few changes. But this week, switching between applications is taking way longer than it should. And she's a trooper. Even though her flow is broken, she's powering through it. She hasn't even opened a ticket yet. After all, she's focused on getting ready for that call. You see, we put tools and configurations on these devices for really good reasons. We're protecting our data. We're meeting our compliance requirements. We're keeping work in sync. But those same tools and considerations can interact in ways that we didn't intend. And the person sitting in front of the device feels the combined effect. If you were to bring up Maya's Mac in your console, you'd see that it's enrolled, it's compliant, checked in seven minutes ago, everything's fine on your end. But her Mac is wasting her time. Both things can be true. And once her issues reach the point that she is opening a ticket, now her work has stopped and she has to describe a problem the platform should have known about. Autonomous endpoint management needs a nervous system. It needs a way to sense what's actually happening on every Mac and act on it. So we built that. We built a continuous health record of every Mac in your fleet over time that covers performance, stability, memory, storage, battery, and more. To see it in action, I'm going to need a little bit of help. I'm I'm going to bring out a friend from down under, senior consulting engineer, Dan McLaughlin. Welcome back, Dan. DAN MCCLUCKLIN- Hey, Benyar. BENYAR AHMEDYAR- How's the jet lag? DAN MCGLUCKLин- Yeah, it's good to be back here. BENYar AHMedyar- So Dan drew the short straw second year in a row. This morning, he gets the job that only gets noticed when things start breaking. So Dan, let's take a look at our fleet. So this is the health of our fleet summarized. And this morning, I want to focus on these devices that need my attention. I'm going to start here because with these computers, there's something going on with each of them. So there's Maya, our employee that's been experiencing issues. Let's take look at health over the last week. Yuck. Well, this poor woman. All right, starting with memory pressure, which is a measure of how well her computer's memory is keeping up with what's running. You can see here, it starts to climb and it stays high. And that can show up as those pauses that Maya's been experiencing. If we go to stability, we can see that software starts crashing around the same time. And Dan, let's look at these crashes here. You can that six out of these eight crashes were all this hardware sync file syncing app. So there's our answer. Her Mac raised its hand, and she never had to figure out how to describe the problem herself. We've been running this health check at Jamf on all of our Macs for months, and it's already changed the way that we operate. My favorite example, we had a bunch of Macs that were staying awake hours longer than they were supposed to. They were frozen on wake, they had dead batteries by morning, and users were blaming the hardware. But when we looked at the device health, spoiler alert, it wasn't the hardware, there was a third-party agent that was poking those Macs awake every 28 seconds, all night, every night. The data settled it. And that is the difference between evidence and an assumption. Let's put that evidence to work. So the agent in that example was already on our Macs and we used the health signals to work backward and understand what happened. But the next problem like it might not be on your Macs yet. You see, you're pushing patches and updates and new configurations to these Macs all the time. And some of the biggest outages that we've seen, they weren't attackers or malicious They were actually updates. Updates that were approved on a Tuesday that kept thousands of people from working on Wednesday. And of course, the careful approach exists. You can use canaries and smart groups and spreadsheets. But that approach assumes that people in that group will tell you that something broke. And most of them won't. They'll just work through it the same way that Maya did. Your console will say that the app installed, but installed is not the same as healthy. Your rollouts should know the difference. So we're building the careful approach right into Jamf, ring deployments, with a health check at every ring. Let's roll out a Zoom update. Zoom is on every Mac that you manage, and every meeting that your organization has runs through it. You can test an update like that, But your test Macs aren't the fleet. Only real machines can tell you how it'll actually behave. So let's do that, Dan. Let's roll it out to a group of devices. We're going to use Device Health to tell us whether it landed clean or if it caused an issue. That way, everyone else either gets a clean update or never experiences a bad one. So we're using this Blueprint. And you'll see that under Scoping here, we've got a new option called rings. So Dan, let's walk through these rings. We're gonna start with the canary group. Handful of Macs that can absorb a surprise. Then we'll move to early adopters. And once we clear the early adopter's phase, then we'll roll it out to everyone. What I love about