Most Organizations Still Run Critically Outdated Devices

Outdated operating systems remain common across workplaces, with many organizations still relying on devices that lack critical updates. This lapse in basic security maintenance increases the risk of cyberattacks and leaves sensitive data needlessly exposed.

Jamf’s Security 360 Report analyzes data from over a million Mac and mobile devices to show how modern Apple-focused environments are being targeted by attackers. This research indicates that poor update practices are widespread in organizations. Over half of enterprises have at least one device running a critically outdated operating system, which creates serious security gaps.

Infostealer malware emerges as top threat to macOS environments

Infostealer malware has become the most common threat facing macOS environments. These attacks are designed to secretly collect passwords, credentials, and sensitive data, which often form the first stage of more damaging campaigns.

Phishing and other social engineering attacks continue to be highly effective, especially on mobile devices. Jamf found that many users still click on malicious links, which gives attackers an easy way into corporate systems.

Vulnerable and untrusted apps increase enterprise risk

According to the report, applications themselves are another weak point. Many installed apps contain vulnerabilities, request excessive permissions, or bypass security controls when downloaded from unofficial sources. This issue increases privacy and data‑exposure risks in enterprise environments.

The report emphasizes that attackers now chain multiple weaknesses together (such as combining unpatched software with phishing or zero‑click exploits) to bypass traditional defenses. This makes simple security oversights far more dangerous.

Basic security hygiene remains a critical first line of defense

Organizations are advised to start with basic security hygiene, particularly by ensuring that all devices and applications are kept fully up to date. Moreover, they should promptly apply operating system and software patches to close known security gaps that attackers frequently exploit. Companies should also restrict the use of unapproved or sideloaded apps, regularly review app permissions, and use tools that provide visibility into device and application risks across the environment.

This research also emphasizes the importance of layered defenses and user awareness. This includes adopting zero‑trust principles, strengthening phishing detection, and investing in regular security training to help employees recognize social engineering attacks. When combined with Apple‑specific security controls and proactive monitoring, these measures help reduce reliance on reactive fixes and create a more resilient security posture.