Why Android hasn't beaten Apple in business

Despite significant improvements in recent years, three key realities give iOS the edge in the enterprise

Why Android hasn't beaten Apple in business

Across the world, Android smartphones handily outsell Apple iPhones by wide margins -- yet Android devices rarely have significant presence within enterprise environments. Even in the United States, where the market share for the two smartphones is roughly equal, iPhones account for about 70 to 90 percent of enterprise smartphones in use, according to various surveys.

The latest incarnation of Android -- version 6.0 Marshmallow -- has made significant improvements around security and management, and the leading Android device maker (Samsung) offers enterprise-quality smartphones like the Galaxy S7, as well as a strong security platform that has gained federal approval. But enterprise mobility is still very much an iPhone and iPad phenomenon.

Speaking of the iPad, when it comes to tablets, it's iPad or nothing at most enterprises. Android tablets have almost no presence among business users, and if anything seems likely to get adoption beyond the iPad, it's Microsoft's Windows 10-based Surface Pro.

Today, enterprises can adopt Android as a near-equal to iOS. Why haven't they? There are three basic reasons, all of which can be overcome if the Android industry decides to do so.

1. Android is not as secure or reliable as iOS

For most of Android's existence, Google played at best lip service to security and management. By contrast, Apple became very serious about enterprise-level security in 2010, in what I and other analysts have long believed was a quiet but intentional strategy to displace the BlackBerry in business as soon as the iPhone became the darling of users.

Apple created adopted Microsoft's Exchange ActiveSync (EAS) policies so that enterprises could manage iPhones and iPad using their existing tools, and it created a set of APIs that enterprises could layer on top of EAS through a mobile device management server, in an approach similar to BlackBerry's but not locked to a single management provider. Apple has deepened those APIs every year since, adding more and more capabilities not only around device management but around content and access management.

Apple has also focused deeply on device security, making encryption both strong and impossible to disable. As we've seen recently, its encryption is strong enough to make life very difficult for even the FBI. Enterprises whose execs carry corporate secrets are happy about that.

Finally, Apple's tight hold over its App Store may have frustrated developers in the early years, but the company's control has made iOS malware a rare phenomenon. The few times malware has found its way into the App Store, it's been major news -- precisely because it happens very little. By contrast, the Google Play Store is so rife with malware that hardly anyone thinks a specific incident is newsworthy, and Google's efforts to combat it have been late and halfhearted.

Malware is the biggest risk to enterprises today because it lets attackers into the network, not merely compromise this or that device. Though Google has greatly strengthened Android device-level security -- through a combination of cloning Apple's API approach and adding the notion of containers to separate work and personal environments -- the malware threat remains significant despite the progress that Google has made in limiting Android malware's effects.

The good news for Android is that Marshmallow and, my security sources tell me, the forthcoming Android N bring Android device security to Apple's level, especially when used with Samsung's Galaxy devices, which already have a hardware stack that provides Apple-like encryption strength. If Google can tackle the malware issue, IT's principal security objection to Android should finally go away.

A related issue is Android's stability. When a new version of iOS arrives, it's deployed in the vast majority of active devices with a month of release and only about four months after it's been announced. That means IT can trust both corporate-provisioned and user-provided devices will be current.

By contrast. Android versions take years to get significant installed bases. For example, six months after Marshmallow was released -- and a year after it was announced -- it's on only 8 percent of active devices. Most users are running Android 5 Lollipop, which is not insecure but doesn't have the near-Apple-level security of Marshmallow and its Android at Work technology. Or running even earlier versions.

Each Android vendor takes its sweet time to decide what devices will get a new Android version and when to release them. Worse, the carriers review each release themselves, deciding which to send on to users. As a result, more than half of current devices never get upgraded at all, and the rest take a year or more. 

Thus, IT has to manage multiple variations of Android, with differing security capabilities. Though mobile management tools can figure out what policies are available to what version of Android, IT usually has to take a lowest-common-denominator approach to security policies so that it can support the older Android devices still widely in use. That's not the case for iOS. 

Android's version lag must change -- but it will require a major shift by device makers and carriers, who mostly see the upgrade effort as a drain on profits, particularly if they focus on offering lower-cost devices. Thus, they'll likely avoid the strategy. They'd prefer you buy another device, as if smartphones and tablets were disposable cameras or mere fashion items.

2. Android doesn't have enough business-savvy apps

Google has always seemed to view Android smartphones and tablets as appliances to be used by consumers whose mobile activities and searches would feed Google's information empire. Thus, Google has provided only basic email and calendaring, and Android has historically lacked business-oriented third-party apps -- and still does.

