Device Security at Scale After the Office Disappears
Shopify’s shift to a Digital by Design model—supporting employees wherever they work—removed the security assumptions that come with an office-centric fleet. When devices live on varied networks and in-person remediation is off the table, securing those devices becomes both more critical and more complex. The company’s Trust team, responsible for internal IT and cybersecurity posture, found that off-the-shelf tools didn’t fully address the problem. Their answer was Hubble, an internal platform that encapsulates and extends the common security tools Shopify already uses.
Rather than granting large numbers of employees access to multiple administrative panels, Hubble ingests and standardizes data from those underlying systems and sends commands back to them. For IT staff, this means a single interface for inventory, device management, and security. Access levels are granular, with specialists able to do more than entry-level workers, and all actions are tracked and audited in one central location with a consistent set of fields. That consistency makes incident response and investigation far less of a rabbit hole.
What Hubble Provides to the Rest of the Company
For non-IT employees, Hubble is a way to see and manage the devices that belong to them. The tool shows device health and compliance at a glance—using metrics Shopify defines as meaningful, like OS and patch compliance and VPN usage—rather than an arbitrary list of checks. Users don’t have to ask IT whether their device is secure; Hubble tells them, either through the web interface or through device notifications. When a device isn’t compliant, Hubble gives clear guidance on how to fix it.
Hubble also supports user-designated test devices and opt-in beta participation, which makes building test cohorts straightforward. The point is to give people the means to be proactive about security, which in turn builds a culture of ownership rather than dependence on IT.
The broader benefit is that Hubble becomes a single source of truth for all the data it consumes. Other teams can build automations and security processes against Hubble’s standardized, reliable data instead of making calls to dozens of different services. Where security workflows often require tedious normalization, Hubble provides a clean foundation.
Two Lessons from Building Hubble
Hubble itself is not open source and remains an internal Shopify tool, but the lessons from building it apply more broadly.
Encapsulation Forces Useful Collaboration
Building and maintaining Hubble requires ongoing conversation between developers, support staff, security engineers, and compliance managers—people who typically work near each other but rarely work together directly. That collaboration surfaces automation opportunities and gives team members a clearer view of possible next roles. Even without building a custom tool, involving frontline staff in design and engineering processes brings valuable context and helps surface the real problems an organization faces.
Investment in Tooling Is Worth the Fight
IT and cybersecurity teams are often reactive, driven by ad-hoc demands, with workloads that can spiral into unhealthy cultures and erratic work-life balance. Shopify set out to avoid that pattern by using Hubble as a platform for identifying automation opportunities, connecting engineering teams to support staff, and encouraging proactive problem-solving instead of accepting broken processes.
The cost argument is also concrete. Onboarding a new employee to IT or cybersecurity teams involves weeks or months of ramping up and safely provisioning system access. Certification and training costs can reach thousands of dollars per employee, and hiring becomes more difficult when the role requires direct, sensitive access. Each new tool added to the environment multiplies complexity exponentially—but complexity alone isn’t a reason to reject a tool. The real risk is letting costs grow unchecked while administrative overhead or shadow IT fills the gap.
Shopify chose to invest in Hubble as a way to solve those problems at scale. Encapsulation, done deliberately, can keep a fleet secure without burying the people responsible for it.
