Kandji or Rippling IT for a PE Portfolio Company Rollup

A typical diligence request wants a full device inventory, confirmation that endpoints are encrypted, and evidence of a patch management process. Before evaluating any platform, write down honestly what you could produce right now if asked this week. Most companies discover the gap isn't a missing tool, it's that nobody owns compiling the answer, and a platform doesn't fix an ownership problem by itself.

That ownership gap tends to show up hardest at a company that's grown quickly without a dedicated operations or IT lead, since devices get purchased and issued without a central record. Fixing the record-keeping first, even manually, makes the eventual platform rollout faster because you already know what you're enrolling.

This is the requirement that separates a portfolio company's needs from a typical single-business buyer's. Whatever you choose needs to onboard a newly acquired company's devices, which usually means yet another mixed fleet of Windows and Mac machines with their own existing software and habits, without a multi-month project each time. Rippling IT's cross-platform management is the more realistic fit here, since an acquired company running mostly Windows is common and Kandji has nothing to offer that fleet.

Kandji still has a place if the portfolio company itself and its likely acquisition targets are genuinely Apple-standardized, which happens in some software or professional services niches. The judgment call is about your specific sector's typical target profile, not a general rule that one platform always wins for a rollup.

• Inventory the acquired company's devices within the first two weeks of close, separate from folding them into your existing platform immediately
• Confirm encryption status on every device before granting access to portfolio-wide systems
• Flag any device running an operating system old enough to be out of vendor support
• Set a target date, not indefinite, for full enrollment into your standard platform
• Document the whole process once so the third acquisition doesn't require re-inventing it

A checklist like this only works if someone owns running it at every close, not just the first one. Naming that owner, whether it's someone at the portfolio company or a shared resource at the fund level, is what actually makes the checklist repeatable instead of a document nobody follows after the first acquisition.

Federal guidance under CISA's binding operational directives sets a 15-day remediation window for a critical, internet-accessible vulnerability¹, and while a portfolio company isn't bound by that federal standard, it's a useful benchmark for how a diligence team or an acquirer's own security reviewer thinks about acceptable patch timing. Being able to show you patch critical issues quickly, even without citing a specific mandate, is a stronger answer than not tracking it at all.

Most portfolio companies won't hit that exact window on every device, and that's fine as long as you can show a defined process and a trend toward faster remediation rather than an ad hoc approach with no record at all. Diligence teams are generally looking for evidence of discipline, not a perfect score against a federal standard that doesn't apply to you.

A portfolio isn't always uniform. If one acquired company happens to run entirely on Mac and its team wants to stay that way, forcing it onto a cross-platform tool solely for fund-level consistency can create more friction than it's worth for a single company's small fleet. Some funds run Rippling IT as the portfolio-wide standard and let an exceptional company keep Kandji, accepting a slightly less unified reporting picture in exchange for not fighting a team that's happy with what it has.

A single portfolio company might manage without a platform, but a sponsor running the same playbook across several portfolio companies benefits from standardizing the approach once. Say your fund closes on a new platform investment this quarter: onboarding its device fleet under an already-configured process is a matter of days, not the weeks it would take to build one from scratch at each new company.

The math gets more favorable the more companies are in the portfolio, since the standardization cost is paid once and reused at each acquisition. A fund with a single platform company and no near-term acquisition plans has a weaker case for this urgency than one actively rolling up a fragmented market.