this is it makes it so much easier to start with a plan instead of a scramble. So once this ring rolls out, then a routine will take the watch. Dan, lets show them the routine. So, this is the routine that's watching the rollout. You can see that once this ring starts, we're going to capture a health baseline of that group. Then we'll wait through a bake period. When that bake period is up, device health will check that group again to see if anything moved in the wrong direction. And once that's up, we'll go ahead and see if if anything got better, anything got worse. What I really like about this is that since it's a routine, you can see it. You can change it. You can have it automatically open tickets or notify the app owner. The idea is that you can make this work exactly how your organization actually wants to roll out software. So this routine's big period is set for 72 hours. We don't have 72 hours, so we're going to do what every cooking show does, and we're going to show you one that we started three days ago. So, the big period is up. Routines has done its health check, and now it's going to bring the decision to where we're already working, right, over here in Slack. And this time, it brings evidence for us to help make the call. So Dan, let's look at that evidence. Right, we can see ring one before and after. Everything moved past the threshold that we set. Everything looks good. Dan, let's promote. All right. Ring 2 is on the way. You get the evidence to see what changed and the control to decide what happens next. But let's think back to Maya. Maya with the slow Mac. My health helped us find her problem, but so far she's still waiting on you to notice. Her Mac is slow, you know why, but she still doesn't. What if, what if she didn't have to wait for you? What if she could just ask her Mac? She goes into self-service plus, a place she already goes for help, and she asks the question she's been asking herself all morning. Why is my Mac slow? Self-service plus goes and looks at what's running, what's holding on to memory, what has been crashing this week, and voila, the same stuck sync client that we found on the console side. It shows her the pressure that it's been creating, recommends a fix, it explains what that fix will do, and the action is right there in front of her. When she's ready, she clicks the button and runs it herself. Her Mac explained itself, and she had what she needed to act. Dan, thank you. Thank you. That answer didn't come from the cloud. It came from her Mac. We had to find a way to ask the Mac about its state live, and for that, we're using OS query. Yeah, we are doing it. We also needed to find away to make sense of what it found and turn those results into something that Maya could actually understand. For that, we're use Apple's latest on-device foundation model, running locally on Apple Silicon right from her desk. And that's what makes it possible for everyone, everywhere. So let's zoom out for Maya, and here's the whole morning. Your fleet defined itself, kept itself running. It told you the truth about what was actually happening. It rolled out change safely, and now it's helping the person sitting in front of the the Mac resolve their own issues without the need to open a ticket. That's autonomous endpoint management taking responsibility for the digital experience of the people that you support. And that's where we're headed. Not just a device that you can manage remotely, but an intelligent endpoint. It's a pretty good morning. But there's another half to today. Shadow AI already running on these same devices in your environment. To show you how you can manage this, let's welcome back to the JNUC stage, Senior Vice President of Engineering, Mike Kampen. Thank you, Matt, and hello, Jamf Nation. It is great to be back. We've just seen how Jamf is building intelligence right into the platform and the endpoint itself that works for you. We're now going to look at a different kind of AI, the AI productivity tools used by your end users to get their own work done. Most of what we'll talk about is how you get the best from the tools you've chosen to roll out. But first, we need to get our arms around the AI that nobody approved. And here's how big that is. 98% of organizations have Shadow AI running on their endpoints. This isn't just your developers, it's everyone. Someone found a tool, it made their life easier, they never mentioned it. That's not a bad actor, that's a well-meaning employee. But using Shadow AI means they're sending company data to services you haven't vetted. And it means they are running tools you can't patch. AI agents raise the stakes again by running commands that your users approve without understanding, or increasingly by running demands that your uses don't have to approve at all. You can't act on what you can't see. So, in June, we launched AI Governance, which includes our new AI Visibility Report. Since then, more than 600 organizations have turned it on. providing visibility across more than a quarter of a million endpoints. Your feedback has shaped where we take it next. To show you the latest, I'd like to invite Rob Poppin, Senior Consulting Engineer, to