In short
Zero trust endpoint security applies zero trust principles to laptops, desktops, servers and phones. Before granting access, it checks the device's identity and health, such as encryption, patch level and a running EDR agent. On the device it blocks unknown applications by default, removes standing admin rights and contains lateral movement, so one compromised device cannot spread.
Get a quote for zero trust endpoint security
Tell us roughly how many users or sites you have and we will reply by email with options and a quote.
What zero trust means for endpoints
Traditional security trusted anything inside the network perimeter. Zero trust removes that inherent trust: the network is assumed hostile, and each request is checked against an access policy. Our sister site explains zero trust security as a whole strategy.
The NCSC's zero trust architecture design principles put devices at the heart of it. Two of its eight principles are directly about endpoints:
- Know your user, service and device identities: every device should be uniquely identifiable, because identity is one of the most important factors in deciding whether something gets access.
- Assess your user behaviour, devices and services health: device health is an important signal when deciding whether a request should be trusted.
For endpoints, zero trust therefore works in two directions. Outwards, the device must prove who it is and that it is healthy before it is allowed near your applications and data. Inwards, the device itself is not trusted to behave: applications are denied unless approved, users have no standing admin rights, and if something goes wrong it is contained before it can spread.
The device signals that matter
Access decisions are only as good as the signals behind them. These are the device health checks most zero trust designs use:
| Signal | Why it matters | Where it usually comes from |
|---|---|---|
| Device identity | Only known, managed devices (or approved personal devices) should reach sensitive data | Device certificates, MDM enrolment, directory registration |
| Endpoint security running | A device without a working EDR agent is blind to attack | EDR or endpoint protection console |
| Active threats or risk score | A device with an open incident should lose access until it is clean | EDR, XDR or mobile threat defence |
| Operating system and patch level | Unsupported or unpatched systems are easy targets | MDM, EDR or vulnerability management |
| Disk encryption | Protects data if the device is lost or stolen | MDM or encryption console |
| Secure configuration | Firewall on, screen lock, no jailbreak or root | MDM compliance policy, hardening checks |
| Location and behaviour | Unusual sign-ins from a device may indicate theft or misuse | Identity provider risk signals |
The point is not to collect every signal, but to agree which ones decide access to which data, and to make sure the tool producing each signal covers every device. A posture check that only runs on half your laptops is a policy with a gap.
Not sure which option fits? Ask us
Tell us what you need and we will recommend the right option for your organisation, with a quote.
Using device health at sign-in
The usual way to act on device health is conditional access: your identity provider asks whether a device is compliant before it lets a user into Microsoft 365 or other cloud apps. MDM compliance policies decide what compliant means, and many security tools feed their own view in:
- Mobile threat defence products such as Lookout feed a device risk level to your MDM, so a compromised phone can be blocked from company data automatically. See mobile threat defence.
- EDR platforms can mark a device as high risk during an incident, which compliance rules can use to cut access until it is clean.
- Posture management in tools such as Check Point Endpoint Security finds vulnerabilities and missing patches, so you can fix what would make a device non-compliant. See Harmony Endpoint posture management.
For internal applications, zero trust network access replaces the traditional remote access VPN: each connection is brokered and checked for identity, MFA and device health, and users reach individual applications rather than the whole network. Our sister site explains ZTNA. The NCSC's enterprise authentication policy guidance is a useful companion for the identity side.
Zero trust on the device itself
Checking health at the door is half the job. Zero trust endpoint protection also assumes that something on the device may be hostile, and limits what it can do:
| Control | What it does | Read more |
|---|---|---|
| Application default-deny | Unknown software does not run until it is approved or classified as safe | Application whitelisting |
| Least privilege | Users run without standing admin rights; elevation is just-in-time and logged | Endpoint privilege management |
| Device control | Removable media and peripherals are blocked or read-only unless approved | USB device control |
| Host firewall and segmentation | Devices only talk to what they need to, limiting lateral movement | Endpoint hardening |
| Detection and containment | Suspicious behaviour is detected and the device isolated before an attacker moves on | Endpoint detection and response |
| Encryption | Data on a lost or stolen device stays unreadable | Full disk encryption |
Together these are what vendors mean by a zero trust endpoint protection platform: prevention that does not rely on recognising known-bad software, combined with detection and containment for what gets through.
