# How do you choose the right endpoint security solution?

> How to choose endpoint security: what EDR must include, how to read MITRE and AV-Comparatives tests, vendor questions for MSPs, and rollout steps.

Choose an endpoint security solution by matching it to how attacks actually start, not to the longest feature list. In practice that means four steps: pick a platform that combines malware prevention with endpoint detection and response (EDR), verify the vendor's claims against public test data instead of datasheets, confirm it fits your management stack (multi-tenant console, RMM and ticketing integration), and pilot it on a small ring of machines before rolling it out everywhere. The stakes are not abstract: ransomware appeared in [44% of breaches](https://www.verizon.com/about/news/2025-data-breach-investigations-report) analyzed in Verizon's 2025 Data Breach Investigations Report, and in 88% of breaches at small and mid-sized businesses, exactly the clients most MSPs manage.

![Endpoint security illustration](/images/cms/68deea1396c824ea158d686d_img-zd6axqu7nr8llcvglslmu4fr.png)

## Why does your endpoint security choice matter right now?

Because endpoints are where most incidents become expensive. The [2025 Verizon DBIR](https://www.verizon.com/about/news/2025-data-breach-investigations-report) analyzed 12,195 confirmed breaches and found credential abuse (22%) and vulnerability exploitation (20%, up 34% year over year) as the leading ways in: both play out on laptops, servers, and edge devices. The median ransom payment was $115,000; 64% of victims now refuse to pay, but refusing only works if you detect the intrusion early and can restore from clean backups.

The FBI's [2024 Internet Crime Report](https://www.ic3.gov/AnnualReport/Reports/2024_IC3Report.pdf) tells the same story from the complaint side: $16.6 billion in reported losses (up 33% from 2023), ransomware complaints up 9%, and 67 new ransomware variants identified. If you are fuzzy on how these attacks unfold on a device, start with [how ransomware spreads](/learning/threats), the mechanics drive most of the requirements below.

## What should a modern endpoint security stack include?

Think in layers, and ask one concrete question per layer:

| Layer | What it does | What to check |
|---|---|---|
| Prevention (AV/NGAV) | Blocks known malware before it runs | Detection and false-positive rates in independent tests |
| EDR | Records endpoint activity, flags suspicious behavior, enables response | Can you isolate a host and see the full process tree? |
| Hardening controls | Disk encryption, device/USB control, host firewall policy | Managed from the same console, or a second product? |
| Patch and vulnerability visibility | Shows exposed software before attackers find it | Does it cover third-party apps, not just the OS? |
| Coverage | Agents for every OS you actually manage | Windows, macOS, Linux, servers, parity, not checkboxes |

The EDR layer is the one that separates modern platforms from legacy antivirus. Microsoft [defines EDR](https://www.microsoft.com/en-us/security/business/security-101/what-is-edr-endpoint-detection-response) as a solution that "monitors endpoint activity, detects suspicious behavior, and helps security teams investigate and respond to threats in real time", the key difference being behavioral analysis rather than known signatures. That behavioral layer is what catches [fileless malware](/learning/threats) and living-off-the-land techniques that never drop a scannable file.

## Do you need EDR or XDR?

EDR watches endpoints deeply; XDR correlates signals from more places. Microsoft's [EDR vs. XDR comparison](https://www.microsoft.com/en-gb/security/business/security-101/edr-vs-xdr) puts it plainly: "XDR solutions build on the foundation provided by EDR by broadening the scope of protection beyond endpoints": pulling in email, identity providers, cloud workloads, SaaS apps, and network telemetry. XDR is not a replacement for EDR; it is EDR plus correlation.

The honest buying question: which of those extra signal sources do you actually own and monitor? A team running everything in one productivity suite gets real value from XDR correlating email and identity events with endpoint alerts. A team already shipping telemetry to a SIEM may be paying twice for correlation. Don't buy the label. Buy the signals you will use.

## How do you verify a vendor's detection claims?

Never from the vendor's own charts. Two public sources let you check claims independently:

1. [MITRE ATT&CK Evaluations](https://evals.mitre.org/) run vendors through emulations of real adversary behavior and publish the raw results free. Crucially, MITRE does not rank or score vendors. You read the detections yourself. The 2024 Enterprise round emulated ransomware behaviors on Windows and Linux plus techniques inspired by North Korea's state-sponsored actors on macOS, so the scenarios map directly to what MSP clients face.
2. [AV-Comparatives' Business Security Test](https://www.av-comparatives.org/tests/business-security-test-2025-march-june/) evaluates business endpoint products the way an administrator would run them, vendors configure their own products, and the report documents the settings each one used. The March–June 2025 round put 17 products through 438 real-world test cases plus malware protection, performance, and false-positive testing.

When you read these, don't stop at the detection percentage. False positives and alert noise decide whether technicians can live with a product. One heavy false positive on a line-of-business app can take a whole client offline. Then confirm with a proof of concept on your own images, because test labs never include your clients' odd legacy software.

## What should MSPs ask before signing?

Beyond detection quality, these are the questions that decide whether a platform works at MSP scale:

1. **Is the console truly multi-tenant?** Per-client policy isolation, per-client reporting, and technician role scoping, not one shared tenant with folders.
2. **How does it coexist with your RMM?** Remote access tooling is now a favorite attack path; CISA, NSA, FBI, MS-ISAC, and Israel's INCD published a joint [Guide to Securing Remote Access Software](https://www.cisa.gov/sites/default/files/2023-06/Guide%20to%20Securing%20Remote%20Access%20Software_clean%20Final_508c.pdf) recommending organizations audit the remote access software on their networks and use application controls (including allowlisting approved RMM programs) to control what can run. Your endpoint product should help you detect [RMM tool abuse](/learning/msp), not whitelist it blindly.
3. **What telemetry is kept, and for how long?** Investigations often start weeks after initial access, so [EDR data retention](/learning/howlongshouldorganizationsretainEDRdata) windows and export options matter.
4. **What happens when nobody is watching?** If you don't run a 24/7 desk, ask what the managed detection and response (MDR) add-on's SLAs actually commit to.
5. **How does licensing flex?** Monthly, per-endpoint pricing that scales down as well as up.
6. **Does it integrate with your PSA?** Alerts that don't become tickets don't get worked.

