- Endpoints are the primary entry point for ransomware. An unpatched device, or one protected by signature-only antivirus, gives attackers a reliable foothold.
- EDR (Endpoint Detection and Response) monitors device behaviour continuously and catches attacks that have no known signature. For most businesses, EDR is the minimum viable standard today, not antivirus.
- Patch management returns more security value per pound spent than almost any other control. Most ransomware exploits vulnerabilities with patches that existed weeks or months before the breach.
- Full-disk encryption stops data theft from lost or stolen devices. A stolen laptop without BitLocker or FileVault is a data breach under UK GDPR, not an inconvenience.
- MDM lets you enforce device policies, push security updates, and wipe lost devices remotely. It is essential for any organisation with staff working outside the office or using personal devices for work.
Why endpoints are the most targeted part of your environment
Every employee works on a device. That device connects to the internet, runs applications, stores files, and holds credentials. Attackers target endpoints because they are numerous, often inconsistently managed, and carry direct access to the data and systems that matter.
The three most common endpoint attack paths are:
- Phishing leading to malware installation: a user clicks a malicious link or opens an infected attachment, dropping ransomware, a remote access tool, or an information stealer onto the device.
- Exploitation of unpatched vulnerabilities: attackers scan for devices running software with known vulnerabilities and run exploit code against them directly, with no user interaction required.
- Credential theft: malware on an endpoint captures passwords or session tokens, which attackers use to move laterally into cloud services, file shares, and internal systems.
Antivirus vs EDR: what the difference means in practice
Antivirus compares files against a database of known malware signatures. If the file matches a signature, it is blocked. If it does not, it runs. Attackers have known this for years and routinely modify malware to evade signature detection, or use legitimate tools that have no signature at all.
EDR takes a different approach. Rather than looking at files, it monitors what processes do: what they write to disk, what network connections they open, what registry keys they modify, what other processes they spawn. When a process behaves like an attacker, EDR flags it, records the activity, and can isolate the device automatically while your team investigates.
Modern ransomware groups routinely use legitimate system tools such as PowerShell, WMI, and remote desktop protocols to move through networks without dropping any malware file for antivirus to detect. This is called living-off-the-land. EDR detects these patterns; antivirus does not.
Microsoft Defender for Endpoint
For most UK businesses already on Microsoft 365, Defender for Endpoint (included in Business Premium and available as a standalone add-on) is a capable EDR platform that covers Windows, macOS, iOS, and Android devices. It provides behavioural detection, attack surface reduction rules, a management console, and integration with Microsoft Sentinel for organisations running a security operations function.
Third-party EDR products from vendors such as CrowdStrike, SentinelOne, and Sophos offer comparable detection with different management interfaces and licensing models. The choice matters less than ensuring EDR is deployed to every device, correctly configured, and actively monitored.
Patch management
Unpatched software is the single most exploited attack surface in UK businesses. Attackers do not need zero-day vulnerabilities when a significant proportion of devices run software with known, publicly documented vulnerabilities and available patches.
The challenge is not awareness. Most IT teams know patching matters. The challenge is execution at scale: hundreds of devices running dozens of applications, each with its own update cadence, some requiring restarts, some requiring user action, and some managed by users who defer updates indefinitely.
What to patch and how quickly
| Severity | Timescale | Examples |
|---|---|---|
| Critical | Within 14 days (Cyber Essentials requirement) | Remote code execution in Windows, Exchange, VPN appliances |
| High | Within 14 days | Privilege escalation, authentication bypass |
| Medium | Within 30 days | Information disclosure, denial of service |
| Low | Within 90 days or next scheduled cycle | Minor configuration issues, limited exploitability |
Cyber Essentials requires patches for high and critical severity vulnerabilities to be applied within 14 days of release, and software that is no longer supported by the vendor to be removed. This is a minimum baseline. The Mandiant research cited above puts the median exploitation window at 15 days for actively exploited vulnerabilities, which means the 14-day target is tight.
