What does an endpoint protection platform cover, and what does it miss?

An endpoint protection platform (EPP) is software on laptops, desktops and servers that aims to prevent malware and malicious activity on that device. It usually bundles scanning, behavior monitoring and policy controls under one console. It is a core layer, but it does not cover stolen logins, cloud services or an attacker using your own tools.

What problem does it address?

NIST SP 800-83 Revision 1, on malware incident prevention and handling, describes malware as a program covertly inserted into another program to destroy data, run destructive or intrusive programs, or otherwise compromise the confidentiality, integrity or availability of data, applications or the operating system. It calls malware the most common external threat to most hosts, causing widespread damage and requiring extensive recovery. Its recommendations cover both prevention measures and the incident response capability needed when prevention fails.

An endpoint product sits at the point where that malware would run. NIST SP 800-94 describes the related idea of host-based intrusion detection: monitoring the characteristics of a single host and the events within it, such as network traffic for that host, system logs, running processes, application activity, file access and modification, and configuration changes. It says these are most commonly deployed on critical hosts such as public servers and servers containing sensitive information.

What does a typical platform include?

Product names differ, and this article does not assume any standard product definition. Common building blocks are:

1. Scanning for known malicious files, matched against signatures.
2. Behavior monitoring that watches what a process does, such as encrypting many files quickly.
3. Exploit and memory protections.
4. Device controls, such as limiting USB storage.
5. A host firewall and web filtering.
6. A central console for policy, alerts and reporting.

Some vendors add endpoint detection and response (EDR), which collects security telemetry from endpoints. NIST SP 800-215 mentions EDR as a way some visibility into east-west traffic is now sought, since over 75 percent of network traffic is east-west or server-to-server, and largely invisible to security teams at the network perimeter. EDR is a distinct capability layered on, or sold with, endpoint protection.

Where does it fall short?

NIST SP 800-94 explains why signature matching alone is limited: it is very effective at detecting known threats but largely ineffective against unknown threats, evasion, and many variants of known threats. If an attacker changes a filename or a byte, the signature may no longer match.

CISA's joint guidance on living off the land techniques points to a second gap. Attackers who use built-in tools leave few conventional indicators, and defenders who rely on untuned endpoint detection systems may not get an alert. The guidance recommends baselines, centralized logging and application allowlisting alongside endpoint tools.

Other gaps are not about detection at all:

• Devices without an agent, or with a stopped agent.
• Stolen passwords used from a clean machine. No malware appears.
• SaaS and cloud accounts, which the endpoint product cannot see.
• Settings left in monitor-only mode and never switched to block.

A constructed example

A 150-person company deploys an endpoint platform to 140 laptops and thinks it is covered. Ten machines belong to contractors and run a different build of the agent that never connected to the console. One of those machines is infected through a malicious download. The console shows no alerts, because it never heard from the machine. The gap was in coverage, not detection.

How to check or apply this

1. Reconcile your device inventory with the console. Every device in the inventory that is not checking in is a finding.
2. Check each policy mode: which groups are monitor-only, and why.
3. Test with a harmless standard test file used by antivirus vendors for this purpose, and confirm an alert reaches a person.
4. Make sure agent tamper protection is on, and that local users cannot disable the agent.
5. Send endpoint alerts and logs to a central store outside the endpoint.
6. Pair the platform with application allowlisting on servers, patching, and multi-factor authentication.
7. Write the response step: who isolates a device, and how fast, when an alert fires.

Quick check

Sources

• NIST SP 800-83 Rev. 1, Guide to Malware Incident Prevention and Handling
• NIST SP 800-94, Guide to Intrusion Detection and Prevention Systems (IDPS)
• NIST SP 800-215, Guide to a Secure Enterprise Network (secure enterprise networks guide)
• CISA, Identifying and Mitigating Living Off the Land Techniques

Last reviewed: 18 October 2026.