An endpoint protection platform (EPP) is software installed on laptops, workstations and servers that tries to stop attacks before they run. NIST's glossary describes it as safeguards such as antivirus, antispyware, personal firewalls and host-based intrusion prevention. It prevents known bad activity; it does not replace patching, identity controls or monitoring.
What does an EPP actually include?
The NIST glossary entry for the term, sourced from SP 800-128, lists the pieces: antivirus, antispyware, antiadware, personal firewalls, and host-based intrusion detection and prevention systems. That is a useful baseline when someone hands you a feature sheet. Each item is a layer that sits on the machine itself.
In practice a modern product groups those layers under one agent and one console. The agent inspects files as they are written or opened, watches process behaviour, and applies a local firewall policy. The console pushes policy and shows which devices are healthy.
What is the job of each layer?
Signature and reputation checks compare a file with known malicious patterns. They are fast and cheap, and they only catch what someone has already seen.
Behaviour checks watch what a process does: spawning a shell from a document, writing to many files quickly, injecting into another process. These catch some new threats, at the cost of tuning and occasional false alarms.
The host firewall limits which programs may talk on the network. On a laptop at a coffee shop this is often the only firewall in the path.
Host intrusion prevention blocks actions that match rules for known attack steps.
NIST SP 800-83, the guide to malware incident prevention, treats this software as one control among several. It also covers user awareness, vulnerability mitigation and incident response, because no single product stops everything.
What does an EPP not do?
It does not tell you which of your machines are missing a patch, though some products add that report. It does not decide who may sign in to a SaaS app. It does not fix a misconfigured cloud bucket. And it does not guarantee detection of an attacker who uses legitimate tools in normal-looking ways. MITRE ATT&CK lists many techniques, such as PowerShell abuse (T1059.001), that rely on software already present on the machine.
A constructed example: a finance laptop gets a macro document. The EPP blocks the first payload because its hash is known. The attacker sends a second email with a script that only uses built-in Windows tools. Nothing on disk matches a signature. Whether the behaviour layer flags it depends on its rules, and on whether anyone reads the alert.
EPP, EDR and antivirus: how are the words used?
Antivirus is the oldest layer: file scanning. EPP is the broader prevention bundle. Vendors often add a recording and investigation capability on top and sell it under another name. The marketing terms overlap, so compare features, not labels. Ask what the product prevents, what it only records, and who responds when it raises something.
How to check or apply this
- List your devices by type (laptop, server, virtual desktop, phone) and mark which ones have an agent installed. Gaps are usually servers and contractor machines.
- Confirm each agent reports to the console and checked in during the last day. A silent agent protects nothing.
- Read the policy for the three layers separately: file scanning, behaviour rules, host firewall. Note any that are in audit-only mode.
- Test alert routing. Trigger a harmless test file that vendors publish for this purpose, and confirm a person is notified.
- Pair the EPP with patching and least-privilege accounts. SP 800-40 frames patching as preventive maintenance for exactly this reason.
If your applications ship dependencies to those endpoints, also look at what is inside them. Safeguard scans dependencies and builds an SBOM so you know which libraries reach a machine, which an endpoint agent will not tell you.
Quick check
Is an EPP the same as antivirus?
No. Antivirus is one layer. NIST's glossary lists antivirus alongside antispyware, personal firewalls and host intrusion prevention as parts of an endpoint protection platform.
If every laptop has an EPP, are we covered?
No. An EPP covers the device. Identity, cloud configuration, patch status and the code you ship need their own controls.
Sources
- NIST CSRC Glossary: Endpoint Protection Platform
- NIST SP 800-83 Rev. 1, Guide to Malware Incident Prevention and Handling
- NIST SP 800-40 Rev. 4, Enterprise Patch Management Planning
- MITRE ATT&CK T1059.001, PowerShell
Last reviewed: 18 October 2026.