## How do you roll out endpoint security without breaking things?

A phased rollout catches problems while they are still small:

1. Inventory every device first: the agent you never installed protects nothing.
2. Remove old security agents completely with the vendor's cleanup tool.
3. Deploy to a pilot ring (your own machines plus one tolerant client) in detect-only or audit mode.
4. Tune exclusions for backup software, databases, and developer tools before enabling blocking.
5. Switch on blocking and tamper protection, then wire alerts into your ticketing system with severity routing.
6. Verify agent health weekly: offline or degraded agents are silent coverage gaps.

Pair the rollout with the basics the joint CISA/MS-ISAC/NSA/FBI [#StopRansomware Guide](https://www.cisa.gov/stopransomware/ransomware-guide) keeps hammering: phishing-resistant [multi-factor authentication](/learning/mfatypesformsp), aggressive patching, and offline or immutable backups. The guide organizes prevention by initial access vector for a reason. Endpoint tooling is one control among several, not the whole plan.

## What won't endpoint security stop?

Be honest about the limits before you promise clients "protection":

- **Third-party breaches.** The 2025 DBIR found third-party involvement in 30% of breaches, double the prior year. Your agent cannot see inside a vendor's network.
- **Malware-free email fraud.** A convincing invoice-fraud email contains no payload for an agent to detonate. Business email compromise is a people-and-process problem at the point of delivery.
- **Spoofing of your own domain.** When attackers forge a client's domain to phish their customers, the malicious mail never touches a protected endpoint. That is an email authentication problem (see [why phishing emails can pass SPF and DKIM](/learning/why-do-phishing-emails-pass-spf-and-dkim)) and it is the layer Palisade automates for MSPs through [managed DMARC](/learning/how-can-i-set-up-managed-dmarc-with-palisade).
- **Lookalike domains.** Even DMARC has limits worth stating plainly: [RFC 9989](https://www.rfc-editor.org/rfc/rfc9989.html#section-2.2) notes it "does not address the use of visually similar domain names or abuse of the RFC5322.From human-readable display name." No single control covers everything, which is the whole argument for [layered defenses](/learning/why-single-solution-cant-stop-ransomware).

A free [email security score](/tools/email-security-score) check shows where a domain stands on these email-side controls, useful when splitting budget between endpoint and email layers.

## Common issues with endpoint security rollouts

### Why are two security agents fighting on the same machine?

Leftover antivirus from a previous vendor is the classic cause of crashes and double-scanning. Uninstall via the old vendor's dedicated removal tool (remnants survive normal uninstalls), then verify what Windows still registers as active:

```powershell
Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct |
  Select-Object displayName, productState
```

This namespace exists on Windows desktop editions, not Windows Server, check servers through your console's agent health view.

### Why did machines slow down after deployment?

Usually scan contention with I/O-heavy software: backups, databases, developer builds. Add vendor-recommended exclusions for those workloads, stagger full scans outside business hours, and compare against the performance results in the independent tests above: if a product tested light but runs heavy, suspect your configuration, not the agent.

### Why is the team drowning in alerts?

Default policies alert on everything to look thorough. Tune in stages: suppress known-good admin tools per client, route only medium-and-above severities to your PSA, and review the noisiest rules weekly for the first month. If tuning still outpaces staff time, price MDR rather than letting alerts rot in a queue.

### What if attackers just disable the agent?

Modern intrusions routinely try to blind or uninstall endpoint protection first, sometimes by [abusing trusted installers and drivers](/learning/can-trusted-installers-blind-edr). Enable tamper protection and uninstall passwords everywhere, and treat "endpoint stopped reporting" as an incident trigger, not a maintenance chore.

## Frequently asked questions

### Do I still need antivirus if I buy EDR?

You need both functions, but you rarely buy them separately anymore, mainstream platforms bundle prevention and EDR in one agent. Prevention cheaply blocks the commodity malware that makes up most volume; EDR catches the behavioral, fileless, and hands-on-keyboard activity that prevention misses.

### Is the security built into the operating system enough for a business?

Built-in protection shows up respectably in independent tests, but "enough" depends on management: multi-tenant policy control, cross-platform coverage, retention, and reporting are where built-in tooling runs thin for MSPs. Whatever you choose, watch its security advisories. Endpoint products ship vulnerabilities too and need the same patch discipline as everything they protect.

### Can endpoint security alone stop ransomware?

No. The CISA #StopRansomware Guide structures prevention around initial access vectors, phishing, credentials, vulnerabilities, plus backups and zero trust architecture, because ransomware defense fails at whichever layer you skipped. Strong EDR shortens detection time, but without tested offline backups and MFA you are still one bad night away from paying.

### How do we prove the investment is working?

Track coverage (agents deployed vs. devices known), agent health (percentage reporting in the last 24 hours), mean time to acknowledge and to isolate, and false-positive rate per client. Those four numbers expose the most common failure mode: a well-chosen product that is quietly not deployed everywhere.

## Related reading

- [What endpoint security stats should MSPs track?](/learning/msp)
- [What should MSPs do first after a ransomware breach?](/learning/msp)
- [How are identity threats evolving against Google Workspace?](/learning/identity-threats-google-workspace-2025)