Endpoint security is a set of controls on laptops, servers and phones, not one product. The main types are malware protection, patching, configuration hardening, access control, disk encryption, device management, and detection and response. Each covers a different way a device gets compromised.
Why a stack and not a product?
Devices fail in different ways. Malware arrives as a file. An attacker uses a known flaw in an unpatched program. A lost laptop is read by whoever finds it. A user with full admin rights installs the wrong thing. No single tool addresses all of those, so endpoint security works as layers.
What are the types?
Malware protection. Antivirus and related tools detect known and suspicious malicious code. NIST SP 800-83 Revision 1 describes malware as the most common external threat to most hosts and gives recommendations for prevention and incident handling. Treat this as a base layer, not the whole answer.
Patch management. Updating operating systems and applications closes known flaws. NIST SP 800-40 Revision 4 frames patching as routine maintenance and offers a planning approach for it.
Configuration hardening. Turning off unneeded services, setting secure defaults and blocking risky features shrinks what an attacker can use. Benchmarks from standards bodies provide starting settings.
Access control and least privilege. Standard users instead of administrators, strong authentication and limits on who can sign in to a device reduce the damage of one stolen password.
Encryption. Full disk encryption protects data when a device is lost or stolen.
Device and mobile management. A management system enforces settings, installs patches, wipes lost devices and reports inventory. NIST SP 800-124 Revision 2 covers managing and securing mobile devices across their lifecycle, including centralized management and endpoint protection technologies.
Detection and response. Agents record behavior on the device so analysts can spot and contain attacks that slip past prevention. This is the layer commonly sold as EDR.
Application control. Allow lists limit which programs may run. They are strong but need care to operate.
Backups. Not a prevention control, but they decide whether a ransomware incident is an inconvenience or a crisis.
Which should come first?
For most small and mid sized teams, the order that returns the most is inventory, then patching, then least privilege and multi factor authentication, then encryption and backups, then deeper detection. You cannot protect devices you do not know exist.
Constructed example: the inherited fleet
A company acquires a firm with 120 laptops. Nobody has a list. A quick check against the management system shows 90 enrolled and 30 unknown. Of the 90, a quarter have not installed a browser update in months, and most users are local administrators. The first month of work is not buying a tool. It is finding the 30, enrolling them, forcing updates and removing local admin rights. Detection comes after the basics hold.
Do software dependencies count as endpoint risk?
Yes, for developers. A laptop that builds software holds source code, tokens and package caches. A poisoned package installed on a build machine is an endpoint problem and a supply chain problem at once. Scanning dependencies before they reach a workstation helps, and Safeguard's free in browser scan at gold.safeguard.sh/scan checks up to 100 dependencies for a quick look.
How to check or apply this
- Build a device inventory and compare it with what your management system sees.
- Measure patch age for operating systems and browsers, and set a target.
- Count local administrators and reduce the number.
- Confirm disk encryption is on and recovery keys are stored safely.
- Test restoring a device or data from backup.
- Check that detection telemetry reaches someone who will act on it.
Quick check
Is antivirus the same as endpoint security?
No. Antivirus is one type of control. Endpoint security also includes patching, hardening, access limits, encryption, management and detection.
What is the first step?
An accurate inventory of devices. Every other control depends on knowing what you have.
Sources
- NIST SP 800-83 Rev. 1, Guide to Malware Incident Prevention and Handling
- NIST SP 800-40 Rev. 4, Guide to Enterprise Patch Management Planning
- NIST SP 800-124 Rev. 2, Guidelines for Managing the Security of Mobile Devices
Last reviewed: 18 October 2026.
