Endpoint security is the practice of protecting endpoint devices that connect to computing environments, including desktop computers, laptops, smartphones, tablets, servers, workstations and other network-connected devices. An endpoint is effectively a place where a user, application or system interacts with a network or computing environment. Endpoint security seeks to prevent, detect and respond to threats affecting these devices and to reduce the consequences of compromise.
Controls can include antivirus and antimalware software, endpoint detection and response, host firewalls, application control, device encryption, patch management, vulnerability management, secure configuration, mobile-device management and endpoint monitoring. Endpoint security is distinct from network security because it protects the devices themselves rather than focusing primarily on communications between devices and networks.
Traditional endpoint protection was strongly associated with antivirus software that used signatures and other detection methods to identify known malicious files. Modern endpoint security is broader because malware can change rapidly and attackers may use legitimate system tools rather than introducing an obvious malicious executable. Endpoint Detection and Response, or EDR, therefore monitors processes, files, registry or configuration changes, network activity and other telemetry to identify suspicious behaviour and support investigation.
Extended Detection and Response, or XDR, can correlate endpoint information with telemetry from other security domains. Behavioural detection can identify activity that differs from expected patterns, while threat intelligence can provide information about known indicators and attacker techniques. Modern endpoint security consequently combines prevention, detection, investigation, response and recovery rather than relying on a single malware scanner.
Patch and vulnerability management are fundamental endpoint-security functions. Operating systems, browsers, drivers and installed applications can contain vulnerabilities that attackers may exploit. Applying security updates reduces exposure to vulnerabilities for which fixes are available. However, patching is not simply a matter of installing every update immediately because organisations must consider compatibility, testing, operational constraints and emergency priorities. Asset inventories are therefore important because an organisation cannot reliably protect devices that it does not know exist. Vulnerability-management processes can identify outdated software and prioritise remediation according to factors such as exploitability, exposure and business impact. Unsupported operating systems and applications create additional risk because security fixes may no longer be available from the vendor.
Endpoint security also includes hardening and configuration management. Devices can be configured to disable unnecessary services, restrict administrative privileges, enforce secure authentication, enable host firewalls and require disk encryption. Application-control mechanisms can restrict which software is permitted to execute, reducing the opportunities for unauthorised programs to run. Least privilege is particularly relevant because users who operate with unrestricted administrative rights can make accidental changes and provide attackers with greater opportunities after compromise. Secure boot and trusted-platform technologies can provide additional protections against certain forms of tampering. These controls work together: endpoint security is strongest when device configuration, identity, software management, encryption, monitoring and incident response are integrated rather than treated as isolated products.
Endpoint detection and response systems collect telemetry that can help security teams reconstruct events. For example, an EDR platform might record that a document application launched a scripting process, which then created a new executable and attempted an outbound connection. Security analysts can use process trees, timestamps, file hashes, network connections and other evidence to investigate whether the behaviour is malicious.
Response capabilities can include isolating a device from the network, terminating a process, quarantining a file or collecting forensic information. Automated response must be carefully configured because an incorrect action can disrupt legitimate business activity. The value of EDR therefore depends not only on detection technology but also on the quality of telemetry, alert triage, investigation procedures and incident-response processes surrounding it.
Endpoint security increasingly includes mobile and remote devices. Smartphones and tablets can access corporate email, cloud applications and sensitive data, making mobile-device management and mobile-threat controls relevant to enterprise security. Remote workers may connect from networks that the organisation does not control, making device posture and endpoint controls particularly important. Cloud-managed endpoint platforms can enforce policies across distributed devices and report security status centrally. Bring-your-own-device programmes create additional complexity because organisational data may coexist with personal data. Containerised workloads and specialised operational technology devices can also require endpoint-like protection, although their security requirements may differ substantially from those of general-purpose desktop systems.
Endpoint security has limitations because a security agent cannot prevent every form of compromise. Attackers can exploit vulnerabilities before patches are available, abuse legitimate credentials, disable security controls, exploit firmware or use techniques designed to evade detection. Security software itself can also contain vulnerabilities or consume system resources. Privacy considerations arise when endpoint agents collect detailed information about applications, files, users and network activity. Organisations must therefore define appropriate monitoring boundaries and protect collected telemetry. Endpoint controls also need to be maintained: outdated security agents, inactive licences, unmanaged devices and misconfigured policies can create gaps that may not be obvious from a high-level security dashboard.
Effective endpoint security is part of a broader defence-in-depth strategy. It should work alongside identity security, MFA, access control, network controls, application security, data protection, backups, vulnerability management and incident response. For example, if malware bypasses endpoint prevention, network segmentation may limit its communications, least privilege may restrict its capabilities, application controls may prevent additional execution and monitoring may enable rapid detection. Endpoint security therefore does not mean merely installing antivirus software.
It encompasses the lifecycle of devices and their software from provisioning and secure configuration through patching, monitoring, incident response and eventual retirement. The central objective is to reduce the likelihood and impact of compromise at the device level while maintaining visibility and operational control over the endpoints that form part of an organisation's computing environment.
