Endpoint protection is host software that blocks unwanted programs and enforces rules about what may run on a user device.
It is a preventive control on the device, narrower than the full discipline of endpoint security and different from later investigation of what a host already did.
How it works
The software may stop known unwanted programs, control which applications are allowed, and report tampering with its own agent.
It reduces common harm, but it does not replace patching, limited privileges, or a person who investigates odd behavior that was not blocked.
Rules that are too strict stop legitimate work, and rules that are too loose allow anything a user downloads.
Owners need a way to approve an exception quickly and to remove it when the project ends.
Concrete examples
- A laptop blocks an unapproved remote administration tool that a staff member was about to run.
- A server allows only a short list of applications, and a new installer cannot start until a change is approved.
- The protection agent stops reporting, and that silence itself becomes an alert for the device owner.
Protective measures
- Deploy protection on every managed device and alert when the agent is missing or silent.
- Prefer an allow list for high value servers and a reviewed block approach for ordinary user laptops.
- Give staff a fast exception path with an expiry date so urgent work does not create a permanent hole.
- Do not treat this software as a substitute for updates, limited admin rights, or investigation of strange behavior.
Related articles
Configuration, updates, privileges, and monitoring together are the wider discipline in What is endpoint security?.
Watching what a host did over time, after prevention, is the subject of What is endpoint detection and response?.
A network control that complements on device blocking by filtering traffic between zones is What is a firewall?.