join me on stage. Hi, Jamf Nation. Hey, Rob. Hey, Mike. Got a very cool demo coming up here. That's great to hear, Rob. Okay. Now, like Dan and Misha, Rob is on your IT team for the day, and he's the one who gets asked to find out what AI is running in your environment and to do something about it. So, Rob, let's open up the AI Visibility Report. Here we go. This is every AI app running across your estate. The headlines at the top provide a useful adoption signal. The details inform next steps. Now, Rob looking at that list on the right, I can see the ones we approved, but I don't remember approving Grokbot. Let's take a deeper look. Okay. So, we can see it's an AI agent, and that active use is increasing. I don't like the look of those risky commands, particularly OSA script. Tell me, who installed this? Okay. Look at the bottom there. I recognize those names. I mean, you know, seeing unsanctioned AI is one thing. Doing something about it is a different thing. We already provide the tools that you need at blocking and network blocking. We are extending them to meet the specific needs of the AI domain and bringing them directly into the AI visibility report to make it easier than ever to act on what you see now some of you though are probably thinking the same thing this is great for apps but what about the ai that runs in the browser well we're extending the jamf platform into the browser itself visibility controls management in the browsers that your users, that your people already use. For the AI visibility report, this means a new tab. Here we go. AI usage across Chrome, Safari, Edge, Firefox, and more. And then here, if we look, Rob, I can see here there's a lot of users using personal AI accounts. That's not good, is it? What can we do about it? Well, here's an example. So Rob, if you put on your user hat and then open up Safari, navigate to ChatGPT with a personal account signed in, straight away, we pop up a custom acceptable use policy. Let's see what it says. It says, no file uploads to personal accounts. Well, I think we should try anyway. So Rob why not try uploading that transcript from the meeting we had earlier? Blocked, immediately, and the notice at the bottom explains why. We launched the AI Visibility Report with support for apps. You've just seen browser, integrated support for mobile comes next. Wherever your people use AI, you'll be able to see it and act on it from one place. The AI Visability Report. Now, if you're new to AI governance, this is where we recommend you start. But controls only decide what your people can't use. Getting the most from the tools that you've approved is where we go next. Earlier, Misha used blueprints to deploy Claude code and Claude desktop across the estate. but deployed doesn't mean configured it doesn't mean that compliance guardrails are in place or that they're ready for a new joiner to pick up and run and run with AI policies which is part of AI governance is how you close this gap AI policies makes it easy to create managed configurations configurations that improve productivity compliance security and risk now Rob I don't know about you but I like the sound of those benefits so I think we should pick up from where Misha left off and configure Claude code so here we go into AI policies we'll select Claude code and then the first thing we do is set the AI provider so our presets cover the major AI providers and we're extending it to support the new open wait clouds today though we're going to standardize our users on anthropic okay now Wow look at this the left-hand nav this is how much you can do with AI policies today we're just going to focus on two outcomes to make it easier for our new joiners to get up and running we're going to pre-configure a plugin marketplace so that it's ready when they unbox. And then secondly, to help protect company data, we're going to ensure that only work credentials can be used to log in. Once that's done, we can save the policy ready for it to be deployed via Blueprints. But as it happens, policy is going to help us answer something else. Rob, the CFO, he's got in touch about AI spend. And behind it, the real questions, are the tokens being used for the right work? Are people using it responsibly? Most organizations know what they spend on AI. What they don't know is which models burnt the tokens or what work they were used for. AI policies will soon let you configure our new on-device AI gateway. Working behind the scenes, it unlocks the visibility you're about to see. OK, so Rob, let's bring up the Model Insights report. Here we go. Token usage in glorious detail. You can break it out by device, provider, model, and app. It also shows cost. That's at published pricing, so it's not exact. It's directional, but it helps you understand trends. And then as we scroll down, we get to the part which shows the type of work being done. And Rob, this is interesting, because we can see here that people are using Fable for summarization. That is frontier intelligence being used for routine work. Overkill. And this is exactly what Model Insights gives you, not just how much AI is being used, but also which models and for what kind of work. And