Every device that touches your network is an endpoint: laptops, desktops, phones, tablets, the point-of-sale terminal, the networked printer, the security cameras, the tablet in the break room nobody remembers setting up. Each one is a potential way in.
For years, the answer was antivirus software, and for years that was mostly adequate. It isn’t anymore, and not because antivirus got worse, but because attacks changed shape. This guide covers what modern endpoint protection actually means for a business with 10–100 employees, and what to do about the devices you can’t install anything on.
Why Antivirus Alone Stopped Working
Traditional antivirus compares files against a list of known-bad signatures. That model has two problems in 2026.
Modern malware changes constantly. Attackers automatically generate variants specifically to produce a signature nobody has catalogued yet. By the time a signature exists, the campaign has moved on.
The most effective attacks don’t install anything. “Living off the land” techniques use tools already present and trusted on your systems: PowerShell, Windows management utilities, remote desktop software. Nothing malicious is written to disk, so there’s no file to scan. Signature-based tools see a normal administrator doing normal administration.
What Replaces It: EDR
Endpoint Detection and Response watches behavior instead of matching files. It builds a picture of what normal looks like on each machine and flags the sequences that indicate an attack: a document opening a scripting engine, a process trying to enumerate the network, bulk file encryption starting, credentials being read from memory.
The single most valuable capability, and the one to check for when comparing products: can you isolate a compromised machine from the network remotely? When something is spreading, cutting one laptop off in thirty seconds from wherever you happen to be is what limits an incident to one machine.
For small businesses, the realistic options are Microsoft Defender for Business (included in Microsoft 365 Business Premium, which many already own), SentinelOne, or CrowdStrike Falcon. All three are viable; the deciding factor is usually whether someone is actually watching the alerts.
Which raises the point most product comparisons skip.
A Tool Nobody Watches Is Not a Control
EDR generates alerts. Alerts need a human to triage them, because the interesting ones look boring and the boring ones are frequent. A small business that buys EDR, points it at every machine, and never opens the console has purchased a very good record of how it got breached.
Be realistic about which of these you’re set up for:
- Someone internally owns the console and checks it on a defined schedule
- Your IT partner monitors it and has authority to act without waiting for approval
- You’ve configured automatic isolation so the tool responds even when nobody’s looking
The third option is underused and worth configuring regardless. Automated containment isn’t as good as a trained analyst, but it works at 2 a.m. on a holiday weekend.
The Devices You Can’t Protect Directly
Every small business has some. A card terminal, a networked scanner, an older machine running software the vendor won’t update, a building control system, cameras with firmware from 2019. You can’t install an agent on these, and replacing them often isn’t realistic.
Three compensating controls handle most of the risk:
Network Segmentation
Put devices you can’t secure on their own network segment with no path to your staff systems. A compromised camera should be able to reach the internet and nothing else. This is a firewall and switch configuration change, not a purchase, and it’s the highest-value thing you can do for this category.
Application Allowlisting
For an old machine whose only job is running one specific program, flip the model: instead of blocking known-bad software, permit only the handful of approved applications and deny everything else. This is highly effective precisely because the machine’s job never changes.
Network Monitoring
Devices that can’t run software can still be watched from the network. Unusual outbound connections from a printer are a strong signal, and you don’t need to touch the printer to see them.
Priorities By Device Type
| Device | Run EDR? | Primary Control | Backup Control |
|---|---|---|---|
| Staff laptops and desktops | Yes | EDR + automatic patching | MFA, email filtering |
| Servers | Yes | EDR + controlled patching | Restricted admin access |
| Phones and tablets | Partly | Mobile device management | App and OS update enforcement |
| Point-of-sale terminals | Sometimes | Vendor-supported protection | Segmentation |
| Printers, cameras, IoT | No | Segmentation | Change default passwords, update firmware |
| Specialized equipment | Rarely | Allowlisting | Isolate on its own VLAN |
| Personal devices (BYOD) | No | Conditional access policies | Restrict what data they can reach |
Two Gaps Small Businesses Consistently Miss
Personal Devices
If staff check work email on personal phones, those phones are endpoints. You generally can’t and shouldn’t manage someone’s personal device fully, but you can require that access comes only from a device meeting basic conditions (screen lock, current OS, not jailbroken) and you can retain the ability to remove company data without wiping their photos. Conditional access policies handle this; the mistake is having no position at all.
Default Passwords
Networked devices ship with published default credentials, and lists of them are freely available. A camera system or a network switch still on admin/admin is not a subtle vulnerability. Walk your device list and change them; it costs an afternoon and closes a door that scanning tools find automatically.
Patching Is Still the Foundation
Nothing here substitutes for keeping software current. Set a cadence and automate it:
- Critical vulnerabilities: within 30 days, faster if actively exploited
- Everything else: within 90 days
- Anything that can’t meet that: document why, and write down what compensating control covers it
Automated tools such as Intune or an RMM platform enforce this without depending on someone’s memory. Where patching genuinely isn’t possible, that device belongs behind segmentation.
Where to Start
- Inventory everything. You cannot protect what you don’t know exists. Most businesses find devices they’d forgotten, and a few they can’t identify at all.
- Deploy EDR everywhere it will run. Check whether you already own it through Business Premium before buying.
- Decide who watches the alerts. Make this an explicit decision, not an assumption.
- Segment the devices you can’t protect. Cameras, IoT, guest Wi-Fi, and specialized equipment off the main network.
- Change default credentials. One afternoon, meaningful risk reduction.
- Automate patching. Then verify it’s actually running monthly.
- Set a BYOD position. Even a simple one is better than none.
The Bottom Line
Endpoint protection is no longer a product you install and forget. It’s a layered arrangement of the right tool where it fits, compensating controls where it doesn’t, and someone paying attention to what the tools report.
That last part is where small businesses most often fall short, not from bad decisions, but because the work is invisible when it’s going well and nobody has the time when it isn’t.
If you want a clear picture of what’s on your network and where the gaps are, our free Technology & Growth Review covers cybersecurity, technology, and AI readiness in 60 minutes and leaves you with a written action plan.