Endpoint protection is the set of controls that secure the devices people and systems use: laptops, desktops, servers and phones. It covers patching, secure configuration, malware defense, disk encryption and access control. It protects the device, and it does not replace identity, network or application controls.
Why do endpoints matter?
They are where users run code and open attachments, and they hold credentials and data. NIST SP 800-83 Rev. 1 describes malware as the most common external threat to most hosts, causing widespread damage and disruption and requiring extensive recovery. That framing explains why endpoint controls are among the oldest in security programs.
An endpoint is also the way into everything else. A compromised laptop carries a logged-in browser session, cached tokens and access to internal systems. Protecting the device protects what it can reach.
What belongs in the baseline?
Think in layers.
- Inventory: you cannot protect a device you do not know about. Track owner, operating system and last check-in.
- Patching: operating system, browser and key applications, with a defined timeline for urgent fixes.
- Configuration: remove unneeded software, turn off unused services, enforce a screen lock and disable local admin rights for daily use.
- Malware defense: scanning, reputation checks or application allowlisting, depending on the device role.
- Encryption: full disk encryption, with recovery keys stored safely.
- Access: multi-factor authentication, and conditional access that considers device health.
- Recovery: backups and the ability to wipe or re-image a lost or compromised device.
Detection and response tooling sits on top of this baseline. It adds visibility, but it does not fix a missing patch or a shared admin password.
What does it miss?
Endpoint controls do not see what happens in a cloud console, a SaaS app or an API. They do not stop an attacker who steals a valid session token from another place. They do not cover devices you do not manage: contractors' laptops, personal phones, forgotten test servers.
They also depend on healthy agents. Software that stopped checking in six months ago still shows as deployed on most reports.
What does a constructed gap look like?
A company rolls out endpoint software to every laptop and reports 100 percent coverage. An engineer, working late, spins up a cloud virtual machine to test something and leaves it running with an old operating system and an exposed management port. The laptop fleet is clean, and the forgotten server is the way in.
The lesson is that coverage numbers describe the devices you know. Asset discovery has to come first, or the metric flatters you.
How to check or apply this
- Build the inventory from several sources: identity provider, device management, network, cloud accounts. Reconcile the lists.
- Measure healthy agents, not installed agents: reporting in the last seven days, patched within your timeline.
- Set a patch timeline by severity and exposure, and track exceptions with expiry dates.
- Remove local admin rights from daily accounts, and provide a request path for exceptions.
- Enforce disk encryption and verify recovery key escrow on a sample each quarter.
- Require multi-factor authentication and block access from devices that fail health checks where practical.
- Test recovery: re-image one device and restore its data, and time it.
- Review the baseline when a new device type appears, such as a phone fleet or a Linux build server.
How does this relate to compliance?
Many frameworks include endpoint requirements in some form: malware protection, patching, encryption and access control. Framework text varies, so read the exact control language for the standard you follow. Evidence is usually inventory exports, configuration reports and sample screenshots with dates.
Quick check
Is antivirus the same as endpoint protection?
No. Antivirus is one malware control. Endpoint protection also includes patching, configuration, encryption, access control and recovery.
Do servers need endpoint protection too?
Yes, with controls fitted to the role. Servers need patching, hardening, access control and monitoring, though they may not need the same user-focused features as laptops.
Sources
- NIST SP 800-83 Rev. 1: Guide to Malware Incident Prevention and Handling
- CISA StopRansomware: tips and guidance
Last reviewed: 18 October 2026.
