Endpoint security is now a continuous identity and resilience problem

At a glance

What this is: NHI Mgmt Group's analysis, drawing on SecurityScorecard's blog post: Endpoint security has shifted from antivirus to continuous protection, with unmanaged devices and remote access making device control an ongoing governance problem.

Why it matters: This matters to IAM and security teams because endpoint trust, device inventory, and access gating now shape who and what can reach sensitive systems, including users, vendors, and connected devices.

Context

Endpoint security is no longer just about blocking malware on a managed laptop. It now includes inventory, device posture, access policy, response, and the ability to see endpoints that sit outside the traditional corporate boundary. The article’s core point is that protection breaks down when organisations cannot identify every device that can reach their resources.

That shift has an identity dimension because endpoint trust is often the first control that determines whether a device, user, or third-party machine is allowed into the environment. When unmanaged devices and vendor endpoints are part of the attack surface, endpoint security becomes a question of governance as much as detection.

Endpoint trust gap: the distance between the devices organisations believe are controlled and the devices actually touching the environment is now a material security risk.

Key questions

Q: What fails when endpoint security does not cover unmanaged devices?

A: Unmanaged devices break the assumption that corporate policy controls every access path. If a personal laptop, contractor machine, or IoT device can still reach sensitive systems, attackers only need one weak endpoint to gain credentials, bypass layered defences, and expand their reach laterally.

Q: Why do compromised endpoints create identity risk as well as device risk?

A: Because endpoints often store or handle active credentials, session tokens, and cached access data. Once the device is compromised, the attacker can reuse those identity artefacts to impersonate the user or service, which turns a hardware problem into an access problem.

Q: What are the signs that endpoint protection is not tuned well enough?

A: Common warning signs include excessive false positives, missed detections on newer malware, inconsistent blocking across devices, and response features that exist but are rarely used. If teams cannot explain which controls catch what, or if policies create friction without improving coverage, the stack is probably misaligned. Regular testing should show where the gaps are before attackers do.

Q: How should organisations adapt zero trust when endpoints remain the main breach path?

A: Organisations should start with the endpoint because it is often the first place an attacker lands and the place where zero trust controls can be enforced most consistently. That means hardening device access, verifying posture continuously, segmenting privileges, and making endpoint telemetry central to detection and response. An endpoint-centric model only works when trust is repeatedly earned, not assumed.

Technical breakdown

Why endpoint visibility now matters more than perimeter security

An endpoint is any device that can communicate with your network, which means laptops, phones, servers, printers, and IoT devices all become possible entry points. Traditional perimeter thinking assumes a trusted internal zone, but remote work and personal devices dissolve that assumption. Modern endpoint security therefore combines discovery, policy enforcement, malware prevention, and response into a single control plane. Without accurate inventory, even strong tooling leaves blind spots because the defender cannot protect or measure what it cannot see.

Practical implication: inventory every device class that can reach corporate resources, including contractor and IoT endpoints, before trusting any endpoint control.

How EPP and EDR split prevention from investigation

Endpoint protection platforms focus on prevention by blocking known malware, suspicious files, and risky behaviour before execution. Endpoint detection and response assumes some threats will bypass those controls, so it records activity and supports investigation after compromise. The distinction matters because prevention and response are not interchangeable. EPP reduces the chance of initial compromise, while EDR preserves the evidence needed to understand how a device was abused and whether lateral movement occurred.

Practical implication: use EPP and EDR together, and validate that telemetry from both reaches your SOC and identity workflows.

How unmanaged devices turn endpoint compromise into lateral movement

A single compromised endpoint can expose credentials, session tokens, and access paths that attackers reuse to move through the environment. That is where endpoint security intersects with IAM, because device compromise becomes identity compromise when credentials are stored, cached, or active on the device. The article’s warning is not just that malware lands on endpoints, but that unmanaged or weakly governed devices can become the bridge from initial access to broader enterprise impact.

Practical implication: require device posture and authentication controls to work together so compromised endpoints cannot automatically inherit broad access.

Threat narrative

Attacker objective: The attacker seeks a foothold on an endpoint that yields reusable access and lets them spread through the environment, steal data, or deploy ransomware at scale.

1. Entry occurs through an unmanaged or weakly protected endpoint such as a laptop, mobile device, or vendor-connected device that reaches corporate resources.
2. Credential access follows when the compromised device exposes cached credentials, session material, or access tokens that attackers can reuse.
3. Lateral movement then becomes possible because the stolen identity artefacts let the attacker move from the endpoint into broader infrastructure.
4. Impact is achieved through ransomware, data theft, or remote encryption across systems that trust the compromised device.

