Security · Detection & Response
Endpoint Security
The layered controls that protect devices: hardening, application control, exploit mitigation, EDR and disk encryption.
IntermediateUpdated 2026-09-01
Overview
Endpoint security is a stack rather than a product: secure baseline configuration, patching, least privilege, application control, network protection, attack surface reduction rules, disk encryption and behavioural detection.
Removing local administrator rights and enforcing application control prevent far more incidents than adding another detection product to an unhardened device.
Security considerations
- Enforce disk encryption with escrowed recovery keys.
- Deploy application control in audit mode, refine, then enforce.
- Block macros from the internet and restrict script hosts where practical.