Article · Endpoint security
How endpoint security works, from antivirus to detection and response
Laptops, desktops and servers are where most attacks eventually land. Understanding what endpoint security software does, what it records and where it stops helps you buy the right protection and set realistic expectations.
- Published
- 7 min read
On this page
Key takeaways
- Traditional antivirus blocks known malicious files; modern next-generation antivirus adds behaviour analysis and cloud lookups.
- Endpoint detection and response (EDR) records detailed activity on each device so suspicious behaviour can be detected, investigated and contained.
- Isolation lets a responder cut a compromised device off from the network while keeping it reachable for investigation.
- Patching, encryption, removal of admin rights and attack surface reduction prevent many incidents before detection is ever needed.
- EDR is only as good as its coverage and the people reviewing its alerts; unmanaged devices and stolen cloud identities sit outside its view.
What counts as an endpoint, and why it matters
An endpoint is any device that connects to your network or cloud services and runs software on behalf of a user or a business process: Windows and macOS laptops, desktops, servers, and increasingly phones and tablets. Endpoints are where people open attachments, run installers, type passwords and store files, so they are where ransomware encrypts data and where attackers establish a foothold.
Endpoint security is not a single product. It is a layered set of controls that try to prevent malicious code from running, detect it when prevention fails, and give someone the tools to respond quickly. Knowing which layer does what helps you see gaps.
Antivirus, next-generation antivirus and EDR
These terms are often used interchangeably in marketing. They describe different capabilities.
Signature-based antivirus
Compares files against a database of known malware fingerprints. It is fast and reliable for known threats, but new or modified malware, and attacks that use legitimate tools, can slip past.
Next-generation antivirus
Adds machine-learning models, behaviour monitoring, exploit protection and real-time cloud reputation checks. It can block suspicious files and actions it has never seen before. Microsoft Defender Antivirus, built into Windows, works this way when cloud-delivered protection is enabled.
Endpoint detection and response
Continuously records what happens on the device and sends that telemetry to a cloud console, where detection logic looks for attacker behaviour. It supports investigation and response actions. Microsoft Defender for Business and Defender for Endpoint include EDR capabilities.
Extended detection and response
XDR correlates endpoint signals with identity, email and cloud application signals, so an attack that starts with a phishing email and ends on a laptop can be seen as one incident.
What EDR telemetry records
An EDR agent watches events at the operating system level: process creation and the command lines used, parent and child process relationships, file creation and modification, registry changes, network connections, script execution, driver loads, logons and memory techniques associated with credential theft. Individually these events are mundane. Together they form a timeline.
Detection logic looks for patterns rather than files. A word processor spawning PowerShell that downloads content from the internet, a backup utility being stopped and shadow copies deleted, or a tool reading credential memory are all suspicious regardless of whether any known malware file is present. This is how EDR catches attackers who use built-in administrative tools, a technique often called living off the land.
Telemetry also matters after the fact. When an alert fires, a responder can follow the process tree back to the email attachment or download that started it, see which other devices communicated with the same address, and decide how far the incident reaches.
What happens when something is detected
Detection is only useful if it leads to a timely, proportionate response. A typical flow looks like this.
Alert and triage
The platform raises an alert with severity and context. Automated investigation may run, and a person reviews whether it is malicious, benign or needs more information.
Contain
If the activity is malicious, the responder can kill the process, quarantine the file, or isolate the device. Isolation blocks network traffic except the connection to the security console, stopping spread while keeping the device available for investigation.
Investigate scope
The responder checks the timeline, looks for the same indicators on other devices, and reviews identity sign-ins in case credentials were captured.
Remediate
Remove persistence, reset affected credentials and revoke sessions, patch the weakness that was exploited, and reimage the device if trust cannot be restored.
Learn
Record what happened, tune detections and exclusions, and close the gap, whether that is a missing patch, an unnecessary admin right or a user training need.
Prevention layers that reduce how often detection is needed
Detection and response tools work best on devices that are already hardened. These controls remove many attack paths outright.
- Patch operating systems, browsers and common applications promptly, prioritizing vulnerabilities that are known to be actively exploited.
- Remove local administrator rights from everyday accounts and use a managed local administrator password solution such as Windows LAPS.
- Enable attack surface reduction rules, for example blocking Office applications from creating child processes, in audit mode first and then enforce.
- Turn on tamper protection so attackers or well-meaning users cannot disable the security agent.
- Encrypt disks with BitLocker or FileVault so a lost or stolen device does not expose data.
- Use application control or at least block unsigned scripts and common abuse of tools such as remote access software.
- Keep the host firewall on and restrict inbound remote access such as RDP to the people and networks that need it.
The limits you should plan around
Endpoint security only protects devices that run the agent. Personal computers, unmanaged contractor laptops, network appliances, printers and many IoT devices are invisible to it. An asset inventory and onboarding checks are part of endpoint security, not a separate concern.
It also does not see everything that happens in the cloud. If an attacker phishes a password and session token and then reads mail in a browser on their own machine, there may be no malicious activity on your endpoints at all. Identity protections, Conditional Access and email security close that gap.
Alerts need people. A console full of unreviewed alerts provides little protection, and overly broad exclusions added to stop false positives can create blind spots. Agree who reviews alerts, during which hours, and what they are authorized to do, such as isolating a device without waiting for approval.
Finally, determined attackers actively try to disable security tools, sometimes with vulnerable signed drivers. Tamper protection, rapid patching and keeping the agent current reduce that risk but do not remove it, which is why backups and an incident plan remain essential.
Choosing protection for a small business
For many Microsoft 365 organizations, Defender for Business, included in Business Premium, provides next-generation antivirus and EDR managed from the same portal as the rest of the tenant. Whatever product you choose, confirm it covers every platform you use, that tamper protection is on, and that someone is responsible for reviewing alerts.
Frequently asked questions
Is the antivirus built into Windows good enough?
Microsoft Defender Antivirus is a capable next-generation antivirus when cloud protection and tamper protection are enabled. On its own it does not provide EDR investigation and response features, which come with Defender for Business, Defender for Endpoint or a comparable product.
Does EDR slow computers down?
Modern agents are designed to be lightweight, and most users do not notice them in normal use. Problems usually come from running two security products that conflict, so remove legacy antivirus when you deploy a new agent.
If we have EDR, do we still need backups?
Yes. EDR reduces the chance and impact of an attack but cannot reverse every outcome. Hardware failure, accidental deletion and successful ransomware still require tested, protected backups.
Does isolating a device wipe it?
No. Isolation blocks network communication except with the security platform, leaving data and evidence in place. The device is released from isolation once it has been investigated and cleaned.
Related services
Products and packages
Check how well your devices are protected
An endpoint security assessment reviews agent coverage, configuration, patch levels and admin rights across your devices and gives you a prioritized list of improvements.