Breaches seen in the wild

• Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.
• CISA Private-CISA GitHub leak 2026: A CISA contractor's public GitHub repo exposed AWS GovCloud admin keys, Artifactory credentials and plaintext passwords for six months.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Endpoint security has become a governance problem because device trust now determines identity trust. The article makes clear that endpoint compromise is rarely isolated to the device itself. Once a laptop or mobile device is unmanaged, the access decisions tied to that device can become the real vulnerability. The practitioner conclusion is that endpoint controls must be treated as part of identity governance, not as a separate hygiene layer.

Endpoint visibility is now the control that decides whether policy exists in practice or only on paper. If security teams cannot enumerate devices, they cannot enforce posture, detect drift, or prove coverage. That gap is especially important in hybrid and third-party ecosystems where the endpoint estate changes faster than periodic reviews. The practitioner conclusion is that continuous discovery is now a prerequisite for credible endpoint assurance.

Unmanaged-device exposure creates what we would call the endpoint trust gap. This is the point at which the organisation believes access is bounded by corporate controls, but the actual entry path is controlled by devices outside those controls. The article’s supply-chain angle matters because vendor and partner endpoints extend that gap beyond the employee estate. The practitioner conclusion is to govern endpoint trust as a shared access boundary, not a one-time enrollment task.

Resistance to layered control is usually a false economy in endpoint security. The article shows that no single technology stops every attack, which is why prevention, detection, and response all have to be operating together. That logic aligns with modern resilience thinking: when one layer fails, another must preserve containment. The practitioner conclusion is that endpoint programs should be judged by their failure tolerance, not their marketing stack.

What this signals

Continuous device discovery is now a core control, not an IT inventory task. Endpoint security breaks down when teams only protect what they already know about. The harder problem is maintaining a live view of every device that can touch the environment, including unmanaged and third-party endpoints.

Device trust and identity trust are converging at the endpoint boundary. A device that cannot prove posture should not be allowed to inherit user access, because the compromise path often starts with the endpoint and ends with the account.

Endpoint resilience depends on reducing the time between detection and containment. Prevention will miss some attacks, so the real test is whether EDR, policy enforcement, and response workflows can isolate a compromised device before it becomes a lateral-movement platform.

For practitioners

• Build a complete endpoint inventory Include employee, contractor, mobile, server, printer, and IoT devices that can reach sensitive systems, then reconcile the list continuously with network access logs and endpoint management data.
• Gate network access on device posture Require verified protection, patch status, and policy compliance before a device can connect, especially for remote and bring-your-own-device scenarios.
• Pair prevention with response telemetry Make sure EPP alerts, EDR telemetry, and identity signals reach the same investigation workflow so compromised endpoints can be traced back to the accounts they expose.
• Tighten vendor endpoint oversight Treat third- and fourth-party endpoints as part of the attack surface by reviewing which partners can connect, what controls they run, and how quickly risky devices are removed from access.

Key takeaways

• Endpoint security now succeeds or fails on whether organisations can see and govern every device that can reach their resources.
• Unmanaged devices, remote work, and third-party endpoints turn endpoint compromise into an identity and resilience problem, not just a malware problem.
• The most effective programs combine prevention, detection, posture enforcement, and rapid containment rather than relying on antivirus alone.

Key terms

• Endpoint Protection Platform: An Endpoint Protection Platform is a prevention-focused control set that hardens devices against malware delivery and execution. It typically includes attack surface reduction, device controls and policy enforcement, making endpoints harder to abuse before a detection layer is needed.
• Endpoint Detection and Response: Endpoint detection and response is security software that monitors individual devices for suspicious activity, investigates threats, and supports containment actions. It is designed for persistent hosts such as laptops and servers, where an agent can collect telemetry over time and give responders visibility into process, file, and network behaviour.
• Device Posture: The current security condition of a device or runtime at the moment access is requested or renewed. Posture can include patch state, protection status, integrity, and whether the endpoint is managed. In identity governance, posture is part of the trust decision, not a separate endpoint problem.
• Unmanaged Device: An unmanaged device is a system that connects to enterprise resources without being fully enrolled in security controls, inventory, or policy enforcement. These devices are dangerous because they may still carry valid credentials, cached sessions, or access paths that attackers can exploit.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity, and secrets management for teams that need to connect access control to real operational risk. It helps identity, security, and platform practitioners align governance with the systems and endpoints that actually carry credentials.