An MDM administrator notices that a fleet of corporate Android devices are all showing a 'May 2024' security patch level even though it is now June 2026. What is the security risk and recommended enterprise response?

• A.A two-year gap in the reported patch level is a low risk here, and Android Security Bulletin fixes are cumulative: Project Mainline ships every one of them, the kernel and vendor items included, in APEX modules that install silently in the background. The enterprise response is to confirm Google Play services is current on all 200 handsets (the console patch string is cosmetic reporting) and to close the finding.
• B.Devices running a 2-year-old security patch level are exposed to all publicly disclosed CVEs in the Android Security Bulletins from June 2024 to June 2026, including critical vulnerabilities in the media framework, Bluetooth stack, kernel, and vendor components. Enterprise response: (1) identify the specific CVEs from 24 months of bulletins and assess exploitability; (2) implement compensating controls (MDM network segmentation, restricting risky features); (3) accelerate device replacement program - hardware that is end-of-support cannot be remediated by patching.