An "endpoint" is any device that connects to your network and does actual work — laptops, desktops, phones, tablets. They're the most common entry point for attackers, not because they're technically the weakest link, but because they're where humans directly interact with email, downloads, and the web, making them the target of choice for phishing and malware.

The baseline stack

  • Endpoint protection (antivirus or EDR). Traditional antivirus catches known malware signatures. EDR (Endpoint Detection and Response) goes further, watching for suspicious behavior patterns even from malware it's never seen before, and giving IT the ability to investigate and respond to an incident directly on the affected device.
  • A firewall, both at the network edge and on individual devices — built-in OS firewalls (Windows Defender Firewall, macOS's firewall) are a reasonable baseline and should simply be turned on, not disabled for convenience.
  • Full-disk encryption (BitLocker on Windows, FileVault on Mac) — ensures a lost or stolen laptop doesn't hand over readable data along with the hardware.
  • Automatic updates, both for the operating system and commonly-exploited applications like browsers and PDF readers.
  • Least-privilege accounts. Most day-to-day users shouldn't be running as local administrators — a compromised standard account is contained in a way a compromised admin account isn't.

What EDR adds over traditional antivirus

Traditional antivirus is largely signature-based — it recognizes malware it already knows about. EDR adds behavioral monitoring: it watches for patterns that look like an attack even from previously unseen malware, like a process suddenly trying to encrypt large numbers of files rapidly, or an application attempting to access memory it has no legitimate reason to touch. For a small business without a dedicated security team, a managed EDR service (where a third party monitors the alerts) often makes more sense than buying a tool and having nobody actually watch what it flags.

Mobile device management for small fleets

Even a handful of company phones or laptops benefit from basic MDM (mobile device management) — the ability to enforce a passcode, remotely wipe a lost device, and push required updates, without needing enterprise-scale tooling. Microsoft Intune and similar cloud-based platforms have made this realistic even for a business with a dozen devices, not just large enterprises.

Minimum viable checklist

  • Endpoint protection installed and centrally managed (not left to individual users to configure)
  • Automatic OS and browser updates enabled, not deferred indefinitely
  • Full-disk encryption turned on for every laptop
  • Standard users running as non-administrators day to day
  • MFA enforced on any account with access to sensitive systems
  • A basic MDM policy covering at minimum: passcode requirement and remote wipe capability