Endpoint

In security usage an endpoint is a host that terminates network communication and runs workloads or serves users, as opposed to intermediate infrastructure such as routers, switches, firewalls and load balancers. The category is broad: managed laptops and desktops, servers and virtual machines, mobile devices, and a long tail of embedded devices - printers, IP phones, cameras, badge readers, medical devices, building-management controllers, PLCs. The distinction that matters operationally is not device type but manageability: whether the device can run an agent (EDR, MDM/UEM client, patch agent), whether the organisation controls its configuration, and whether its firmware is still supported. Headless and embedded endpoints often cannot take an agent at all and must be protected by network segmentation, NAC and passive monitoring instead.

Note that the word has a second, unrelated meaning in software engineering, where an API endpoint is a URL or route that accepts requests. Endpoint security is about the device, API security about the interface; the two are occasionally conflated in procurement documents.

Endpoint security is a layered stack: hardened baseline configuration (CIS Benchmarks, Microsoft security baselines), full-disk encryption (BitLocker, FileVault, LUKS) with keys escrowed centrally, host firewall, application control, patching of OS, applications and firmware, local administrator rights removed or managed (for example with Windows LAPS), EPP/EDR, and device management that can wipe a lost device. Modern designs add device health attestation - TPM-backed measured boot and secure boot state reported to the identity provider - so that conditional access in a Zero Trust architecture can refuse a request from a device that is unmanaged, out of date or tampered with. BYOD complicates this: the organisation typically manages an app container or work profile rather than the whole device, which limits both control and visibility and has data-protection implications for monitoring employees' private devices.

ISO/IEC 27002:2022 control 8.1 (user endpoint devices) covers registration, protection and acceptable use, and CIS Controls v8 treats end-user devices, servers and mobile devices as enterprise assets under Control 1 (inventory), Control 4 (secure configuration) and Control 10 (malware defenses). Endpoints matter disproportionately because initial access - phishing attachments, drive-by downloads, malicious USB media, stolen session tokens in browsers - lands there, and because credentials cached on an endpoint are the raw material for lateral movement.