An EPP brings several preventative controls together into one solution that administrators manage centrally. Each control blocks a different category of threat at the device before it can execute or spread.
The table below summarizes the core capabilities of an endpoint protection platform.
| Capability | What is does |
|---|---|
| Antivirus and anti-malware | Blocks known malware at the point of entry, including signature-based threats |
| Application control | Allows or blocks specific applications from running on the endpoint |
| Device and port control | Governs which external devices and ports can connect to the endpoint |
| Host-based firewall | Filters inbound and outbound traffic at the individual device |
Effective anti-malware protection is the most demanding of these capabilities, because malware can appear harmless at first and change behavior later. To counter that, a modern EPP uses advanced anti-malware techniques:
Detection techniques map against documented adversary behavior catalogued in MITRE ATT&CK.
Even with these capabilities, no EPP can guarantee 100 percent efficacy, which is why an EPP alone is not sufficient endpoint security.
An EPP brings several preventative controls together into one solution that administrators manage centrally. Each control blocks a different category of threat at the device before it can execute or spread.
The table below summarizes the core capabilities of an endpoint protection platform.
An EPP prevents known threats at the point of entry. Endpoint detection and response (EDR) focuses on threats that have already evaded front-line defenses and entered the environment, continuously monitoring endpoints to find, investigate, and contain them. The two are complementary, not interchangeable. The table contrasts them at a capability level; for the full definition of EDR, see the EDR page.
| Capability type | EPP | EDR. |
|---|---|---|
| Primary focus | Prevention at the point of entry | Detection, investigation, and response |
| When it acts | Before a threat executes | After a threat evades prevention |
| Core method | Signature-based and behavioral blocking | Continuous monitoring and analysis of endpoint activity |
| Limitation | Cannot block every threat | Acts after a threat is already inside |
A complete endpoint security program uses both. The EPP reduces the volume of threats that reach the environment; EDR catches what gets through.
An EPP is an integrated security solution that combines a personal firewall, port and device control, and anti-malware to block known threats at the endpoint. It focuses on prevention, stopping threats at the point of entry on devices such as laptops, servers, and mobile devices.
An EPP prevents known threats at the point of entry, while EDR continuously monitors endpoints to detect and respond to threats that evade prevention. The two work together: an EPP blocks what it can, and EDR catches what gets through. See the EDR page for full detail.
An EPP can be described as a traditional antivirus solution, but it does more than signature-based blocking, adding application control, device control, and a host-based firewall. Antivirus alone improves front-line security but does not stop more sophisticated threats that find another way in.
Yes. An EPP focuses solely on prevention, and because no EPP can block every threat, it should be paired with EDR. A comprehensive endpoint security solution includes both EPP and EDR capabilities.
An EPP should include antivirus and anti-malware, application control, device and port control, and a host-based firewall, managed from a central console. Advanced versions add machine learning, threat intelligence, and sandboxing to block threats the EPP has not seen before.
