Endpoint Security

Overview

Endpoint security applies the principle of defense in depth: layering multiple controls so that a failure in one layer is caught by another. At the outer boundary, edge security controls filter traffic before it reaches the internal network. Inside the perimeter, access control mechanisms regulate which devices and users can connect to internal resources. The endpoint itself must be individually secured rather than assumed safe simply because it passed a perimeter check.

Defense in Depth Layers

A mature endpoint security posture uses at minimum three distinct layers:

• Edge security — firewalls, IPS, and perimeter controls filter inbound and outbound traffic before it reaches internal segments. These controls stop threats that never reach the endpoint.
• Access controls — network access control (NAC) systems validate endpoint posture before granting access to network resources. A device that fails a health check is quarantined or given limited access to a remediation VLAN.
• Endpoint hardening — individual device controls: host-based firewalls, antivirus, patch management, disk encryption, application whitelisting, and EDR agents protect the device itself after it joins the network.

None of these layers is sufficient alone. Perimeter controls can be bypassed by insider threats or compromised devices already inside. Endpoint hardening cannot prevent a device from receiving a malicious payload from the network. Defense in depth requires all layers operating simultaneously.

Endpoint Posture Assessment

Posture assessment evaluates the security state of an endpoint before and during network access. The three deployment models differ in how the assessment agent is delivered and how long it persists on the device:

The agentless model is the most limited: it can verify AD membership and basic account attributes but cannot inspect running processes, installed software versions, or real-time security status. Persistent and dissolvable agents provide richer health data because they execute directly on the endpoint.

What Posture Assessment Checks

Regardless of agent type, posture assessment evaluates whether the endpoint meets a defined health policy before granting access:

• OS patch level — is the operating system at the required patch version?
• Antivirus status — is AV installed, enabled, and signature database current?
• Host-based firewall — is the firewall active and properly configured?
• Disk encryption — is full-disk encryption enabled for devices requiring it?
• Certificate presence — does the device hold a valid machine certificate?

Devices that fail posture assessment are typically redirected to a quarantine network with access only to a remediation server. After self-remediation, the device can re-request assessment and normal access.

Overview

Traditional antivirus relies on signature matching: it compares files against a database of known malicious signatures. This approach fails against novel malware, fileless attacks, and polymorphic code that changes its signature on every execution. Endpoint Detection and Response (EDR) takes a fundamentally different approach: it monitors behavior rather than signatures, identifying attacks by what they do rather than what they look like.

EDR Core Capabilities

• Behavioral analysis — EDR monitors every process on the system: what files it reads and writes, what network connections it makes, what registry keys it modifies, and what child processes it spawns. Malicious behavior produces patterns that are detectable even if the malware binary has never been seen before.
• Machine learning — ML models trained on millions of attack samples identify malicious behavior patterns with high accuracy. ML allows EDR to detect zero-day attacks that have no existing signature.
• Process monitoring — EDR watches every running process continuously, building a tree of parent-child process relationships. An unexpected process spawning from a Word document (e.g., cmd.exe spawned by winword.exe) is a strong indicator of macro-based malware.
• Root cause analysis — when a threat is detected, EDR reconstructs the full attack chain: which process started first, what it executed, what changes it made, and what data it accessed. This allows responders to understand the full scope of a compromise rather than just the final payload.

EDR Automated Response

EDR systems can respond to detected threats automatically without waiting for human intervention:

• Automated isolation — a compromised endpoint can be immediately quarantined from the network, preventing lateral movement to other systems. Isolation happens at the OS level; the EDR agent retains its management channel even when the device is isolated from the rest of the network.
• Automated quarantine — malicious files are quarantined (moved to a protected container inaccessible to users and other processes) rather than simply deleted, preserving them for forensic analysis.
• Automated rollback — EDR agents on Windows systems can leverage the Volume Shadow Copy Service (VSS) to roll back changes made by ransomware or other destructive malware, restoring files to their pre-attack state.
• API-driven response — EDR systems expose APIs that allow integration with SIEM platforms, SOAR playbooks, and ticketing systems. A threat detected by EDR can automatically open a helpdesk ticket, notify the security team, and trigger additional investigation steps.

The combination of behavioral detection and automated response reduces dwell time — the time an attacker operates undetected inside a network — from weeks or months (the industry average for traditional AV) to minutes or hours.

EDR vs. Traditional Antivirus

Overview

EDR provides deep visibility into individual endpoints. XDR extends that visibility across multiple security domains simultaneously, correlating data from endpoints, networks, cloud workloads, and identity systems into a unified investigation view. User Behavior Analytics (UBA) adds a behavioral baseline layer that detects anomalies in how users and accounts interact with systems, catching threats that bypass technical controls by exploiting legitimate credentials.

Extended Detection and Response (XDR)

XDR is an evolution of EDR that aggregates telemetry from multiple security tools into a single detection and response platform:

• Endpoint data — process telemetry, file system changes, network connections (from the EDR agent)
• Network data — traffic flows, DNS queries, IPS alerts (from network sensors and firewalls)
• Cloud data — API calls, configuration changes, access logs (from cloud security tools)
• Identity data — authentication logs, privilege escalation events, failed logins (from identity providers)

By correlating these data sources, XDR can detect multi-stage attacks that span across domains. An attack that starts with a phishing email (email security data), results in a malicious process on an endpoint (EDR data), makes lateral movement across the network (network data), and then accesses a cloud storage bucket (cloud data) is invisible to any single tool but visible as a connected attack chain in XDR.

XDR Benefits

• Reduced false positives — correlating context from multiple sources means that an alert that looks suspicious in one domain can be validated or dismissed based on what is happening in other domains simultaneously.
• Shorter investigation time — security analysts no longer need to pivot between separate SIEM, EDR, and network tools to reconstruct an attack. XDR presents the unified attack story automatically.
• Cross-domain automated response — XDR can trigger responses across domains simultaneously: isolate the endpoint, block the IP at the firewall, disable the compromised account in the identity provider, and quarantine the cloud storage access, all from a single platform.

User Behavior Analytics (UBA)

UBA systems establish a behavioral baseline for each user and account in the environment. The baseline captures what is normal: which systems a user logs into, what hours they work, what data they typically access, what applications they use, and how they move through the network. Once the baseline is established, UBA continuously compares current behavior against it and flags statistically significant anomalies.

Examples of UBA-detectable anomalies:

• A user account logging in from two countries within minutes of each other (impossible travel)
• A user accessing ten times more files than their historical average (potential data staging for exfiltration)
• An account that normally works 9–5 suddenly connecting at 3 AM and downloading large volumes of data
• A service account that never generates interactive logins suddenly authenticating to a workstation

UBA is particularly effective at detecting insider threats and credential theft. Both scenarios involve legitimate credentials performing illegitimate actions — traditional rule-based detection often misses these because no specific rule is violated. UBA detects the deviation from the established behavioral norm regardless of whether the actor is the legitimate user or an attacker using stolen credentials.