In short
An endpoint in cyber security is any device that connects to your network or cloud services and runs software for a user or workload: laptops, desktops, servers, virtual machines, phones, tablets and connected IoT or operational technology devices. Each one is a possible way in for an attacker, so each needs to be known, managed and protected.
Want help with endpoint security?
We can plan it with you or do it for you. Tell us where you are up to.
Endpoint meaning in cyber security
The word comes from networking: an endpoint is the device at one end of a communication, as opposed to the routers, switches and firewalls that carry traffic between devices. In security, "endpoint" has come to mean the computing devices people and applications actually use, wherever they are.
That definition matters because modern work no longer happens inside one office network. A laptop on home broadband, a phone on EE Business or Vodafone Business mobile data, and a virtual machine in a public cloud are all endpoints. They connect directly to Microsoft 365 and other cloud apps, often without passing through any firewall you control, so the device itself has to carry much of the protection.
Network equipment such as firewalls, switches and wireless access points is usually treated as network infrastructure rather than as endpoints. It still needs patching and secure configuration, but it is protected with different tools.
Types of endpoint
Most organisations have more types of endpoint than they first count. This table covers the main groups and how each is typically protected.
| Type | Examples | How it is usually protected |
|---|---|---|
| Laptops and desktops | Windows PCs, Macs and Linux workstations used by staff | Endpoint protection and EDR agent, disk encryption, patching, device management |
| Servers | File, application and database servers, on-premises or hosted | Server-capable EDR agent, tight change control, patching, backups |
| Virtual machines and virtual desktops | Cloud workloads, virtual desktop sessions, test machines | EDR agent or cloud workload protection, hardened images, short-lived builds |
| Phones and tablets | Company-owned and personal smartphones and tablets | Device or app management plus mobile threat defence |
| IoT and OT devices | Printers, cameras, door entry, building management, industrial controllers | Inventory, network segmentation, firmware updates and default password removal; most cannot run an agent |
Peripherals such as USB drives, keyboards and docking stations are not endpoints in their own right, but they connect to endpoints and can carry malware or take data away. That is what USB device control addresses.
Not sure which option applies to you? Ask us
Tell us about your organisation and we will point you to the right option.
Managed, unmanaged and personal devices
A managed endpoint is enrolled in your device management or security console. You can see it, push settings to it, patch it and, if needed, wipe it. An unmanaged endpoint is any device reaching your data that you cannot see or control: a contractor's laptop, an old PC under a desk, or a personal phone with work email set up by hand.
Personal devices used for work, known as bring your own device (BYOD), sit between the two. You can protect work apps and data on them without taking control of the whole device, but you need a policy first. Our BYOD security guide follows the NCSC's five actions for this. For Cyber Essentials, user-owned devices that reach organisational data or services are in scope unless they are only used for native calls, texts or multi-factor authentication apps; the detail is on our sister site's BYOD and home working page.
Unmanaged devices are where blind spots appear. A good first step for any organisation is to compare the devices in your security console with the devices in your asset list and your Microsoft 365 sign-in logs, then explain every difference.
Why endpoints are a prime target
Endpoints are where people open email, browse the web, plug in USB drives, install software and sign in to cloud services. That makes them the natural first target:
- People are on them. Phishing links, malicious attachments and fake software updates all need a device to run on.
- Credentials live there. Browsers and apps hold passwords, session cookies and tokens that let an attacker reach cloud services without a password prompt.
- They leave the building. Laptops and phones get lost, stolen or connected to untrusted Wi-Fi.
- They hold or reach data. Files sync from cloud storage to local disks, so one device can expose a lot.
- Ransomware runs on them. Encryption of files happens on endpoints and servers, often after attackers have used legitimate admin tools to move between devices.
- Patches lag. Every device that misses an update keeps a known weakness open until it is fixed.
Because so much starts on an endpoint, the device is also where the best evidence is. That is why endpoint detection and response records process, file, network and sign-in activity on each device.
Prefer a hand with this?
We can help you plan it and set it up, alongside your own team.
How endpoints are protected
Endpoint protection is a set of layers rather than one product. The main ones are:
- Endpoint protection (EPP) and antivirus: blocks known and suspicious malware. Our sister site endpointprotection.uk covers these products.
