.jpg?width=1200)
Three different control tests failed at different rates
The Department of Homeland Security inspector general reported that 76% of tested Intelligence and Analysis mobile devices had apps categorized as risky, prohibited or allowing prohibited activity. The audit also found that 27% of device settings and 44% of mobile-device-management settings did not comply with requirements.
Those percentages measure different tests and should not be added together. They show breadth across app governance, device configuration and centralized management rather than a single 147% failure rate.
| Control test | Finding |
|---|---|
| Devices with risky/prohibited apps | 76% |
| Noncompliant device settings | 27% |
| Noncompliant management settings | 44% |
| Known unremediated vulnerabilities | 3 in 2 I&A apps |
| Recommendations | 11 open |
The inventory gap was larger than the configuration gap
Only 11% of devices recorded for the office in DHS’s chief information officer asset system could be accounted for by Intelligence and Analysis, according to the audit. That does not establish that the remaining devices were stolen; it establishes that the two official accountability views did not reconcile.
An incomplete inventory weakens every downstream control because administrators cannot reliably prove which devices need patches, configuration checks or retirement.
The auditor also documented a scope constraint
The OIG said it was denied direct access to ServiceNow data and had to rely on information supplied through the department. That is a material limitation because independently extracting source-system records is stronger evidence than reviewing an agency-selected export.
The watchdog nevertheless issued 11 recommendations covering app approvals, vulnerability remediation, asset accountability, configuration compliance and oversight. The public record reviewed lists them as open.
Method and limits
The newsroom compared each reported percentage with the control domain it describes and treated the ServiceNow access denial as a stated audit limitation. No attempt was made to infer device counts where the public summary provides only percentages.
The findings establish control weaknesses, not that classified information was exfiltrated or that every flagged app was malicious. The report should not be read as a breach notification.
Sources and further reading
DHS OIG mobile-device security audit, April 30, 2026 ↗
U.S. Army mobile-device cybersecurity photograph and public-domain record ↗