Most organisations own an EDR licence and a patching tool, yet few can say with evidence how mature their endpoint security actually is or which gap to close next. Laptops, desktops, servers and mobile devices are where ransomware lands, where credentials are dumped and where attackers switch off the tools meant to catch them. This five-level model, using the same Ad hoc to Optimised scale as the NHI Mgmt Group NHI Governance Maturity Model, scores endpoint security across ten dimensions and maps the levels loosely to the ASD Essential Eight maturity levels and the CIS Controls Implementation Groups. It is for security architects, endpoint and infrastructure leads, and CISOs who need an honest baseline, a realistic target and a roadmap.
Key takeaways
- Score ten dimensions separately: asset coverage, hardening baselines, privilege management, application control, patching, EDR and response, encryption, logging and telemetry, device identity and posture, and governance and metrics.
- Coverage decides the level. A control enforced on 60% of devices is Level 2, whatever the policy says; the unmanaged 40% is where attackers start.
- Level 3 (Defined) is the right first target for most organisations. It lines up roughly with full CIS Implementation Group 1 and Essential Eight Maturity Level One.
- Privilege and application control move the needle most. Removing standing local admin and enforcing an allowlist blunt more attack techniques than adding another detection tool.
- Maturity must show in numbers: patch latency for exploited flaws, percentage of devices in enforced application control, EDR health coverage and time to isolate a host.
The five levels
| Level | Name | Description |
|---|---|---|
| 1 | Ad hoc | No reliable device inventory. Antivirus and patching depend on individual administrators, users are local administrators, and problems are found through incidents or audit findings. |
| 2 | Developing | Endpoint management and EDR are deployed but coverage is patchy. Baselines exist for some platforms, patching runs monthly with frequent exceptions, and local admin removal has started for some groups. |
| 3 | Defined | Documented standards for every device class. Inventory is reconciled, baselines are enforced through management tooling, local admin passwords are unique and rotated, exploited vulnerabilities have a patch deadline, and EDR alerts have an owner and a playbook. |
| 4 | Managed | Controls are enforced and measured across the estate, including servers. Application control is in enforced mode, privilege is granted just in time, device compliance gates access to applications, and metrics drive decisions. |
| 5 | Optimised | Endpoint security is continuous and largely automated. Drivers and firmware are patched and controlled, high-confidence detections trigger automatic isolation, configuration drift is corrected without tickets, and evidence for auditors is generated from tooling. |
The ten dimensions
Levels 2 and 4 sit between the descriptions shown; the roadmap below lists what moves you from each level to the next.
| Dimension | Level 1 Ad hoc | Level 3 Defined | Level 5 Optimised |
|---|---|---|---|
| Asset coverage | No inventory; unknown device count | Inventory reconciled across directory, MDM, EDR and network data at least monthly; unmanaged devices flagged | Automated discovery at least fortnightly; any device without management and EDR is blocked or isolated |
| Hardening baselines | Vendor defaults | CIS Benchmark or vendor baseline per OS, enforced by GPO, Intune or configuration management, with documented exceptions | Drift detected and remediated automatically; baselines reviewed with each OS release |
| Privilege management | Users are local administrators; shared local admin password | Local admin removed for standard users; Windows LAPS or equivalent for unique, rotated passwords; separate admin accounts | Just-in-time elevation; Credential Guard and Remote Credential Guard on; admin access only from privileged access workstations |
| Application control | Anything can run | Allowlist enforced on workstations, including user profile and temp folders; scripts and installers covered | Enforced on all workstations and servers, drivers restricted, vulnerable driver blocklist applied, rules validated yearly |
| Patching | Manual, irregular | Defined deadlines: 48 hours for critical or exploited flaws on internet-facing systems, one month for workstations; unsupported software removed | 48 hours for critical or exploited flaws everywhere, including drivers and firmware; ring-based automatic deployment |
| EDR and response | Signature antivirus only, often disabled | EDR on all supported workstations and servers, tamper protection on, alert triage owned by SOC or MDR | Automated isolation on high-confidence detections; response playbooks tested; EDR health monitored as a control |
| Encryption | Some laptops encrypted | Full-disk encryption on all laptops and removable media policy; recovery keys escrowed centrally | Encryption enforced as a compliance condition; key access logged and reviewed; pre-boot protection for high-risk roles |
| Logging and telemetry | Local logs, overwritten | Security, PowerShell and process creation events forwarded centrally; application control and privilege events logged | Workstation and server logs analysed in near real time; log tampering detected; retention meets policy |
| Device identity and posture | Any device with a password can reach email and SaaS | Devices enrolled with a managed identity; compliance policies defined for encryption, OS version and threat level | Conditional access requires a compliant, attested device for every application; non-reporting devices marked non-compliant |
| Governance and metrics | No endpoint standard or owner | Endpoint security standard approved; owner named; monthly metrics on coverage and patch latency | Risk-based targets reported to leadership; exceptions expire; management plane (MDM, EDR consoles) treated as tier 0 |
How the levels relate to Essential Eight and CIS Controls
The Essential Eight defines maturity levels zero to three for eight Windows-focused mitigations, and a level is only met when all of its requirements are. CIS defines Implementation Group 1 as "essential cyber hygiene", with IG2 building on it and IG3 covering all 153 Safeguards. Neither framework covers every dimension here (the Essential Eight has no EDR or disk encryption strategy, for example), so treat the mapping below as a sense check, not an equivalence. See the Essential Eight Guide.
