Contact

Endpoint Security

Cybersecurity area

Endpoint Security

Endpoint Security protects workstations, servers, mobile devices, and other endpoints where users, data, and attacks often meet first.

Thematic hero image for the Endpoint Security area

Acronym Glossary

This glossary explains acronyms used in this part so the intended security function is clear.

EPP
Endpoint Protection PlatformThe core preventive endpoint security layer covering modern antivirus, antimalware, behavioral protection, and central policy management.
EDR
Endpoint Detection and ResponseDetection, investigation, and response for suspicious behavior on endpoints and servers.
XDR
Extended Detection and ResponseExtended detection and response across multiple sources such as endpoint, email, identity, cloud, and network.

What This Area Covers

Endpoint Security covers the devices on which users and systems actually work: notebooks, workstations, servers, mobile devices, and specialized endpoints. These devices face phishing, malicious attachments, exploited vulnerabilities, unauthorized applications, stolen devices, lateral movement, and ransomware scenarios.

Why It Matters

Modern endpoint protection must combine prevention, detection, and response, but these layers should not be mixed together. EPP is the foundation for blocking malware, malicious behavior, and risky activity directly on the device. EDR adds endpoint telemetry, investigation, isolation, and response. XDR then expands detection and correlation beyond the endpoint into the broader organizational context.

How To Navigate This Area

Endpoint protection has a clear sequence. The foundation is EPP, a preventive layer with modern antimalware, behavioral detection, and central policy. EDR follows as the detection, investigation, and response layer on the endpoint. XDR is the next layer, extending endpoint context with signals from email, identity, cloud, network, and security operations. It is practical to separate prevention, detection, broader correlation, encryption, host firewall, and application control.

When selecting endpoint technology, the organization should assess whether it first needs a reliable EPP prevention layer, then EDR analytics and response, or already a mature XDR architecture for correlating multiple signals. Some environments need low operational effort and strong automatic protection. Others need forensics, device isolation, threat hunting, application control, encryption, or strong data protection if a device is lost.

The technology list below works as a map of the Endpoint Security area. The practical sequence is to name the security problem first, select the closest technology category second, and only then compare relevant vendors. This helps separate similar-sounding solutions and reduces the risk of adding another tool without a clear architectural role.

Technical Section Schema

Technical schema for the Endpoint Security area
The schema shows the main inputs, security layers, and outputs of the Endpoint Security area.

Questions To Ask When Selecting A Solution

  • Which device types and operating systems must be covered?
  • Is the priority foundational EPP prevention, EDR endpoint detection, or broader XDR correlation?
  • Does the organization have an internal team that can work with EDR or XDR data?
  • How does endpoint telemetry connect with identity, email, cloud, and SOC processes?
  • Is it also necessary to cover disk encryption, removable media, and application control?

How To Use This Section

Each technology page expands one category, explains its architectural role, and lists SecTec portfolio vendors related to that area. The section page is therefore the orientation layer, while the detail pages support concrete mapping to solutions.

Vendors From The SecTec Portfolio

Attack coverage and defensive context

MITRE ATT&CK® Enterprise version 19.1 is used as a reference model. The mapping is a SecTec expert interpretation and does not imply endorsement by MITRE.

Practical attack scenarios

  • Phishing and identity abuseAn adversary manipulates a user, obtains credentials, or abuses a trusted account to gain access to the environment.
  • Credential theftAn adversary obtains passwords, tokens, sessions, or other authentication material and uses it to expand access.
  • Public application or API abuseAn adversary exploits a vulnerable web application, API, client-side code, or software component for initial access and execution.
  • Cloud and SaaS compromiseAn adversary abuses cloud identities, permissions, configurations, or application integrations to access services and data.
  • Lateral movement inside the networkAfter initial access, an adversary discovers systems, accounts, and services and moves toward higher-value assets.
  • Malware and Command and ControlMalicious code executes, maintains access, and communicates with adversary infrastructure through common or covert channels.
  • Data exfiltration and leakageAn adversary searches for, collects, and transfers sensitive data from endpoints, cloud services, email, or internal repositories.
  • Ransomware and availability impactAn adversary encrypts or manipulates data, stops services, inhibits recovery, and creates operational impact.
  • Attacks on OT and IoT environmentsAn adversary discovers industrial or connected devices, abuses remote access and network services, and threatens operational availability.
  • Privilege escalation and persistenceAn adversary expands privileges, creates or modifies accounts and policies, and establishes repeatable access to systems, identities, or cloud environments.
  • Defense evasion and control impairmentAn adversary hides activity, removes evidence, disguises code, or weakens security tools, encryption, firewalls, and recovery mechanisms.
  • Insider threat and authorized access abuseAn insider or an adversary with a valid account abuses legitimate permissions to discover, copy, manipulate, or transfer sensitive data.
  • DDoS and resource exhaustionAn adversary floods a network, application, API, or endpoint and exhausts capacity, connections, or compute resources to reduce service availability.
  • Injection and command executionUntrusted input changes the meaning of a command, query, or template and enables data access, logic bypass, or code execution.
  • Path traversal and file inclusionAn adversary manipulates a file path or imported name and reads, writes, or executes content outside the permitted directory.
  • Malicious file upload and unsafe deserializationAn application accepts or processes a malicious file or serialized object and enables code execution, control bypass, or compromise of other users.

Relevant ATT&CK techniques

Facebook Twitter Linkedin Youtube
Contact