An endpoint is a device that connects to a network and sends or receives data on it: laptops, desktops, smartphones, tablets, servers, virtual machines and cloud workloads, and connected devices such as point-of-sale terminals, printers, cameras and sensors. In IT and security, endpoints are where people and applications actually touch company data, which makes them both the main tools of daily work and one common place attacks begin or execute.
At a glance
- Endpoints include user devices, servers (physical, virtual and cloud), and IoT and operational devices.
- Each endpoint needs to be known, managed, patched and protected; unknown devices are the hardest to defend.
- Endpoints are one common place attacks begin or execute; others start with stolen identities, email, SaaS accounts or exposed remote services.
- Protection usually layers management (UEM or MDM), prevention (EPP) and detection and response (EDR), with network controls for devices that can’t run agents.
- Remote work and personal devices mean many endpoints rarely or never touch the office network.
What problem it solves
Defining and counting endpoints is the starting point for both IT management and security. A company can’t patch, protect or monitor a device it doesn’t know about, and each laptop, phone or server with access to company systems is a potential way in.
Endpoints are one common place attacks begin or execute. Phishing emails are opened on user devices, malware runs on them, and ransomware can spread from a compromised endpoint to servers and backups. Other attacks start elsewhere, with stolen identities, email or SaaS account takeover, or exposed remote access services, and may reach endpoints later or not at all, so endpoint controls are one layer among several. Endpoints also hold data, cached credentials and access tokens that attackers can reuse. Treating endpoints as a managed population, rather than individual machines, is how organizations reduce that risk while keeping people productive wherever they work.
How it works
Inventory. IT tracks every device that can reach company resources, its owner, operating system, software and health. Management and security tools, identity platforms and network scans all contribute.
Management. Unified endpoint management (UEM) or mobile device management (MDM) tools enroll devices, apply configuration and encryption, deploy software and handle patch management. For personal devices, policies often protect only company apps and data.
Prevention. An endpoint protection platform (EPP) blocks known and likely threats using antivirus, exploit prevention, device control and host firewalls.
Detection and response. Endpoint detection and response (EDR) records process, file and network activity, flags suspicious behavior and lets analysts isolate a device or stop a process. Extended detection and response (XDR) correlates that data with other sources such as identity and email.
Devices that can’t run agents. Printers, cameras and many IoT devices are protected through inventory, firmware updates, credential hygiene and network segmentation.
When it matters for buyers
- When hybrid work grows. Devices on home and public networks need management and protection that works without the office network.
- When cyber insurance renews. Insurers commonly ask about EDR coverage, patching and multi-factor authentication on endpoints.
- When evaluating EDR, MDR or XDR. Pricing is usually per endpoint, so an accurate count, including servers, matters.
- When compliance applies. Frameworks such as HIPAA, PCI DSS and GDPR include safeguards that may apply to devices handling covered data; which ones apply depends on your data and obligations, so confirm with your compliance team or counsel.
- When adding IoT or operational devices. These often can’t run security agents and need a different approach.
For a comparison of endpoint-focused and broader detection tools, see EDR vs XDR. Our endpoint detection and response overview covers how to choose and buy endpoint security.
Questions to ask vendors
- Which operating systems and device types do you support, including servers, mobile and virtual desktops?
- Is pricing per device, per user or per server, and how are short-lived cloud workloads counted?
- How do you find and report devices that don’t have your agent installed?
- What can your tool do on a device without user involvement: isolate, roll back, remove files?
- How does your product work alongside our existing management and security tools?
- What visibility do we get into devices that are offline or off the corporate network?
How it differs from an API endpoint
In software development, an “endpoint” also means an API endpoint: a specific web address, such as a URL path, where an application accepts requests. That is a location in an application, not a device. Security teams protect API endpoints with API gateways, authentication and web application and API protection tools, while endpoint security in the sense used here protects the devices and workloads people and systems run on. Context usually makes the meaning clear: “endpoint protection”, “endpoint management” and per-endpoint pricing refer to devices.
Problems this helps with
- Don't know how many laptops and phones can reach company data
- Remote staff on devices we never see on the office network
- Worried one compromised laptop could spread ransomware across the company
- Cyber insurer asking how we protect and monitor devices