| This model | Essential Eight (loose fit) | CIS Controls v8.1 (loose fit) | Evidence that marks the level |
|---|---|---|---|
| 1 Ad hoc | Maturity Level Zero | IG1 not met | No inventory; users are admins |
| 2 Developing | Partial Maturity Level One | IG1 in progress | EDR and patching deployed but with known coverage gaps |
| 3 Defined | Maturity Level One | IG1 complete | Application control on workstations (ISM-0843, ISM-1870); 48-hour patching of exploited internet-facing systems (ISM-1877); dedicated admin accounts (ISM-0445) |
| 4 Managed | Maturity Level Two | IG2 | Application control on internet-facing servers with Microsoft's recommended blocklist (ISM-1490, ISM-1544); privileged access disabled after 45 days of inactivity (ISM-1648); managed local admin and service account credentials |
| 5 Optimised | Maturity Level Three | IG3 elements | Driver control and vulnerable driver blocklist (ISM-1658, ISM-1659); 48-hour patching of critical flaws on workstations, drivers and firmware (ISM-1696, ISM-1879, ISM-1903); Credential Guard (ISM-1686) |
ISM control references are taken from Microsoft's published Essential Eight mappings. Microsoft states that Maturity Level One application control can be met with AppLocker, while Levels Two and Three need App Control for Business (WDAC), and that reputation-based allow decisions do not meet the requirement.
Dimension to framework mapping
| Dimension | CIS Controls v8.1 | NIST CSF 2.0 | Attack technique it blunts |
|---|---|---|---|
| Asset coverage | Control 1 (Safeguard 1.1) | ID.AM-01 | Initial access through unmanaged hosts |
| Hardening baselines | Control 4 (4.1) | PR.PS-01 | Abuse of default services and settings |
| Privilege management | Controls 5 and 6 (5.4) | PR.AA-05 | T1003.001 LSASS Memory |
| Application control | Control 2 (2.5, 2.7) | PR.PS-05 | Execution of unapproved payloads and scripts |
| Patching | Control 7 (7.3, 7.4) | PR.PS-02 | Exploitation of known vulnerabilities |
| EDR and response | Control 10 (10.1, 10.7), Control 13 | DE.CM-09 | T1685 Disable or Modify Tools |
| Encryption | Control 3 (3.6) | PR.DS-01 | Data theft from lost or stolen devices |
| Logging and telemetry | Control 8 (8.2) | PR.PS-04 | T1685.001 and T1685.005 event log tampering |
| Device identity and posture | Controls 1 and 4 | PR.AA-03 | Sign-in from attacker-controlled devices |
| Governance and metrics | Control 17 and programme level | GV.PO, GV.OV | Takeover of the management plane |
Self-assessment questions
Score each dimension from 1 to 5 using evidence from tooling, not policy documents. Your overall level is the lowest score among the dimensions that protect your most critical systems, not the average.
- Asset coverage: how many devices appear in the directory but not in EDR, and how many in EDR but not in MDM? Could you produce the reconciled list today?
- Hardening: what percentage of Windows, macOS and Linux devices pass their baseline, and how many exceptions have no expiry date?
- Privilege: how many standard users still hold local admin, and is any local administrator password shared between two machines?
- Application control: is your policy in audit or enforced mode, and does it cover user profile and temp folders, scripts and servers?
- Patching: for the last vulnerability on the CISA Known Exploited Vulnerabilities list that affected you, how many hours did it take to reach 95% of devices?
- EDR: how many devices have a sensor that is unhealthy, out of date or without tamper protection, and who is paged at 2am?
- Encryption: could you prove a lost laptop from last month was encrypted, and retrieve its recovery key without the user?
- Logging: would you see an attacker clearing the Security log or disabling PowerShell logging on a workstation?
- Device posture: can a personal or non-compliant device reach email, SaaS or the VPN with a valid password and MFA?
- Governance: who can push scripts or wipe commands to every device from your MDM or EDR console, and how are those accounts protected?