it's insight that you can act on, for instance, by setting sensible defaults using AI policies, or maybe even using routines to make it possible for your people to request frontier access via Self Service Plus. But that is just the start. Where we're taking this is to put this data to work for your people. So maybe a nudge that says, for this task, this model will do. Or maybe the gateway quietly picking the right model on behalf of your users. Taken together, this is how you get to yes for the best models on your terms. Rob, you've had a productive day. Shadow AI under control, sanctioned apps configured, AI usage understood. But we have one more task for you. It's to push forward the pilot of a new type of AI, a type of that is moving fast and getting a lot of attention on-device AI. It's where the AI model, rather than running in the cloud, runs on the hardware you own instead. And for certain types of work, the potential upside is significant. Think processing sensitive data without it leaving the device, reducing spend on cloud tokens, or even unlocking new AI use cases with specialist models. The customers that we speak to who are exploring it all say the same thing. The value is real, but getting it deployed, configured, and compliant is where it gets hard. So we're extending the Jamf platform to make on-device AI with Apple work at enterprise scale. It's the AI control plane you need to deploy and manage local models, connect them to the apps your people use, and with the governance and visibility required to make it enterprise-grade. OK, Rob, should we crack on with our pilot? Great. ROB DODSON- Yep. OK, so Apple provide some great AI models built right into the OS. In fact, you saw one of them working earlier when Matt demoed diagnostics and self-service. But for general-purpose knowledge work, you'll probably want something a little bigger, which you can deploy via Blueprints. So we'll start by opening up the components library and then selecting the new local model category. We'll drag across Gemma 4. which model you pick depends on the hardware and the job in time we're going to recommend it for you based on what we already know about your estate but for now this blueprint is ready Gemma is an eight gigabyte download so we're gonna switch the one that we downloaded earlier Now, got the model on the device, it's time to put the local model to work. Local models can serve your own custom apps or third-party tools. They can run on the same device or on a shared device nearby. For the pilot, what we're going to do is use an AI policy to connect the Claude desktop to the local model via our AI gateway, all on the same device. So Rob, time to put your end user hat on again. You can open up here. Well, here is Claude Desktop. Make sure that our local model is selected in the picker. And now it's time to summarize that meeting transcript from earlier. Remember that summarization work that was burning frontier tokens? This is where it belongs. There we go. Great. So, no data left the device. No cloud tokens were used. The end user gets their meeting summary. And for you, well, it's all managed the same way as you manage everything else on the Mac. Rob, thank you so much for your help today. Bye, everybody. We are working hard to move as fast as AI. We'll be rolling out everything you've seen just as soon as it's ready over the coming months. Until then, if you'd like to learn more, please come and talk to us on the Jamf Expo stand, or you can join one of these great sessions over the next few days. You only have to read the news to know how much is coming at us at the moment. Some of you want to be first with the latest AI innovations or the newest models. just want it to stop turning up unannounced. We're building Jamf for both. We're build the Jamf platform to make sure that whatever arrives, you can see it, manage it, and get the most from it. What this all means is that your team is no longer the department that says no. Instead, it's the reason the answer is yes. AI runs better on Apple. Apple runs better on Jamf. Okay, right. To talk about putting AI governance into practice, I'd like to invite to the stage Matt Vlasak. all right hey there everybody you just heard about jam's very exciting vision for ai governance today and into the future to continue that conversation i want to bring two individuals from companies that are redefining ai and work as we know it will you please welcome to the stage scott munson from Anthropic, and Savi Raghupati from AWS. Hey, guys. Good to see you. Hey, Matt. Okay, so when I get out there and I talk to a bunch of our customers, I generally find that those customers land in one of two camps when it comes to their AI policies. Either try to lock it all down and be prohibitive to maybe one or two tools, or just be very open and permissive and let them cook, if you will, right? Now, your platforms provide some really great controls to be able to maybe strike a better balance. So when it comes to actually doing the configuration to get that first starting baseline, like some of the stuff we just saw from Mike, what do you say? What do you recommend? Scott, starting with you. Yeah, I