Understanding endpoint security properly

An endpoint is any device that a person uses to do work: laptops, desktops, phones, tablets, and the till in the front of the shop. For most small businesses these devices are now the entire office. They sit on home broadband, they hold cached copies of everything, and they are where an attacker gets their first real foothold.

For a beginner, the useful question is not "which product should I buy" but "what protects this machine, and in what order".

Order matters: controls near the top cost almost nothing and prevent most of what actually happens. Those near the bottom cost real money and pay off only after the top is done.

What to take away

The controls that matter, roughly in order

Automatic updates, applied and verified. This is dull and it beats everything else. Most successful intrusions on ordinary business machines use a weakness that was fixed months earlier on a machine where the fix was never installed. Turn on automatic updates for the operating system, then separately for the browser, and then for the handful of applications that do their own updating. Then verify, because "enabled" and "applied" are different states: a laptop that never reboots stays vulnerable with the patch downloaded and waiting.

Full-disk encryption. Built into current desktop and mobile operating systems, free, and the difference between a stolen laptop being a hardware loss and being a data breach. Turn it on and, critically, store the recovery key somewhere you can find it. An encrypted disk with a lost key is data you no longer have.

A screen lock with a short timeout, and a real device password. Unglamorous, and the control most often defeated by the machine left open in a coworking space.

Daily work in a non-administrator account. If the account you read mail in cannot install software or change system settings, a great deal of malicious activity simply fails at the first hurdle. On a machine with one user this feels pointless. It is not: it converts a silent installation into a prompt that appears when you were not expecting one.

Anti-malware that is actually turned on. The protection built into current operating systems is competent. What matters is that it is enabled, updating, and that somebody would notice if it were switched off.

Backups of anything stored only on the device. Endpoint protection is about reducing incidents. Backup is about surviving them. See backup and recovery for what a working copy looks like.

Then, and only then, consider detection and response tooling. Discussed below, with a warning attached.

The browser is the real endpoint now

Most work happens inside a browser tab, which makes the browser the thing worth hardening.

Extensions are the specific risk. They can typically read and modify every page you visit, including the accounting system and bank portal. They also change hands: a useful tool acquired by someone else can become something else entirely in an update you never see.

Keep the installed set small, review it occasionally, and where your platform allows, restrict installation to an approved list.

Keep the browser updating on its own, and use the password manager rather than the browser's saved passwords where you can. Treat a profile signed into a personal account on a work machine as a data path in both directions.

Antivirus, EDR, and the question nobody asks before buying

"Endpoint detection and response" describes tooling that records what happens on a device, looks for suspicious sequences of behavior rather than known-bad files, and gives someone the ability to investigate and isolate a machine remotely. It is genuinely more capable than traditional signature scanning.

It also has a requirement often glossed over in the sales conversation: someone has to respond. The value of detection is realized when a human reads the alert, decides what it means, and acts, often out of hours.

A small business that buys this tooling with nobody to watch it has bought a device that records its own burglary in high fidelity.

Ask the buying question in the right form. Not "does this detect more" but this: when it fires at 2am on a Sunday, who reads it, how do they reach me, and what are they authorized to do?

If the answer is nobody, either buy the monitored version of the service, arrange it through whoever provides your IT support, or spend the money on the earlier items in this article instead. Evaluation criteria are set out in the guide to security foundations.

You cannot protect the device you forgot about

Every business has more endpoints than it thinks. Ask three questions and write the answers down.

Which devices are in use? Include personal phones that receive work mail, the laptop lent to a contractor, the machine in the back office that runs one piece of old software, and anything connected to the point of sale. If your mail or file platform has a device list, that list is a good starting inventory and it is usually longer than expected.

Who owns each one? Ownership determines what you may lawfully do to the device, what happens when someone leaves, and who pays when it breaks.

What would happen if it disappeared today? This is the question that finds the unbacked-up machine and the single laptop that holds a business-critical spreadsheet.

