Endpoint security is the set of products that protect and manage a company's laptops, desktops, phones and servers. These devices are called endpoints, because they are where the network ends and a person or a program begins. Most attacks finally succeed or fail on an endpoint.
Imagine an architect who joins a design firm in Chandigarh and receives a new laptop. It arrives sealed from the supplier. When she turns it on and signs in, unified endpoint management (UEM) enrols it with the firm. UEM installs the firm's apps and settings. It encrypts the disk, so that a stolen laptop reveals nothing. It also installs a small security program that she cannot remove. That program is called an endpoint agent.
The agent belongs to endpoint detection and response (EDR). It records every program that starts, every file that is written and every network connection. If a program starts to behave like ransomware, which locks files and demands money to unlock them, EDR stops the program and cuts the laptop off from the network.
Many successful attacks use a known flaw that the software maker has already fixed. The fix is called a patch. Patch management installs patches on every device, the most dangerous flaws first. Each publicly listed flaw has a CVE number.
Her phone is a different case. It is her own phone, and the firm does not control it. Mobile threat defence checks the phone for harmful apps, fake links and unsafe Wi-Fi, without reading her personal data. If the phone is at risk, the firm's email stops opening on it until the problem is fixed.
Two other parts of a company's security depend on the endpoint. EDR sends its alerts to the security operations centre (SOC), where analysts decide what to do. And network security tools, such as zero trust network access (ZTNA), check each device's health before it may connect to company apps.