Endpoint security

Endpoint security is the protection of the devices people actually work on: laptops, desktops, phones and tablets. It covers the protection software running on each device, encryption of the drive, patching of the operating system and apps, removing admin rights from everyday accounts, managing company and personal phones, what to do when a device is lost, and the clean handover of devices when people join or leave. It is for owners, office managers and IT leads at small and mid sized organizations whose staff carry work around on a mix of machines. Canada Create is a Toronto agency at 126 Willowdale Avenue serving organizations across Canada, and endpoint security is part of our cyber security work.

• What counts as an endpoint
• Antivirus and EDR in plain words
• Encryption and lost devices
• Patching the operating system and apps
• Admin rights and application control
• Phones, tablets and BYOD
• Who handles the alerts
• Onboarding and offboarding devices
• Reporting and the device register
• Privacy rules for devices that carry personal information
• How an endpoint security engagement runs
• What endpoint security costs
• Choosing an endpoint security provider: questions to ask first
• Get an endpoint security proposal sized to your devices

What counts as an endpoint

An endpoint is any device a person signs into to do their work. In a typical small organization that means the office desktops, the laptops that go home every night, the partner’s tablet, the phones that receive work email and approve sign-ins, and sometimes a shared reception computer or a shop floor terminal. Each of these holds files, saved passwords and access to email and cloud accounts, which is why each needs looking after on its own.

Why owners start searching

People search “endpoint protection for business” or “antivirus vs EDR” for practical reasons. The free antivirus that came with the laptops is expiring. An insurer’s questionnaire asks whether the organization runs EDR and encrypts its drives. A laptop was left in a taxi. A new hire is starting and nobody knows how to set up their machine the same way as everyone else’s. Or a staff member asked why a new protection program appeared on their computer overnight.

How it differs from network work

Network protection controls traffic between devices and the internet; endpoint protection looks at what happens on each device. A laptop on hotel Wi-Fi is outside the office firewall entirely, so its own protection, encryption and patches are what remain. Firewalls and office segments are covered on our new Network security page in this series.

Antivirus and EDR in plain words

Traditional antivirus compares files against a list of known harmful programs and blocks matches. It is useful but limited: it mostly recognizes what has been seen before.

What EDR adds

Endpoint detection and response, or EDR, watches behaviour on the device rather than only checking files. It notices when a word processor suddenly launches a script, when many files are renamed in a short burst, or when a program tries to read stored passwords. It records what happened so someone can trace the sequence afterwards, and it can isolate a device from the network while the cause is looked at. Modern business endpoint protection usually combines antivirus style blocking with EDR features in one agent.

EDR, XDR and SIEM

XDR stretches the same idea across more sources, such as email, cloud accounts and the network, so related events can be seen together. A SIEM is a different kind of system that collects logs from many places and helps analysts search and correlate them. A small organization rarely starts with a SIEM; it usually starts with good endpoint protection on every device and a clear plan for who reviews what it finds.

Choosing protection that fits

The right product depends on the devices you run, whether you already pay for a productivity suite that includes some protection, how many people travel, and who will look at alerts. We choose protection to fit the organization and set it up in your name; we do not publish product rankings, because the fit matters more than the brand. What matters is that every device has it, it is configured rather than left at defaults, and someone reads what it reports.

Encryption and lost devices

A lost laptop is an inconvenience. A lost laptop with an unencrypted drive full of client files is a privacy question. Device encryption scrambles the stored data so it cannot be read without the person’s sign-in.

Turning encryption on properly

Current computer and phone operating systems all include full disk or device encryption. The work is making sure it is actually on for every device, that the recovery keys are stored in the organization’s account rather than on a sticky note, and that a report shows which machines are encrypted. A device whose encryption status cannot be confirmed is treated as unencrypted until it can.

The lost device routine

When a phone or laptop goes missing, a short written routine helps: the person reports it at once, the device is locked or wiped through device management, the person’s passwords and sign-in sessions are reset, and the event is recorded with what data the device held and whether it was encrypted. That record helps the organization decide whether anything must be reported under privacy law.

Patching the operating system and apps

Software makers release updates that close weaknesses in their products. A laptop that misses months of updates is carrying known holes, and many everyday problems trace back to software that was simply out of date.