Is zero trust endpoint security the right fit for you?
We will check it against your systems and requirements and recommend the right option.
Zero trust capabilities in platforms we supply
No single product delivers zero trust, but several platforms we supply provide important parts of it:
| Platform | Zero trust capability | Read more |
|---|---|---|
| WatchGuard Endpoint Security 360 and Elite | Zero-Trust Application Service, which blocks applications until they are classified as safe, plus lateral movement detection and containment | WatchGuard EPDR |
| Check Point Endpoint Security | Compliance checks and application control in every edition; posture management (vulnerability and patching) in Elite or as an add-on | Harmony Endpoint |
| SentinelOne Singularity | Network isolation, firewall control and device control, plus visibility of devices still missing an agent | SentinelOne Singularity |
| CrowdStrike Falcon | Device control and host firewall management in Falcon Defend; Falcon Discover asset inventory in Complete Defend | CrowdStrike Falcon |
| Keeper Endpoint Privilege Manager | Removes standing admin rights with just-in-time elevation | Endpoint privilege management |
| Lookout | Mobile device risk fed to MDM for conditional access | Mobile threat defence |
Which combination fits depends on what you already run. You may already own several of these pieces in your current licences without having connected them, and we can check that for you.
A phased plan
Zero trust is built in stages, not bought in a day. A realistic order for endpoints:
- Inventory: know every device that touches your data, managed or not.
- Baseline: EDR on every computer, encryption on, updates current, admin rights removed.
- Compliance: define what a healthy device is and report against it.
- Conditional access: start requiring a compliant device for your most sensitive applications, then extend.
- Default-deny: move servers and high-risk groups to application allowlisting.
- Containment: tune automatic isolation and lateral movement controls, and test them.
Our endpoint security best practices guide covers the baseline steps in more detail.
How we help
We supply several endpoint security platforms, so we can look at what you already have, show where the zero trust gaps are, and recommend the smallest set of changes that closes them. We can help define device compliance, connect security signals to access decisions and plan application control and privilege changes, with any new licensing confirmed at quote.
Contact us to talk about zero trust endpoint security for your organisation.
How Forever Systems helps with endpoint security
We are an independent UK IT and cyber security provider. We supply and support endpoint security from several vendors, so we can recommend what fits your devices, your people and your budget rather than one vendor's answer to everything.
- Start with what you have: we can review your current antivirus, EDR and Microsoft 365 licences before suggesting anything new
- Vendor-aware advice on EDR, XDR and managed detection and response, including CrowdStrike, SentinelOne, WatchGuard, Bitdefender, Sophos and Check Point Harmony
- Deployment help: planning a rollout, replacing an existing product and setting sensible policies for device control, encryption and patching
- Policies and compliance: we help you map your controls to Cyber Essentials and the NCSC's device guidance
- Ongoing support options, such as policy tuning, renewals and regular reviews, agreed and confirmed at quote
We work with businesses, schools, charities and public sector organisations. Tell us about your devices and we will suggest a sensible next step.
Frequently asked questions
What is zero trust endpoint security?
Zero trust endpoint security applies zero trust principles to devices. A device has to prove its identity and health before it can access data, and on the device itself unknown applications are blocked by default, admin rights are removed and suspicious activity is contained so it cannot spread.
What is a zero trust endpoint protection platform?
It is endpoint protection that does not rely only on recognising known malware. It denies unknown applications by default, limits privileges and contains lateral movement, and is usually combined with EDR. WatchGuard's Zero-Trust Application Service in Endpoint Security 360 and Elite is one example we supply.
What device health checks are used in zero trust?
Common checks are whether the device is known and managed, whether endpoint security is running, whether it has an active threat, its operating system and patch level, whether the disk is encrypted and whether it meets configuration rules such as having a screen lock and no jailbreak.
Is zero trust the same as ZTNA?
No. ZTNA, zero trust network access, is one technology within a zero trust strategy. It gives users access to individual applications after checking identity and device health, instead of placing them on the whole network as a VPN does.
Where should a small business start with zero trust for devices?
Start with the basics: know every device, run EDR on all computers, encrypt disks, keep updates current and remove local admin rights. Then require a compliant device to reach your most sensitive applications, and extend from there.
Still have a question about zero trust endpoint security?
Ask us and a member of our team will reply by email.