Iru

Last updated: Nov 4, 2026

Rationale

Iru is the MDM and EDR system of Fluid Attacks.

These are the primary reasons why Fluid Attacks selected it and not other alternatives:

It is for macOS and iOS devices.
It supports Apple Business, which is very important to keep full control of devices.
It supports custom policies, which make it much more flexible.
It supports disk encryption, which is very important for information security.
It can block devices and put iPhones in Lost Mode, which is very important to manage theft and other contingencies.
Its UI is cleaner and more intuitive.
It gives a notifications center with native Datadog integration.
It is an all-in-one platform that is easy to administer.

Jamf: Fluid Attacks used this MDM before it moved to Iru. It is mature, it has many features, and it supports all the Apple requirements of Fluid Attacks. But it is harder to manage and more expensive, and it is better for large enterprise environments with dedicated IT teams.
Fleet: It is an open-source, cross-platform device management platform built on osquery. But it is harder to install and maintain, and it does not have native Apple lifecycle management features.
Applivery: It is a unified endpoint management platform for app distribution on macOS, iOS, Android, and Windows. But its security and EDR capabilities are small, and it is not the best option for environments that use primarily Apple devices.
ManageEngine: It is a comprehensive IT management suite with MDM, endpoint security, and IT asset management for more than one platform. But it is hard to learn, and it is not the best option for environments that use primarily Apple devices.
Apple Business Manager: It is the official B2B portal of Apple for zero-touch device enrollment and app distribution. But it is not a standalone MDM, and it does not give EDR or security monitoring capabilities without other tools.

Fluid Attacks uses Iru as the only platform for device management and endpoint security on all its macOS and iOS devices.

Fluid Attacks uses it for these tasks:

MDM: To enroll devices, enforce policies, and manage configurations on all the fleet.
Apple lifecycle management: To provision devices from the start through Apple Business Manager with zero-touch setup.
App deployment: To distribute and update software on all managed endpoints from a central catalog.
Compliance: To continuously evaluate endpoints against security baselines and to send compliance reports to Vanta.
Vulnerability management: To find and track known vulnerabilities on all managed devices.
EDR: To monitor endpoint activity in real time and respond to threats.
Telemetry: To send endpoint metrics and security events to Datadog for correlation with the other data of the platform.