Automating patch deployment
Manual patching does not scale. Use a patch management platform to automate deployment and track compliance:
- Microsoft Intune: patch Windows and macOS devices enrolled in Intune. Configure update rings that deploy patches to a pilot group first, then to all devices within your target window.
- Windows Server Update Services (WSUS): suitable for on-premises environments with no cloud MDM. Requires more manual configuration but gives granular control over which updates deploy and when.
- Third-party patch management: platforms such as NinjaRMM, Manage Engine Patch Manager Plus, or Atera patch Windows, macOS, and third-party applications (Chrome, Adobe, Java) from a single console.
Third-party applications are where most organisations fall short. Operating system patches often deploy automatically, but applications sitting outside the OS update mechanism accumulate vulnerabilities for months. A patch management platform that covers third-party software closes this gap.
Endpoints include servers. A file server or internal application server running unpatched Windows Server is a high-value target. Include servers in your patch management scope and treat them to the same timescales as desktops, with appropriate testing before deployment to production systems.
Full-disk encryption
Full-disk encryption protects data on lost or stolen devices. Without it, anyone with physical access to a laptop can read its contents by booting from external media or removing the drive. With it, the encrypted data is unreadable without the correct credentials or recovery key.
Under UK GDPR, a lost unencrypted device containing personal data is a reportable breach. A lost encrypted device, where the encryption key is not also compromised, is not. Encryption converts a potential ICO notification and reputational incident into an administrative matter.
Enabling encryption on Windows and macOS
- BitLocker (Windows): available on Windows 10/11 Pro, Enterprise, and Education. Enable through Group Policy or Intune. Store recovery keys in Azure AD or Active Directory, not locally on the device. Require TPM-based encryption so the disk cannot be read if removed from the original machine.
- FileVault (macOS): built into macOS. Enable through System Settings or enforce via MDM. Store recovery keys in your MDM platform, not with the user.
- Windows Home editions: Device Encryption (a simplified form of BitLocker) is available on devices that meet hardware requirements. Verify it is enabled on any Windows Home devices used for work, or upgrade to Pro.
Verify encryption status across your estate through your MDM or a vulnerability management tool. Self-reported compliance is not reliable; automated reporting is.
Application control and device hardening
Default device configurations are not secure configurations. Operating systems ship with features enabled that most organisations do not need, and users install software that introduces risk. Hardening addresses both.
Remove what you do not need
Cyber Essentials requires unnecessary software to be removed and unnecessary features to be disabled. This is also sound practice independent of certification. Every application installed is an additional attack surface. Restrict installation rights so standard users cannot install software without administrator approval.
Application allowlisting
Allowlisting permits only approved applications to run and blocks everything else. It stops malware execution even when the malware bypasses detection, because it is not on the approved list. Allowlisting is technically demanding to implement and maintain, but it is the most effective endpoint control available.
Microsoft AppLocker and Windows Defender Application Control (WDAC) provide allowlisting capabilities on Windows. WDAC integrates with Intune for policy deployment across managed devices. Start with audit mode to identify what currently runs across your estate before switching to enforcement.
Attack surface reduction rules
Microsoft Defender for Endpoint includes attack surface reduction (ASR) rules that block specific behaviours commonly used in attacks: blocking Office applications from spawning child processes, blocking executable content from email and web downloads, preventing credential theft from Windows local security authority. Enable ASR rules in audit mode first, review the findings, then move to block mode for rules that do not impact legitimate workflows.
Mobile device management
Employees access corporate email, files, and applications from laptops, phones, and tablets, including personal devices. Without MDM, you have no visibility of what runs on those devices, no way to enforce security policies, and no mechanism to wipe corporate data if a device is lost or an employee leaves.
MDM vs MAM
| Approach | What it manages | Best for |
|---|---|---|
| Full MDM | The entire device: settings, applications, patching, remote wipe | Company-owned devices |
| MAM (Mobile App Management) | Corporate applications and data only; personal content untouched | Personal devices (BYOD) |
| Co-management | Shared control between MDM and Configuration Manager for hybrid environments | Large organisations with existing on-premises management |
For personal devices, MAM through Microsoft Intune App Protection Policies allows you to enforce encryption, PIN requirements, and data loss prevention on corporate apps (Outlook, Teams, OneDrive) without touching personal data. Users accept this approach where full MDM enrolment would meet resistance.