mean, those two camps you just described, I think, are really making the same mistake. You don't want to treat AI as a yes or no question. The baseline way to think about this is to treat Claude like you would any other managed app on your fleet. The first decision is typically deciding where the inference is going to run. For a lot of folks in this room, that's on AWS. You can access Claude models in your AWS account, in your region. Claude code and Claude desktop application both accept that managed configuration. And so when your employees open that laptop, they are using a supported configuration to start with. What you get then is no one's pasting API keys into their laptops. And you also remove friction, so your employees are working faster. The second would be that you configure all of your default configs and scope what Cloud has access to. So beyond just inference, you can also set up permission modes and allow list which models are available and much, much more. One Jamf configuration can push that to the entire fleet. And you also control access. And so this is, you want to think about Claude, think about like least privilege, the same way you would for a user, think about that for the models. So day one, you'd want to deny access any secrets on a machine. You would block a short list of commands and allow list only the integrations that you've reviewed and approved by your team. All of this is assuming that you have these models available somewhere that you control, which is where AWS comes in. Siva? SIVA SINGHALAKRISHNANI- Well, thank you. Thank you, Scott. Hello, everyone. From AWS, I have three recommendations. One, run inference on Amazon Bedrock. We recently helped a large US bank roll out thousands of user in a cloud code and cloud desktop to thousands of users. Inference runs on Bedrock and in the regions they control. And the data and prompts don't leave the security boundary. And these data and props are not used for model training either by AWS or by our partners. All this was very easy to set up. In addition to this, the AWS IAM and audit controls are very familiar to customers when they use AWS. All of this is very easy to set up. In Jamf AI Governance, just select Bedrock as your model provider, and everything else just works after that. The second advice I want to give is tie access to identity on not keys. Users should sign on to their IDP, identity provider, and get temporary credentials, no static keys on your laptop. So, AI governance really wires the identity provider to the AI app as well as Amazon Bedrock. What this also means is when the employee leaves the company, they don't have access to the models anymore, or when they go back home on a Friday, their AI access goes with them. In addition to that, they also have, in terms of cost governance, the AWS bill shows the AI usage of the user. Now, this is where tokenomics starts. And the third one is really lock prompt caching on. With every prompt from clock code that goes to the model, the clock sends everything that you have sent, all the prompt history and what you send right now. The model doesn't remember anything, but if you turn on prompt caging on in Bedrock, it tells the model to actually do inference and only on data that it hasn't seen. So therefore, it has 90% lower cost and 85% lower latency. So one setting in AI governance and Jamf, and users can't turn it off. Every one of the settings is a config file on a laptop, on the Mac. So at fleet scale, AI governance is nothing but device management, and you all in the room know how to do best. So back to you. Yeah, I'd say so. Yeah, I mean, so it's really just using AI governance and those policies to establish inference, establish the secret control, those sort of things. Now, you are in a room full of Mac admins. You're exactly right. So every one of these Mac admons are going back to their desk on Monday, hopefully taking up some of these learnings from what we're talking about here today. Now, what is the one thing or two things that you would absolutely say that like, if you haven't done this already, make sure you go with that? So Siva, starting with you this time. Yeah, thank you, thank Matt. I would say set your users free on a paved path. Your people are already using AI assistance that they really love. And so your job is to actually not let them use their own keys, point them to their own tools, download their own MCP servers, but actually setting up that paved path for them. Therefore, they used approved tools. And so that's the first step. Then, again, in this case, Jamf makes it really easy. One Jamf policy, one Blueprint, and all of this is available on the Mac before the app opens. And they're using a paved path. And then not just that, you should also point the tool to be able to use your data and servers. For example, a model that doesn't talk to your data is just a chat bot. And then where the model shines is actually bringing your own enterprise data and mixing that with inference. So really, this is another point. So what I want to do is point all that to the context, and this is something that you can do. Work with your data and AI teams. Stand up managed MCP servers. Jamf