Controls
What is endpoint protection?
Endpoint protection is security software deployed on laptops, desktops, servers and mobile devices to prevent, detect and respond to malicious activity. Traditional endpoint protection platforms (EPP) block known malware using signatures and heuristics; endpoint detection and response (EDR) adds behavioural analysis, recording of system activity, and the ability to investigate and isolate a compromised device.
At a glance
- EPP
- Prevention — signature and heuristic malware blocking
- EDR
- Detection, investigation and response, with activity telemetry
- MDR
- EDR plus a human team monitoring and responding, usually 24/7
- XDR
- Correlation across endpoint, email, identity and cloud signals
- Cyber Essentials
- Malware protection is one of the five required controls
Why signatures alone are insufficient
Signature-based detection matches files against a database of known malware. It remains useful and cheap, but it cannot identify a payload it has not seen, and much modern intrusion activity involves no malicious file at all.
Attackers routinely use legitimate administrative tools already present on the system — PowerShell, WMI, remote management utilities — a technique called living off the land. Nothing malicious is written to disk, so there is nothing for a signature to match. Behavioural detection identifies the pattern of activity instead: credential dumping, unusual process chains, mass file encryption, disabling of security tooling.
What EDR adds
EDR is distinguished by visibility and the ability to act, not simply block.
- Continuous recording of process execution, network connections and file changes, retained for investigation.
- Behavioural detection rules mapped to known attacker techniques.
- Remote isolation of a device from the network while preserving investigator access.
- Rollback of malicious changes on some platforms.
- Forensic timeline reconstruction showing how an intrusion began and what it touched.
The monitoring gap
EDR generates alerts; it does not interpret them. An SME that deploys EDR without arranging monitoring receives detections into a console nobody reviews, and ransomware deployment is deliberately timed for evenings, weekends and holidays.
Managed detection and response (MDR) addresses this by adding an analyst team, usually operating 24/7, who triage alerts, investigate and take containment action within an agreed mandate. For most small organisations the monitoring, rather than the software licence, is what converts detection into prevention of serious impact.
Sources
The definitions and figures on this page are drawn from the primary sources below. Where guidance changes, the source takes precedence over our summary of it.
- Device Security Guidance — National Cyber Security Centre
- Cyber Essentials Requirements for IT Infrastructure — IASME Consortium
- NIST SP 800-83: Guide to Malware Incident Prevention and Handling — National Institute of Standards and Technology
FAQ
What is endpoint protection — common questions
Direct answers to the questions asked most often about this topic.
What is the difference between antivirus and EDR?
+
Antivirus is preventative and file-focused: it compares files against known malware signatures and heuristics and blocks matches. EDR assumes some attacks will evade prevention, so it continuously records what happens on the device — processes launched, connections made, files modified — and applies behavioural detection to spot attacker techniques rather than specific files. It also provides response capability: isolating a device from the network, terminating processes, and reconstructing a forensic timeline. Most EDR products include antivirus functionality, so EDR generally replaces standalone antivirus rather than running alongside it.
Is Microsoft Defender sufficient as endpoint protection?
+
Microsoft Defender Antivirus, included with Windows, performs comparably with commercial antivirus products in independent testing and is a reasonable baseline. Defender for Business, included in Microsoft 365 Business Premium, adds genuine EDR capability with behavioural detection, investigation and device isolation. The limitation is not the technology but the operating model: it generates alerts into a console that requires someone competent to review them, and attacks are frequently timed for nights and weekends. For organisations without security staff, Defender for Business combined with a managed monitoring service is usually the practical arrangement.
Does endpoint protection cover mobile phones and Macs?
+
Most current EDR platforms support macOS, iOS, Android and Linux as well as Windows, though capability is not equal across them. Windows agents generally offer the deepest telemetry and response options; macOS support is now solid; mobile support is typically narrower, focusing on malicious app detection, network protection and device compliance rather than full process recording. Since Cyber Essentials brings any device accessing organisational data into scope — including staff-owned phones — organisations should confirm what their platform actually covers on each operating system rather than assuming parity.
How much does EDR or MDR cost for a small business?
+
EDR licensing for SMEs commonly sits in the region of a few pounds per device per month, and is included at no additional cost for organisations already licensed for Microsoft 365 Business Premium through Defender for Business. Managed detection and response, which adds a human analyst team and 24/7 coverage, is priced considerably higher — often between roughly ten and thirty pounds per user or device per month depending on scope, response mandate and whether log sources beyond the endpoint are included. The cost difference reflects staffed hours rather than software.
Can endpoint protection be bypassed?
+
Yes. Attackers routinely attempt to disable or tamper with security agents as an early step, use legitimate system tools that generate no malicious file, or operate through stolen credentials on systems where nothing needs to be installed at all. Tamper protection, which prevents the agent being stopped even by a local administrator, is an important setting and is not always enabled by default. The broader implication is that endpoint protection is one layer: it works alongside multi-factor authentication, email filtering, patching, privilege restriction and monitored detection rather than replacing them.
