Endpoint security
What this is
Laptops and servers run code all day. Most of it was approved once and has not been looked at since, and some of it arrived this morning from a mail attachment, a download or a removable drive. Endpoint security is the work of deciding what is allowed to run on those machines, and of being able to show afterwards what did.
Why it matters
An endpoint is the one place where an attacker's code and the organisation's data sit on the same machine at the same moment. Once a file runs there, no network boundary stands between it and everything the logged-in user can reach. Ransomware is the visible version of this, and the expensive part is not the encryption. It is that the encryption is performed by a process holding a real employee's rights, against the files that employee was trusted with.
The difficult part is that the decision has to be made before anything is known. Code nobody has seen before is not evidence of anything, and a product has to act anyway. Refusing everything unrecognised is the correct answer on paper and stops the business in practice, which is why default deny appears in far more security policies than it does in running configurations. Every product in this category is answering that one question. They differ in what they do when the answer is not yet available.
What it solves
- Ransomware running with the rights of the person who opened the file
- Code arriving faster than anyone could review it, from mail, downloads and drives
- Investigations that need to show what ran, in what order, and what it touched
- Buyers required to provide continuous monitoring who have no security team
In our portfolio
Next to this
Secure workspace covers the browser on the same machine. That is a separate surface with separate controls, and neither one reaches into the other. Whether the agent in this area is actually installed and correctly configured on every machine is a different question again, and it sits in exposure and vulnerability.