Policies to enforce through MDM
- Screen lock with PIN or biometric after five minutes of inactivity
- Full-disk encryption required before enrolment
- Minimum OS version enforced (block enrolment of unsupported OS versions)
- Jailbroken or rooted devices blocked from corporate access
- Remote wipe capability confirmed before granting access to corporate data
- Conditional Access policies blocking non-compliant devices from Microsoft 365
Remote and home working endpoints
Remote working expanded the attack surface for most organisations in 2020 and it has stayed expanded. Home networks are not corporate networks: they are shared with family members, run consumer-grade equipment, and often lack the baseline controls present in an office environment.
The zero trust model treats every network as untrusted, including the corporate LAN, and verifies every access request regardless of where it originates. Applied to endpoints, this means:
- Device compliance checked before granting access to any corporate resource, not just at the perimeter
- MFA required for all remote access, not just VPN login
- Conditional Access policies that grant access based on device health, user identity, and location together, not any single factor alone
- Split tunnelling configured carefully on VPN, so corporate traffic routes through the VPN while personal browsing does not, reducing bandwidth load without removing visibility of corporate traffic
You cannot manage an employee’s home router. What you can do is reduce dependence on it: use Zero Trust Network Access (ZTNA) tools rather than traditional VPN, enforce device-based Conditional Access, and ensure sensitive data only reaches fully managed, compliant devices. Remove the home network from the trust model rather than trying to secure it.
Endpoint security and Cyber Essentials
Cyber Essentials and Cyber Essentials Plus assess five technical controls, three of which directly concern endpoints: malware protection, patch management, and secure configuration. Meeting Cyber Essentials is a sensible baseline target for UK organisations, and a requirement for some government contracts.
| Cyber Essentials control | Endpoint requirement |
|---|---|
| Malware protection | Anti-malware software installed and active on all devices; application allowlisting is an accepted alternative |
| Patch management | High and critical patches applied within 14 days; unsupported software removed |
| Secure configuration | Unnecessary software and features removed; default passwords changed; auto-run disabled |
| Access control | Standard user accounts for day-to-day use; admin rights only where required for specific tasks |
| Boundary firewalls and internet gateways | Host-based firewall enabled on all devices, not just the perimeter firewall |
Cyber Essentials Plus adds independent technical verification: an assessor tests a sample of your devices to confirm the controls are working, not just documented. A cybersecurity risk assessment helps identify gaps before you enter the formal assessment process.
Endpoint security baseline checklist
| Control | Status to achieve |
|---|---|
| EDR deployed | Installed and active on all Windows, macOS, and Linux devices; alerts monitored |
| Patch management | Automated deployment; critical and high patches applied within 14 days; third-party apps included |
| Full-disk encryption | BitLocker (Windows) or FileVault (macOS) enabled on all devices; recovery keys escrowed centrally |
| MDM enrolment | All company-owned devices enrolled; BYOD covered by MAM at minimum |
| Admin rights restricted | Standard user accounts for day-to-day use; admin access granted per-task only |
| Software installation restricted | Standard users cannot install software without approval |
| Host-based firewall | Enabled on all devices; default-deny inbound |
| Screen lock | Enforced after 5 minutes maximum; PIN or biometric required |
| Unsupported software removed | End-of-life OS versions and applications removed or replaced |
| Device compliance via Conditional Access | Non-compliant devices blocked from Microsoft 365 and other corporate services |
| Remote wipe tested | Process confirmed and tested before device is given to user |
| Encryption status reporting | Automated reporting via MDM; not self-reported |
Ryland has delivered cybersecurity, compliance, and IT management programmes for regulated organisations across the UK and the Netherlands for over 20 years. View full profile