Skip to content

Endpoint protection platform

Also known as EPP

The preventive layer on a device: antivirus, exploit mitigation, and policy enforcement that blocks threats before they run.

EPP is about prevention, EDR is about detection and investigation. Most modern products do both, but the distinction still matters when comparing quotes, because a cheap product may be prevention only with no ability to investigate afterwards.

Prevention will always miss some share of attacks. The question to ask a vendor is what happens on the day it does.

Where this comes up

Endpoint protection platform sits inside our cybersecurity and threats work. If you are trying to work out what this means for your own environment rather than in the abstract, that is the page worth reading next, and a short call will get you a straight answer faster than either.

Cybersecurity services Ask an engineer

Related terms

Endpoint detection and response Security software on each device that records behavior, detects attacker activity, and lets a responder investigate and isolate remotely. Malware Any software written to do something harmful on a system it has reached, from stealing data to encrypting it. Application allowlisting Permitting only approved software to run, and blocking everything else by default.

More in cybersecurity and threats

Attack surfaceBeaconingBrute force attackBusiness email compromiseCommand and controlContainmentCredential stuffingData exfiltration

Back to the full glossary →

Want this explained against your own setup?

Definitions only get you so far. Book a short call and we will tell you whether this actually matters for your business, and what we would do about it.

Call (855) 737-9500 / (480) 573-3349

Email [email protected]

15-minute response on critical issues, 24/7. Onboarding in two to three weeks.

We reply within one business day. No spam, no pressure.