BHS Trans: uniform settings, lower risk on drivers' phones

The fleet of BHS Trans Kft. ran more than 400 driver phones – practically every one of them configured differently. At first that looks like untidiness, but from a device protection perspective it is more serious: if you do not know what state a device is in, you cannot say whether it is protected.

How do 400 phones end up with 400 configurations?

Fleets are rarely created in a single rollout. Phones arrive gradually: a new driver starts, a device breaks, a new client requirement calls for a replacement. Someone configures each phone by hand – but not always the same colleague, and not always with the same steps. At BHS Trans Kft., over the years this led to 400 different configurations: different wallpapers, app layouts, permissions and notifications.

Why are inconsistent settings a security issue?

Individually small differences add up to a fleet that cannot be tracked or managed. From a security standpoint that means three problems:

• No known baseline. If a phone has a fault, it may stem from any of 400 possible configurations. Troubleshooting becomes detective work.
• Changes do not reach everywhere. Introducing a new security parameter manually means going through 400 phones one by one – assuming they can be reached and are not somewhere far away in Europe.
• Permissions are not consistent. Where different permissions apply, it is hard to say who can access what on the device.

The three requirements

The company defined precisely what it expected from the new system:

1. Uniform settings that are easy to change – every phone with the same parameters, changes made in one place.
2. A dedicated-purpose mode – the driver sees a simple single-window view with only company apps and calling.
3. Corporate branding – company logo and a custom wallpaper on every phone.

How does a uniform profile reduce risk?

One configuration, from one place

Every phone receives the same configuration: the same apps, permissions and home screen items. A new security parameter, a new app or a notification rule can be changed in one place with a few clicks, and it takes effect immediately on every phone in the fleet. The change is immediate, complete and traceable.

A technical restriction instead of a written rule

In the dedicated-purpose mode, the browser, YouTube, TikTok, the system settings menu and every other non-company app are blocked. There is no grey zone of “the policy forbids it, but it can still be opened”.

Central installation and updates

Not only apps from the public app store, but also custom apps distributed outside the store are now installed and updated centrally. Previously, each of these required going through every phone again.

Branding that can be changed

The company logo and wallpaper were rolled out centrally to every phone in a single operation, and can be replaced the same way.

What became verifiable?

The key change: if something is wrong on a phone, it now deviates from a known baseline. According to the source, the results were:

90% of driver-phone-related tasks were automated, the time of one full employee was freed up, and failures and communication outages caused by data running out or phones being misconfigured were eliminated.

• There is no more “what is on which phone” question, because every phone has the same setup.
• The system sees the status, so there is no uncertainty about whether a fault has been resolved.
• Changes go out immediately; no more planning “when will we have time to go through the fleet”.

The takeaway

A uniform configuration is not a convenience feature – it is the foundation of verifiable device protection. As long as every device is different, the state of protection can only be estimated. When every device works from the same central profile, the question “what is on our company phones?” has a precise answer.

If many different configurations are running side by side in your fleet too, let's talk about how a uniform, centrally managed device fleet can be put together.