Where identity fits
Several dimensions are identity problems in disguise. A shared local administrator password is a single credential that unlocks every machine; Windows LAPS gives each device a unique, rotated password backed up to Entra ID or Active Directory (not both), and the legacy LAPS package is deprecated from Windows 11 23H2. Service accounts used by patching, backup and EDR tools often hold administrator rights on every host, and the Essential Eight expects break glass, local administrator and service account credentials to be "long, unique, unpredictable and managed" at Maturity Level Two. The endpoint management console itself is the most powerful identity in the estate: in the Stryker Intune wiper attack, one hijacked admin account was enough to wipe devices at scale. See the Service Account Security Guide and the Endpoint Privilege Management Guide.
Moving up a level
From Ad hoc to Developing
- Build one device list by joining directory, MDM, EDR and DHCP or network data; investigate every device that appears in only one source.
- Deploy EDR to all supported workstations first, then servers, and turn on tamper protection so real-time protection, cloud protection and exclusions cannot be changed locally.
- Set a patch deadline for exploited vulnerabilities and track it, even if you miss it at first. See the Patch Management Guide.
- Remove local admin from a first pilot group and deploy Windows LAPS.
From Developing to Defined
- Publish an endpoint security standard per device class with an owner, and record exceptions with expiry dates.
- Apply a hardening baseline per OS through management tooling. See the Windows Endpoint Hardening Guide and the Linux Server Hardening Guide.
- Roll out application control to workstations in audit mode, review Code Integrity event 3076 (would have been blocked) for two to four weeks, then enforce by pilot ring, watching event 3077 (blocked). Keep the previous policy version ready to redeploy as the rollback. See the Application Allowlisting Guide.
- Deploy attack surface reduction rules in Audit, then Block, starting with the standard protection rules: vulnerable signed drivers, credential stealing from LSASS and WMI persistence.
- Encrypt every laptop and escrow recovery keys centrally. See the Encryption Guide.
- Forward security, PowerShell and process creation events centrally. See the Log Management and Retention Guide.
From Defined to Managed
- Extend enforced application control to internet-facing servers and apply Microsoft's recommended block rules.
- Replace standing admin rights with just-in-time elevation and disable privileged access unused for 45 days.
- Gate access on device compliance: in Intune, set "Mark devices with no compliance policy assigned as" to Not compliant (the default is Compliant) and use the Conditional Access grant "Require device to be marked as compliant". Pilot with report-only policies before enforcing. See the Device Trust and Posture Guide.
- Monitor EDR sensor health and alert on tampering. See the EDR Evasion and Defence Guide.
- Protect the management plane: phishing-resistant MFA, privileged access workstations and multi-administrator approval for wipe and script actions.
From Managed to Optimised
- Restrict drivers, apply the vulnerable driver blocklist and patch drivers and firmware within the same deadlines as the OS.
- Enable Credential Guard and Remote Credential Guard on supported devices.
- Automate isolation for high-confidence detections, with a documented release process and a weekly review of false positives.
- Generate audit evidence from tooling and report risk-based targets to leadership.
Metrics that show maturity
- Coverage gap: devices in inventory without healthy EDR or management, as a percentage (target under 1%).
- Exploited-vulnerability patch latency: median and 95th percentile hours from release to remediation for known exploited flaws.
- Enforced application control: percentage of workstations and servers in enforced, not audit, mode.
- Standing local admin: number of users with permanent local admin rights, and devices without a LAPS-managed password.
- Device compliance: percentage of sign-ins to business applications from compliant devices.
- Time to isolate: minutes from a high-severity EDR alert to host containment.
Common failure patterns
- Audit mode forever: application control and ASR rules sit in audit for years because nobody owns the enforcement decision. Set an enforcement date when audit starts.
- Measuring policy, not coverage: a baseline assigned is not a baseline applied. Score from device reports.
- Servers left out: programmes stall at the server boundary, where exploited flaws often land first.
- Exceptions without expiry: developer, executive and legacy application exemptions become the permanent attack path.
- Unprotected management plane: consoles that can wipe or run code on every device guarded by ordinary admin accounts, as at Stryker.
Practitioner checklist
- Score all ten dimensions with evidence and record the source of each score.
- Set Level 3 as the 12-month target, with Level 4 for internet-facing servers and privileged users.
- Fix the lowest-scoring dimension that protects your most critical systems first.
- Baseline the six metrics now and report them monthly.
- Treat MDM, EDR and patching consoles and their service accounts as tier 0 assets.
- Reassess every six to twelve months and after major platform changes. See the Endpoint Security Guide.
Standards and references
- CIS: CIS Controls Implementation Groups
- CIS: The 18 CIS Critical Security Controls (v8.1)
- NIST: SP 800-40 Rev. 4, Guide to Enterprise Patch Management Planning
- NCSC: Device Security Guidance
- MITRE ATT&CK: T1685 Disable or Modify Tools
- Microsoft Learn: Essential Eight application control
- Microsoft Learn: Essential Eight patch operating systems
- Microsoft Learn: What is Windows LAPS?
Related NHI Mgmt Group resources: Endpoint Security Guide · Essential Eight Guide · Identity Security Maturity Model · MDR Guide