Device custody is the tracked chain of control for a company-issued endpoint: who received it, who uses it, where it is located, and whether that use follows policy. It is more than asset inventory. Custody tells defenders whether a laptop is still in the hands of the approved employee, a third party, or an unknown operator.
In cyber security, custody matters because many attacks rely on a trusted device rather than obvious malware. If a laptop is shipped to the wrong person, used outside the expected region, shared between workers, or connected through remote-access tools in a way that breaks policy, the device can become a stealthy access path. Defenders use custody records, shipping logs, MDM telemetry, login location, and device posture checks to spot mismatches. Strong custody controls help reveal fraudulent onboarding, insider misuse, account takeover, and covert remote-work activity before those issues turn into broader compromise.