What is an endpoint? Endpoint security explained for small businesses
By Jera IT
Originally published July 2021. Refreshed November 2026: staff now work from home and on the move, and basic antivirus has given way to tools that spot and stop an attack in progress, so we've rewritten this guide for both.
Every laptop, phone and tablet your team uses is a door into your business. Most cyber attacks don’t break in through some clever back route; they walk through one of those doors. Securing them is called endpoint security, and in our view it’s where most of your protection budget belongs.
The short answer: an endpoint is any device that connects to your business systems or data. Endpoint security means keeping every one of them updated, encrypted, monitored and under your control.
What is an endpoint?
An endpoint is any device at the end of a network connection that people use to reach your data:
- Laptops and desktop PCs are the obvious ones.
- Phones and tablets count too, whether company-owned or personal ones used for work email and Teams.
- Servers count, in the office or in the cloud.
- Connected devices such as printers, meeting-room screens and cameras count as well.
If it can reach your company data, it’s an endpoint. With hybrid working, most of them now spend a lot of their time outside the office, on home broadband and public Wi-Fi.
The main endpoint security threats
- Phishing. One click on a convincing email can install malware or hand over a login. See phishing email examples.
- Unpatched software. Attackers exploit known weaknesses in out-of-date Windows, browsers and apps; the NCSC says the gap between a flaw being published and attackers using it has shrunk to days (NCSC).
- Ransomware. It encrypts files on the device and spreads to anything it can reach.
- Lost and stolen devices. A laptop left on a train is only a breach if it isn’t encrypted and can’t be wiped.
- Risky downloads and extensions. Some look useful and quietly steal data.
- Unmanaged personal devices. A personal phone reading company email with no PIN leaves you no way to remove the data.
Antivirus vs EDR vs MDR
| What it does | Good for | |
|---|---|---|
| Antivirus | Blocks known malicious files | A basic minimum, no longer enough on its own |
| EDR (endpoint detection and response) | Watches behaviour, spots suspicious activity, isolates the device and rolls back damage | Stopping attacks that antivirus misses, such as ransomware and stolen logins |
| MDR (managed detection and response) | EDR plus a security team watching the alerts around the clock | Businesses without their own security team (most SMEs) |
Microsoft’s own EDR, Defender for Business, is included in Microsoft 365 Business Premium (Microsoft), so many businesses already pay for more protection than they’re using. For more on where antivirus fits, see the advantages of antivirus software.
What every company device needs
- Automatic updates keep the operating system, browsers and apps current, checked centrally.
- Encryption of the drive keeps a lost device from becoming lost data. See what is encryption.
- EDR watches the device, ideally monitored for you (MDR).
- Multi-factor authentication protects every account the device signs in to.
- Central management lets IT enforce settings and lock or wipe a device remotely.
- Least privilege means staff use standard accounts day to day, not administrator accounts. It costs a little convenience: staff ask IT before installing software.
- Rules for personal devices keep company data in managed apps that can be wiped without touching personal photos and messages.
These are also the core of Cyber Essentials, the minimum standard of cyber security the UK government recommends (NCSC), and one many clients and insurers now ask for.
What has changed since we first wrote this
- Endpoints left the building. Home working means devices are rarely behind the office firewall, so the protection has to travel with the device.
- Attacks are faster and more automated. The NCSC expects AI to make attacks more frequent and to shorten the time between a flaw being published and attackers using it (NCSC, May 2025), which is why behaviour-based detection and quick patching matter.
- Stolen logins matter as much as malware. A stolen login can do as much damage as malware, so endpoint security now goes hand in hand with multi-factor authentication and sign-in monitoring.
- You may already own the tools. Microsoft 365 Business Premium includes Defender for Business, so check what you pay for before you buy anything new.
Where an AI agent helps
Monitoring is where most small businesses fall short:
- The AI Security-Monitoring Agent ↗ watches for threats around the clock and raises the alarm.
See all our agents in the solutions library on jerait.ai ↗, or find the right agent for your business on jerait.ai ↗.
The catch: the AI an agent runs on is paid for by use. With Jera IT support, your first agent is built, supported and maintained free; we give you a rough idea of the usage cost before you commit, and a real figure from the trial.
How Jera can help
We manage and secure our clients’ devices from one place, for businesses across Edinburgh, Glasgow and Aberdeenshire, with security monitoring around the clock by an external security operations centre. If you’re on Business Premium, book a call and ask us how much of the protection you already pay for is switched on.
Frequently asked questions
What is an endpoint?
An endpoint is any device at the 'end' of a network connection that people use to access data or systems: laptops, desktop PCs, phones, tablets and servers, plus connected devices like printers. If it can reach your company data, it's an endpoint.
What is endpoint security?
Endpoint security is the protection applied to each of those devices: keeping them updated, encrypted and monitored, blocking malware, and being able to lock or wipe them remotely if they're lost or compromised.
What are the main endpoint security threats?
Phishing that installs malware or steals logins, unpatched software with known weaknesses, ransomware, lost or stolen devices, risky downloads and browser extensions, and personal devices accessing company data without any controls.
What is the difference between antivirus and EDR?
Antivirus mainly blocks known malicious files. Endpoint detection and response (EDR) watches how a device behaves, spots suspicious activity such as a program suddenly encrypting files, and can isolate the device and stop the attack. With MDR, a security team watches those alerts for you.
Are phones endpoints?
Yes. If a phone receives company email or Teams messages, or opens company files, it's an endpoint and needs protecting, including on personal phones used for work.
Sources
- What is Microsoft Defender for Business?, Microsoft
- Cyber Essentials overview, National Cyber Security Centre
- Impact of AI on cyber threat from now to 2027, National Cyber Security Centre