By contrast, Apple has had powerful email and calendar apps and an Office-level productivity suite, iWork, on the iPad and iPhone since 2010, and it early on encouraged a wide range of developers to create business-class apps, such as FTPOnTheGo Pro, GoodReader, Adobe Reader, OmniFocus, Evernote, Dropbox, Scanner Pro, Grafio, iThoughts, Microsoft Office, and various IBM, Oracle, and SAP clients. Apple also supported volume business licenses well before Google thought to do so.

The Google Apps suite is a weak productivity tool on both iOS and Android, but until Microsoft ported Office from iOS to Android last year, Apps was the best business tool on Android (well, maybe second-best after Polaris Office). Microsoft's Office now holds that title, deservedly so. But Android's list of business-class apps beyond Microsoft's remains small, limited to the likes of Slack, TripIt, Dropbox, Box, Google Drive, AnyConnect, Evernote, and Acrobat Reader.

Apple is focused on getting enterprise-specific apps on iOS, first with its IBM partnership and now its SAP partnership. I suspect Salesforce.com and perhaps Oracle will join the party soon. Microsoft has already incorporated iOS as a key part of its all-platforms app strategy, with Apple's encouragement. Apple has also worked closely with the major health car providers like Cerner to make iOS the preferred mobile platform for health care providers.

In addition, Apple has been revising iOS and its iPad line (via the iPad Pro) to appeal more strongly to business users, so both the apps and the hardware feel more like business equipment.

Furthermore, Apple has been quietly sending teams to enterprises for years to understand their needs and find ways to support them directly or through third parties; the latest incarnation is informally known as the Mobility Partnership Program. Its methodical, persistent outreach is the basis of much of iOS's security approach and the partnerships with IBM and SAP and informal alliance with Microsoft.

Android needs serious support from business and enterprise software developers to get adoption beyond basic email access. Google or maybe Samsung needs to get that ecosystem going, then nurture it as Apple has done for iOS. A good start would be for Google to develop much better email and calendar clients than it currently offers; Samsung's clients are better than Google's, so there's already a model for Google to copy.

Until that happens, no matter how good Android's security and device quality gets, enterprises will still need to choose iOS or Windows to get real work done.

3. No one leads Android for enterprise

iOS is Apple's creation and jewel, and the company very strongly shapes its direction and drives its evolution. We've seen the results of that focused leadership when it comes to security, management, and apps.

By contrast, Android is a diffuse universe, with Google creating the operating system and some core services like the Play Store and a variety of device makers creating the actual devices.

Of those device makers, only Samsung has shown sustained leadership. It's pioneered technologies like fingerprint readers, pen input, and side displays, some successful and some not. More important for business users, it created a soup-to-nuts security stack in Knox -- after an initial fumble -- that rivals what Apple has done for iOS and BlackBerry once did for its platform.

Other companies offer similar security-oriented Android hardware stacks, such as BlackBerry and Silent Circle, but they are mere rounding errors in actual sales. They don't count as leaders. The much larger LG has had its Gate security technology since 2013, but it adds little to the equation: only the usual SE Linux core and some hardware-assisted encryption. Still, maybe LG will finally assume some enterprise leadership for Android.

Samsung has also tried, with little success, to encourage a Samsung-centered Android app ecosystem. Though Samsung is the largest seller of professional-class Android devices, Samsung-specific apps haven't taken off -- mainly because it's too dangerous for IT and developers alike to count for the long term on one name in a multivendor market that's seen providers come and go. (Remember when HTC mattered? Or Motorola?) In a way, that's too bad because Samsung is currently the only business-app nucleus available for Android.

Android aficionados argue that the diversity of the Android ecosystem is a strength. That's true in many respects: Different companies can focus on different markets, rather than struggle to do it all or leave large swaths of needs unmet. The failure of individual ecosystem participants doesn't threaten the ecosystem itself.

But such diffuse diversity also means that any major new direction or initiative requires at least tacit cooperation among enough of the ecosystem. That's not easy, and it takes time. Apple has no such cat-herding to do, so if it chooses to go all-out in this direction or that, it can do so. Apple made the choice for enterprise, but not enough of the Android ecosystem has yet done so -- especially not its official leader, Google.

The Android ecosystem can choose to change the equation

None of these issues is insurmountable, and there's been progress on all three fronts over the years. However, Apple remains ahead on all three counts and significantly ahead for the latter two (business apps and leadership focus).

If and when the Android ecosystem decides to take the enterprise as seriously as Apple has and demonstrates long-term commitment to doing so, Android will have a good shot of joining or even displacing Apple in the market.

Until then, Android will be a niche in business even if it's a majority outside the office. Frankly, that's all Google and most device makers want or need. But if they want more, it should be clear which path to take.

Copyright © 2016 IDG Communications, Inc.

How to choose a low-code development platform