Endpoint agent

An endpoint agent is a small program installed on each laptop, phone or server, which watches that device and acts on it for a security or IT product. An endpoint is any device at the edge of a company's network, where a person or a program does the work. The word "agent" here only means a program that acts on the product's behalf. It has nothing to do with an AI agent.

Here is how it works in general. The IT team installs the agent on every device, often automatically when the device is first set up. The agent starts each time the device starts and runs in the background with high permissions, so that the user cannot easily stop it. It records events on the device: which programs start, which files are written and which network connections are opened. It sends a summary to the product's console, usually in the cloud. The console sends back rules and instructions. Then the agent acts on the device itself. It can stop a program, cut the device off from the network, install an update or wipe the device.

Only software on the device can see and stop what happens on it. That is why most security and IT products use an agent. It also brings two problems. A laptop running six agents from six products becomes slow, so vendors now try to do several jobs with one agent. And an agent with high permissions can do great harm if it fails. In July 2024, a faulty update to one widely used security agent crashed about 8.5 million Windows computers worldwide, and airline check-in counters in India went back to handwritten boarding passes.

Take, for example, a laptop where a program suddenly starts scrambling hundreds of files. The endpoint detection and response (EDR) agent stops the program and cuts the laptop off from the network.

Consider a sales executive who loses a company phone on a train. Unified endpoint management tells the agent on the phone to wipe the company's data from it.

Say a company's staff complain that their laptops start slowly. A digital employee experience agent measures each start-up, so that IT can find the cause.

How is an agent different from agentless monitoring? Agentless tools check a device from outside, for example by scanning it over the network, or, like cloud security posture management, by reading a cloud account's settings. They need nothing installed, but they see less and cannot act inside the device. Many companies use both.