pushes the config, and Cloud connects only to the servers that you have approved. Back to you. I completely agree, Siva. I think when we work with our customers, the ones that are moving the fastest, making the biggest impact are absolutely the customers that have made their data available, the organizational context and they are able to make a much bigger impact in that way. My suggestion, Matt, for like a practical next step would be to pick one team that's already using Claude, there's likely one in your organization whether or not you're engaged with them, and set them up with a governed configuration this week and put it in production. Once you've done that, you've got two things. One you've a team that's got a supported setup and they're working with you instead of around you. And two, you got a sort of default configuration that you can use as a template to clone and to move forward with other teams. Once you got this actually running in production, you are no longer having this debate about whether we should allow it or block it, but you've go a governed path available. And that really is the best way forward is to kind of make it real, put it in production. So my recommendation would be one team, one configuration this week. Awesome. Okay. Well, those are incredibly useful insights. So really just like get that paved path, the sanction path being the easy path, and then get it tested with one team to begin with and then see what works, iterate fast and roll it out. Now, iteration is what it's all about right now. I mean, every day this stuff is changing, right? Like new models yesterday. So being able to roll the punches and figure out and have that feedback loop from your customers or for your end users, massive. Hey, guys, really appreciate the partnership and you guys coming out here. You'll find us in the booth, right? So I think we'll be floating around. So come on over and learn more. And, you know, with that, I'm going to bring Beth back up here to bring us home. Thank you, guys. Thank you. Thank you so much. Thank you for having me. Okay, Jamf Nation. And thanks, Matt, Steve, and Scott. That was awesome. So you just saw it. You can define the state of your device and keep it up to date. You can see what's actually happening and roll out change without breaking anything. You can say yes to AI without losing control. And you can build on top of all of it. That is the grid powered all the way up. let's go back just quickly to that power and light district you know it sat vacant for decades and it wasn't for lack of ambition it was that the infrastructure wasn't there yet once they put it there the lights came on but you know the lights are not what brought that district to life it was the people it is always the people and that's true of everything you saw today, the people behind bringing that to you. And this community, the best community, you go far beyond the tech as well. With the help of the Jamf Nation Global Foundation, last year alone, you put more than 10,000 meals onto tables in Denver and the Twin Cities. You funded 150 Mac admin memberships for people who needed them. 350 of you did that by showing up for others. Just yesterday, We packed over 500 steam kits for Kansas City public school students that stays right here the work that we did Now there's more to do this week you can spend time with an MCRI student you can buy yes the MCRI students Yes, spend time them Buy from threads for good so when you buy from them we will match that purchase price and donate, or just donate. We have a QR code, you donate, we, the foundation, will match the donation. And if you skipped your swag, we've already donated what that would have cost on your behalf. So, join us and let us join you because we are more than our work. All right. So you can run every cable and you can stand up the whole grid and you You can still just be having just large buildings that are empty with power. That's what this week is about. That's why we're here. Come find me. Come find a Jamf. There are a lot of them here wanting to help you. That's how our roadmap is built, from conversations just like we have at events like this. A lot of what you saw started exactly like that. We are going to keep building the infrastructure. You keep bringing it to life. All right. and mark your calendars because JNUC 2027 is going to Anaheim. And if that wasn't enough, we will be celebrating Jamf's 25th birthday. So come ready to celebrate. And while we want to see everyone in Anaheaim, we're also coming to a city near you. Jamf Nation lives will be global. Come to those. Let's continue the conversation. Help us build the roadmap. And education, this one's for you. 15 cities, 15 Jamf Nations meetups starting next month. Let us meet up. All right. I want to thank all of our sponsors, especially our premier sponsors, Glead, OneGlobal, Serval, and ZeroTouch. The week does not happen with all of those sponsors. And finally, I want to thank you, Jamf Nation. Thank you for trusting us with your environment and for everything you do to help people do their best work on Apple. Here is to a great JNUC. We are going to keep powering up together. Let's go! Woo!