- Endpoint detection and response (EDR): records activity, detects attacker behaviour and lets you isolate devices and roll back changes. See EDR and EDR vs antivirus.
- Extended detection and response (XDR): joins endpoint data with identity, email and cloud signals. See XDR.
- Mobile threat defence (MTD): detects phishing, malicious apps and device compromise on phones and tablets. See mobile threat defence.
- Device management (MDM or UEM): enrols devices and enforces settings such as passcodes, encryption and updates.
- Hardening, patching and least privilege: reduces what an attacker can exploit. See endpoint hardening, the patch management process and endpoint privilege management.
- Encryption: protects data on lost or stolen devices. See full disk encryption.
How these fit together for a whole organisation is covered on our endpoint security for business page and in the endpoint security best practices checklist.
Counting your endpoints
Knowing how many endpoints you have matters for more than security. Most endpoint security and device management products are licensed per device or per user, Cyber Essentials asks you to define which devices are in scope, and insurers often ask how many devices are protected. A useful count separates:
- User devices: laptops and desktops, noting which are shared and which are personal
- Servers: physical and virtual, on-premises and hosted, because they are often licensed separately
- Virtual desktops and short-lived machines: how many run at once, not just how many images exist
- Phones and tablets: company-owned and personal devices that reach email, files or business apps
- Devices that cannot run an agent: printers, cameras and building systems that need network controls instead
Pull the numbers from more than one place: your security console, your device management tool, your Microsoft 365 sign-in and device records, and your purchase records. The differences between those lists are usually the unmanaged devices you most need to find. Once you have a reliable count, choosing between per-device and per-user licensing, and between platforms, becomes much easier; our endpoint security vendors page lists the platforms we supply.
Get help finding and protecting your endpoints
If you are not sure how many endpoints you have, or which of them are protected, that is the place to start. We can help you compare what your security and management consoles can see with what is actually connecting, then recommend how to close the gaps.
Contact us for help understanding and protecting your endpoints.
How Forever Systems helps with endpoint security
We are an independent UK IT and cyber security provider. We supply and support endpoint security from several vendors, so we can recommend what fits your devices, your people and your budget rather than one vendor's answer to everything.
- Start with what you have: we can review your current antivirus, EDR and Microsoft 365 licences before suggesting anything new
- Vendor-aware advice on EDR, XDR and managed detection and response, including CrowdStrike, SentinelOne, WatchGuard, Bitdefender, Sophos and Check Point Harmony
- Deployment help: planning a rollout, replacing an existing product and setting sensible policies for device control, encryption and patching
- Policies and compliance: we help you map your controls to Cyber Essentials and the NCSC's device guidance
- Ongoing support options, such as policy tuning, renewals and regular reviews, agreed and confirmed at quote
We work with businesses, schools, charities and public sector organisations. Tell us about your devices and we will suggest a sensible next step.
Frequently asked questions
Is a mobile phone an endpoint?
Yes. Any phone or tablet that reaches company email, files or apps is an endpoint, whether the company owns it or not. Phones need device or app management and, increasingly, mobile threat defence to deal with smishing, malicious apps and risky networks.
Is a server an endpoint?
Yes. Servers run software and connect to the network, so security tools treat them as endpoints. They are often the most valuable targets because they hold shared data, and they are usually protected with a server-capable EDR agent, careful patching and backups.
Is a router or firewall an endpoint?
Usually not. Routers, switches and firewalls carry traffic between endpoints and are treated as network infrastructure. They still need secure configuration and firmware updates, but they are protected with network security tools rather than an endpoint agent.
What is the difference between endpoint security and network security?
Network security controls traffic as it moves between networks, for example with firewalls and web filtering. Endpoint security protects the devices themselves, wherever they connect from. With people working remotely and using cloud apps directly, organisations need both.
What is an unmanaged endpoint?
An unmanaged endpoint is a device that reaches your data or services but is not enrolled in your management or security tools, such as a contractor's laptop or a personal phone with work email added by hand. You cannot see its patch level or protection status, so it is a common blind spot.
Still have a question about endpoint security?
Ask us and a member of our team will reply by email.