What Endpoint Security Is
Written by MSP Outpost.
In Short
Endpoint security is the software on every laptop and server that stops malware, spots an attacker at work and lets you isolate the machine. It ranges from EDR, which detects and records, to MDR, where a security team watches the alerts and acts on them for you. Plain antivirus blocks what it already knows about, and EDR and MDR exist to catch what it does not.
What It Does
- Prevention. Blocks known malware and suspicious behavior before it runs.
- Detection and response. Records what happens on each machine so an attack can be seen, traced and stopped.
- Isolation. Cuts a compromised machine off the network with one action while keeping it reachable for cleanup.
- Managed response. With MDR, a security team triages alerts around the clock and acts or calls you.
- Application control. Some allow only approved software to run, which stops a lot of attacks outright.
- Reporting. Per-client summaries of threats stopped and incidents handled, for reviews and insurers.
When You Need One
You need it from the first client. With nobody free to watch alerts at night, an MDR service or an EDR with a managed option is usually the safer buy than a console you have to monitor yourself.
Alert volume grows with every client. Check that the product's alerts are few and useful, and decide clearly who answers them out of hours.
You may run your own security desk or keep paying for one. Either way, settle how incidents are handed to you, how fast, and what the vendor will do without asking.
What to Look For
Must Have
- Behavioural Detection
- Remote Isolation
- Multi-Tenant Console
- Tamper Protection
- Out-of-Hours Coverage
- RMM Deployment
Worth Having
- Application Allowlisting
- Rollback After Ransomware
- Identity Threat Detection
- PSA Ticket Integration
- Client-Facing Reports
How It Is Priced
Endpoint security is almost always priced per endpoint, monthly or annually, and many vendors only quote on request. Watch for minimum endpoint counts and twelve-month terms, managed response sold as a separate tier on top of the agent, and servers priced higher than workstations.
Switching
The agent itself is easy to swap through your RMM, but the old one has to be removed cleanly and some resist uninstalling. The harder part is the process around it: who gets called, what the vendor may do on its own, and how incidents reach your tickets. Settle the term, the removal method and how you get incident history out before you sign.
Questions to Ask a Vendor
- Who actually watches the alerts at night and at weekends, your staff or a partner?
- What will your team do on a machine without asking me first, and can I change that?
- How many alerts does a typical client generate a month that need my action?
- What is the minimum endpoint count and term, and can the count go down mid-term?
- Is the managed response included, or priced on top of the agent?
- How do I uninstall the agent at scale if I leave, and do you provide the tool?