Pretending they are not there does not solve personal devices. A realistic middle ground: require a device passcode and encryption, plus a work mailbox reachable only through an app whose data can be wiped without touching the owner's photographs. Write down what you can and cannot remotely erase.

People consent to a great deal when they understand it, and to nothing at all when it is sprung on them.

The machine that cannot be updated any more

Sooner or later you will have a device running software the vendor no longer supports: a controller for a machine, a terminal for a legacy system, an old tablet that runs one application. It cannot be patched, and the business needs it.

Do not leave it on the ordinary network hoping for the best. Isolate it so it can only reach the specific systems it must reach, and nothing else: the practicalities are in network security.

Remove its access to email and general web browsing, which is how such machines are usually reached. Restrict which accounts can log into it, back up whatever it holds, and know how you would rebuild it.

Then set a replacement date and treat it as a real commitment, not an aspiration, because these machines are otherwise immortal.

A maintenance rhythm that a busy person can keep

Endpoint security is maintenance, not a project, and a small routine that actually happens beats a thorough one that happens once.

Monthly, spend twenty minutes: confirm devices have actually applied updates and rebooted; look at the device list on your mail or file platform for anything unfamiliar; confirm encryption is on for new machines; check that anti-malware is running and current everywhere.

Quarterly, spend an hour: review browser extensions and installed software for things nobody can account for; check which devices have not connected in months and find out why; confirm backups from the past quarter can actually be restored; review the inventory against reality.

Whenever someone joins or leaves, handle the device in the same pass as the accounts. A returned laptop that never gets wiped, and a departed contractor's machine that still holds a signed-in session, are both endpoint problems the account checklist will not catch.

When something looks wrong, isolate rather than wipe. Disconnecting a suspicious machine from the network preserves the evidence needed to work out what happened; reimaging it immediately destroys that evidence and tells you nothing about whether the same thing is happening elsewhere. The sequence is in incident response.

What beginners tend to get wrong

Buying tools before updates, assuming free built-in protection is inadequate, then treating "we have antivirus" as a full answer.

Sharing one administrator account across every machine lets one compromised device yield all, and encrypting laptops, not external drives that go home in a bag.

Measuring success by how many products are installed, not whether the last restore test worked.

The United States Federal Trade Commission's data security guidance for businesses is a free and reasonable general reference. What any specific rule requires of your business depends on your industry and jurisdiction, and that is a question for your own advisers.

Common questions

Is the protection built into the operating system enough?

For a business with patched machines, non-administrator daily accounts and a tested backup, it covers the ordinary cases well. Where it stops is telling a person and letting you isolate a machine from a distance, and whether those gaps matter depends entirely on whether anybody would be watching.

What about personal phones and laptops used for work?

They are on the list whether or not anyone wants them to be. The minimum is a screen lock, encryption, current updates, and a way to remove business access without wiping somebody's own device, which most business platforms offer. The account side of that is covered in identity and access.

A machine cannot be updated any more and the business depends on it. What do we do?

Reduce what it can reach instead of hoping. Give it its own network segment, block browsing and reading mail, and put a replacement date in the budget.

Separating it from machines that hold real work is what matters. Do that on the day you decide to keep the machine, not the day something happens.

How do we handle a laptop that comes back from a leaver?

Wipe it before it is reissued, and do the accounts on the same day rather than a week later. A returned machine holding a signed-in session is the same problem as an open account, and both belong on the same departure checklist.

Does any of this help against a message that tricks somebody?

Only after the click. What acts before it is the mail and account work in phishing defense, and endpoint tooling is what limits the damage once those have failed.

Would it have stopped an invoice being paid to the wrong bank account?

No, and it is worth being clear about that. Nothing malicious runs in that case; a person is persuaded. The control that stops it is the verification rule in business email compromise, which is a process rather than anything installed on a device.

Where should we read further?

The United Kingdom National Cyber Security Centre's device security guidance is organized around the device rather than the network, which suits a business whose fleet has stopped sitting in one building.