Operating system updates

Computer operating system updates can be scheduled so they install outside working hours and restart at a predictable time, with a short window for people to postpone when they are presenting. A report lists which devices are behind so the stragglers, often the laptop that rarely comes into the office, get attention.

Third party applications

Browsers, PDF readers, video meeting apps, accounting software and line of business programs all need patching too, and they are the part most often missed. Endpoint security work sets a routine for the common applications and flags programs that are no longer supported by their maker so the owner can plan a replacement.

Older machines

Some devices can no longer receive updates for their operating system. Those are listed with a recommendation: replace, isolate for a single task, or retire. The register makes the hardware budget conversation easier because the list already exists.

Admin rights and application control

Many small offices give every user full administrator rights on their own computer because it saves a support call when installing a printer. The trade off is that anything the user accidentally runs also has full control of the machine.

Removing admin rights from daily accounts

People do their daily work on a standard account. When they genuinely need to install something, a separate approval path or a time limited elevation handles it. Owners are sometimes worried this will slow staff down; in practice, once the common software is preinstalled, requests become occasional.

Application control

Application control decides which programs may run. In its lighter form it blocks known unwanted categories, such as unapproved remote control tools or file sharing apps. In a stricter form, used for reception computers, kiosks and shop floor terminals, only an approved list of programs may run at all. The choice depends on the role of the device and how much the person using it needs to install.

Browser extensions and macros

Browser extensions and document macros are two small areas with outsized reach. Endpoint settings can limit extensions to an approved list and block macros in files that arrive from outside the organization, while still allowing the internal spreadsheets the finance team depends on.

Phones, tablets and BYOD

Phones carry work email, chat, client contacts and the app that approves every sign-in. Some are company owned; many are personal phones staff use for work, known as bring your own device, or BYOD.

Company owned devices

Company phones and tablets are registered in device management from the first day. That allows the organization to require a passcode, keep the system updated, install approved apps, separate work data and wipe the device completely if it is lost or when it is returned.

Personal phones

Staff are rightly wary of their employer controlling their personal phone. For BYOD, a lighter approach protects only the work apps and their data: email and files live inside a managed work space that can be removed without touching personal photos or messages. A short written policy explains what the organization can and cannot see, and what happens when someone leaves.

Tablets in shared use

A tablet used for check ins at a front desk or for signatures in a showroom is set up in a locked single app mode, signed into a shared account with limited access, and reset on a schedule.

Who handles the alerts

Endpoint protection produces alerts. Some are noise, some need a look, a few need action. Buying protection without deciding who reads the alerts leaves the most useful part unused.

Options for alert handling

A small organization can name an internal person to review a daily summary, with clear instructions for what to escalate. It can ask its IT provider to review alerts during business hours. Or it can hand alert watching to an outside analyst team; that is a separate service, described on our managed detection and response page, and this page does not repeat it.

Tuning so alerts mean something

New protection usually flags legitimate business software at first: the accounting package’s update tool, a scanner utility, a script the bookkeeper runs every month. Tuning those out, with a written record of each exception, is what keeps real alerts visible. The same tuning is what resolves complaints about protection slowing a machine down, which usually trace to a scan running at the wrong time or a large folder that does not need constant checking.

Onboarding and offboarding devices

Most device problems start at the edges: the new laptop set up in a hurry, or the old one that leaves with a departing employee and is never wiped.

A standard setup for new devices

A new device is registered in device management, encrypted, given the standard protection agent, set to update automatically, signed in with a standard account and loaded with the approved applications before the person receives it. Writing the setup down means every laptop leaves the shelf the same way, whoever prepares it.

When someone leaves

Offboarding covers the device and the person: the account is disabled, sessions are signed out, the company phone and laptop are collected, recovery keys are confirmed, and the device is either wiped and reissued or retired. For BYOD phones, the work space is removed. The device register records the date and the outcome.

Retiring and disposing of hardware

Old laptops and phones are wiped using the device’s own secure reset or a recognized erase method before resale, donation or recycling, and the register notes which method was used and when.

Reporting and the device register

The device register is the list everything else depends on: each device, who uses it, its operating system and version, encryption status, protection status, last check in and when it was issued.

What a monthly report shows

A monthly report summarizes how many devices are fully protected, encrypted and current on updates, which ones are behind and why, notable alerts and what was done, devices added or retired, and any applications flagged as unsupported. It is written so an owner can read it in a few minutes and a technician can act on the detail.

