Every laptop, desktop, phone, tablet and server that touches your business data is an endpoint, and each one is a door into your network. Phishing emails are opened on endpoints, ransomware runs on endpoints, and stolen laptops carry customer data out the door. Moving email and files to the cloud does not change that: Microsoft's shared responsibility model lists the client devices that access cloud services among the responsibilities that always stay with the customer, along with data, accounts and access management.
Endpoint security is a set of habits more than a single product. This guide covers the practical steps a small or mid-sized business can take, how to prioritize them, and how endpoint controls connect to your cyber insurance.
Start with an inventory
You cannot protect devices you do not know about. The Cybersecurity and Infrastructure Security Agency (CISA) lists an asset inventory among its Cross-Sector Cybersecurity Performance Goals, recommending a list of IT assets with IP addresses that is updated no less than monthly. For a small business, a spreadsheet or the device list in your management tool is a fine start.
- Record each device with its owner, operating system and version, location, and whether it holds sensitive data.
- Include the easy-to-miss items: point-of-sale terminals, shop-floor PCs, the old server in the closet, tablets used in the field and networked printers.
- Decide your position on personal devices. If employees use their own phones or computers for work email or files, set minimum requirements such as a screen lock, current updates and the ability to remove company data.
- Track the lifecycle. Note purchase dates and end-of-support dates so replacements can be budgeted before support runs out.
Patch quickly and retire unsupported systems
Attackers routinely exploit vulnerabilities for which a fix already exists. Turn on automatic updates for operating systems, browsers and common applications, and have someone confirm monthly that devices actually installed them. CISA maintains a Known Exploited Vulnerabilities catalog of flaws that attackers are actively using, and its performance goals recommend patching or otherwise mitigating those vulnerabilities on internet-facing systems first, within a risk-informed span of time, with critical assets at the front of the line.
Windows 10 is past end of support. Microsoft ended support for Windows 10 on October 14, 2025, which means no further security fixes for unenrolled PCs. Organizations can buy Extended Security Updates for up to three years after end of support. Microsoft lists the first year at $61 per device through volume licensing, with the price doubling each consecutive year, and purchases are cumulative, so joining late means paying for the earlier years too. Extended updates are a bridge to replacement, not a long-term plan.
The same thinking applies to network equipment, firewalls and any software the vendor no longer updates. If a system cannot be replaced right away, isolate it from the internet and from the rest of the network, and limit who can use it.
Harden the device itself
A well-configured device stops many attacks before security software has to. These settings are inexpensive and widely available:
No everyday admin rights
Staff should work from standard accounts. The CIS Controls call for restricting administrator privileges to dedicated administrator accounts and doing email, browsing and productivity work from a non-privileged account. See our guide to privileged access management.
Full-disk encryption
Turn on the built-in encryption for laptops and phones. It protects data if a device is lost or stolen, and it can change whether a loss becomes a reportable breach.
Change default passwords
CISA's goals call for changing manufacturer default passwords before devices join the network. This matters for printers, cameras, routers and point-of-sale hardware.
Lock screens and limit software
Require automatic screen locks, remove software no one uses, and limit who can install new applications.
Pair device controls with strong sign-in. Multi-factor authentication on email, remote access and administrator accounts blocks most attacks that rely on stolen passwords. Our article on multi-factor authentication covers the options.
Detect and respond, not just prevent
Traditional antivirus looks for known malicious files. Endpoint detection and response (EDR) tools watch for suspicious behavior, such as a program encrypting large numbers of files or a script disabling security settings, and let an administrator isolate a device from the network remotely. Managed detection and response (MDR) adds a service provider that monitors alerts around the clock, which is often more realistic for a business without its own security team.
- Deploy security software to every device in your inventory, and alert when a device stops reporting.
- Collect security logs centrally. CISA's goals recommend collecting access and security logs and alerting when a critical log source is disabled.
- Decide in advance who receives alerts after hours and who has authority to isolate a device or shut down a system.
- Review the console weekly for devices that are missing, out of date or showing repeated detections.
Plan for the bad day: backups and lost devices
Even good controls fail sometimes. CISA's ransomware guidance recommends maintaining offline, encrypted backups of data and regularly testing them, because many ransomware variants try to find and delete any backups they can reach. Keep current images or build instructions for critical systems so a damaged device can be rebuilt quickly. Our article on data backup strategies covers the 3-2-1 approach.
For lost or stolen devices, encryption does a lot of work. Under Washington's data breach notification law, as the Attorney General explains it, notice is not required when compromised personal information is encrypted or otherwise unreadable, unless the encryption key or credential was also compromised. Have a simple procedure: employees report a lost device immediately, IT disables its accounts and wipes it remotely, and someone documents what data was on it. If personal information may be involved, follow your incident response plan and see our guide to breach notification.
Mobile and remote devices
Phones and home-office laptops sit outside the office network and its protections. A mobile device management (MDM) tool lets you require a passcode and encryption, push updates, separate business apps from personal ones and wipe company data when an employee leaves or loses a device. Remote workers should connect through secure, company-approved methods, keep home routers updated and avoid sharing work devices with family members. Our guide to remote work security goes further.
| Priority | Control | Why it matters |
|---|---|---|
| 1 | Inventory and automatic updates | Closes known holes on every device you own |
| 2 | MFA and no everyday admin rights | Stops stolen passwords and limits what malware can do |
| 3 | Encryption and remote wipe | Protects data on lost and stolen devices |
| 4 | EDR or MDR with alerting | Catches attacks that get past prevention |
| 5 | Offline, tested backups | Lets you recover without paying a ransom |
How endpoint security connects to your insurance
Cyber insurers look closely at endpoint controls. Applications commonly ask about multi-factor authentication, EDR, patching practices, backups and unsupported systems, and the answers can affect eligibility, pricing and terms. Answer accurately and keep the application current, because insurers rely on those answers and an inaccurate application can create problems at claim time.
A cyber liability policy typically helps pay for incident response, forensic investigation, data restoration, business interruption, extortion and liability to others after a covered event, subject to the policy's terms, limits and retentions. Gaps to ask about:
- Hardware replacement. Some policies cover replacing devices that malware makes unusable, sometimes called "bricking," but often only by endorsement or with a sublimit.
- Stolen devices. The physical laptop is usually a property claim, while the data on it is a cyber matter. Make sure both are addressed.
- Personal devices. Check how the policy defines your computer system and whether employee-owned devices are included.
- Vendor requirements. Many policies require you to use the insurer's approved response vendors and to notify the insurer before incurring costs.
When to call your broker
Call us before you complete a cyber insurance application, when you replace or retire a large group of devices, when you move to a managed security provider, or right away if you suspect a compromise. As a broker, we compare options across the market, help you present your controls accurately, and shape cyber coverage around how your business actually uses technology.
Sources
- CISA — Cross-Sector Cybersecurity Performance Goals
- Microsoft Learn — Extended Security Updates (ESU) program for Windows 10
- Microsoft Learn — Shared responsibility in the cloud
- Center for Internet Security — CIS Control 5: Account Management (Controls v8.1)
- CISA and MS-ISAC — Ransomware Guide
- Washington State Office of the Attorney General — Washington's data breach notification laws