How it connects to the rest

Endpoint work sits beside other services. Cloud accounts, file sharing and admin roles are handled through our cloud configuration and access work. Staff habits around fake sign-in pages are covered by phishing and awareness training. Regular automated checks for weaknesses across devices and servers are covered on our new Vulnerability scanning page. Day to day device support for users sits with managed IT. Where card payments or health records raise compliance questions, our security compliance support page explains how device settings feed into that work. Organizations unsure where to begin can start with a scored security audit.

Privacy rules for devices that carry personal information

Laptops and phones often hold personal information about clients, patients and staff, which brings privacy duties into device decisions.

Breach records and reporting

A missing laptop raises a reporting question. PIPEDA sets the test as a real risk of significant harm: where a breach of security safeguards meets it, the Privacy Commissioner of Canada and the people affected must be told, and every breach, reportable or not, has to be recorded. Whether the drive was encrypted, what files and saved sign-ins it held, and how quickly it was locked are the facts that weigh most in that judgment. Law 25 brings extra duties for Quebec organizations, and in Ontario, PHIPA governs health information custodians, which affects how a clinic issues tablets and charting laptops.

Authorization

We only install, configure or test protection on devices the organization owns or has written authorization to manage, and personal phones are managed only within a policy the user has agreed to. This is a marketing observation, not legal advice.

How an endpoint security engagement runs

A free review

We start by learning what devices you have, who owns them, what protection is on them now, whether staff use personal phones for work email, who currently looks after updates and how new hires get their laptops.

A custom proposal

You receive a custom proposal covering protection choice, encryption, patching routine, admin rights, phone management, alert handling, onboarding and offboarding, and reporting. Fees are quoted in writing, and protection or device management licences are shown separately and held in your organization’s name.

Rollout

Devices are brought on in groups, starting with a few willing staff, so issues with specific applications are found before everyone is affected. Staff receive a short note explaining what is changing on their machine and why.

Every month

Where ongoing care is part of the plan, you receive the monthly device report, and the register is kept current as people join and leave.

What endpoint security costs

Endpoint security is quoted in writing after the free review. Protection and device management licences are paid per device or per user to the vendor, in your name, and listed separately from our setup and care fees.

What drives the quote

• How many laptops, desktops, phones and tablets, and how many operating systems are in the mix.
• Whether existing licences in your productivity suite can be used or new protection is needed.
• How many devices are already encrypted and current, and how many need catching up.
• Whether personal phones are in scope, and how many people use them for work.
• How many line of business applications need testing with the new settings.
• Who will review alerts, and whether that is part of our scope.
• Whether the engagement is a one time rollout or includes monthly care and reporting.

An office where everyone uses the same laptop model and company phones is a simpler scope than a clinic group mixing older desktops, tablets at reception and personal phones for practitioners’ messages.

Choosing an endpoint security provider: questions to ask first

Endpoint protection runs on every machine your staff touch, so the provider choosing and configuring it carries a lot of trust.

• Who owns the accounts? The answer should be you, including the protection console, device management and every licence.
• Where are encryption recovery keys stored, and can we retrieve them without you?
• Who reads the alerts, and what happens when something serious appears outside office hours?
• How will personal phones be handled, and what will the organization be able to see on them?
• What will staff notice on their machines, and how will they be told?
• What is in the monthly report, and can I see a sample layout?
• How are devices wiped and recorded when someone leaves?

Signs of a weak answer

Be cautious when a provider installs protection in their own account, cannot tell you which devices are encrypted, leaves every user as an administrator, or sells protection without a plan for the alerts.

Get an endpoint security proposal sized to your devices

A rough device count is enough to begin: how many laptops and desktops, how many company phones, and how many people read work email on a personal phone. Add the name of whatever protection program is on the machines today if you know it. From there Canada Create will show you, device by device, where protection, encryption and updates stand in a free endpoint security review, and then send a custom proposal with fees quoted in writing.

Call (416) 273-9030, Monday to Friday, 9 am to 6 pm, and Saturday, 10 am to 2 pm. After hours, our 24/7 AI agent answers the toll-free line, +1 (800) 808-9235, and we’ll follow up the next business morning.

Prefer writing? Request an endpoint review, and we reply within one business day.

We are at 126 Willowdale Avenue, Suite 3, Toronto, protecting work devices across Canada.