What Endpoint Security Measures Should Enterprises Implement to Prevent Cyberattacks?
The attack that needed no malware
In the early hours of 11 March 2026, employees at Stryker, the US medical technology company, switched on their laptops and found them wiped. Reports put the number of erased devices at roughly 80,000 across 79 countries, with no malware involved, only a compromised Intune administrator account. The group claiming responsibility said the true figure was above 200,000 systems and that it had taken 50 terabytes of data. Stryker said at the time it had no indication of ransomware or malware. Public reporting suggests the attackers used a Windows domain admin account to create a new Global Administrator, then issued remote wipe commands through Intune.
Every device in that estate presumably had an agent, a patch policy and a compliance score. It did not matter. The attacker had taken over the system that controls the endpoints, and used its own delete button.
That is the argument of this article. Endpoint security in 2026 is less about how well each laptop defends itself and more about how hard it is to take over everything around the laptop: identity, management consoles, drivers, update pipelines and backups. The controls below are ordered with that in mind.
What endpoint security measures should enterprises implement?
Enterprises should implement nine measures, roughly in this order of priority:
A complete asset inventory with fast patching of exposed and actively exploited systems
Phishing resistant MFA, starting with administrators
EDR or XDR with tamper protection and monitoring of the agent's own health
Hardened device baselines with least privilege and application and driver control
A locked down management plane (MDM, EDR console, domain admin)
Network segmentation to contain a compromised device quickly
Isolated, tested backups that survive a wiper attack
Retirement or isolation of unsupported systems
24x7 monitoring with real authority to isolate and respond
No single product delivers all nine. The sections below explain why each one earns its place.
What the 2026 data says about how endpoints are breached
The entry point has shifted to vulnerabilities. Verizon's 2026 DBIR found that vulnerability exploitation, at 31% of breaches, has overtaken stolen credentials, which fell to 13%. That is a 55% jump from the prior year's 20%. Defenders are not keeping pace. Only 26% of critical vulnerabilities in CISA's Known Exploited Vulnerabilities catalogue were fully remediated in 2025, down from 38%, and the median time to fix rose to 43 days.
Ransomware keeps growing, but paying is falling. Ransomware was involved in 48% of breaches, up from 44%, while 69% of victims did not pay. The median ransom paid fell to $139,875 from $150,000. The attackers' answer is to change tooling. Use of legitimate remote monitoring and management tools in intrusions rose 240% while Cobalt Strike fell 27%. Attackers are borrowing the tools your IT team uses.
Credentials still matter, just earlier in the chain. Verizon found that 73% of ransomware victims had an associated infostealer infection or credential leak within the year. Also, 83% of privilege escalation incidents involved no CVE exploitation at all, which is a reminder that patching alone does not close the path to domain admin.
Speed is the real problem. CrowdStrike's 2026 report puts average eCrime breakout time, the gap between first access and lateral movement, at 29 minutes, with the fastest case at 27 seconds. Compare that with IBM's figure for India, where identifying and containing a breach took 263 days on average. (Some media coverage of the same IBM report quoted 292 days. IBM's own release says 263, and that is the figure used here.)
The cost is rising in India. IBM reports an average breach cost of ₹22 crore in 2025, 13% higher than the year before. In India, phishing (18%), third party compromise (17%) and vulnerability exploitation (13%) were the leading attack vectors. CERT-In itself handled more than 29.44 lakh incidents in 2025. On the telemetry side, Seqrite recorded over 265 million detections across about 80 lakh endpoints between October 2024 and September 2025. That is vendor data counting detections, not breaches, but it shows the daily volume of noise.
Why this is now a board level and cost level issue
Two things changed. First, a single endpoint failure no longer stays local. Stryker's wipe reached every enrolled device, including personal phones in a bring your own device programme. Second, the penalty side moved. Under the DPDP Rules, the highest penalty in the schedule is ₹250 crore, and it attaches to the failure to maintain reasonable security safeguards. Endpoint controls are part of what "reasonable" will be measured against.
Our analysis: the useful way to present this to a board is not "we need more security tools". It is "we have a 29 minute window and a 43 day patch cycle, and here is how we close the gap."
Nine endpoint security measures, in priority order
1. Know every asset, then fix what is exposed first
Short answer: You cannot protect what you cannot see, and the highest return comes from fixing internet facing and actively exploited systems before everything else.
Verizon's analysis points to unmanaged and unsanctioned assets as a theme running through its findings. Start with an inventory that includes laptops, servers, VPN and firewall appliances, remote access tools, contractor devices and anything running outside your management tooling. Then patch by exploitation evidence, not severity score. Use the CISA KEV catalogue as a trigger list. A critical rated bug nobody is exploiting can wait a week. A medium rated one on a VPN gateway that appears in KEV cannot.
2. Make phishing resistant MFA the first endpoint control
Short answer: Stolen credentials are how attackers reach the tools that manage your endpoints, so strong authentication for administrators matters more than any agent.
SMS codes and push approvals can be relayed or fatigued. FIDO2 security keys and certificate based authentication bind the login to the legitimate site or device. Roll this out in stages: domain admins and cloud administrators first, then remote access, then everyone else. Pair it with an infostealer response routine. If a credential leak is detected for an employee, treat their device as compromised until proven otherwise.
3. Run EDR or XDR properly, not just install it
Short answer: EDR is essential, but it needs tamper protection, health monitoring and people watching it.
EDR records endpoint behaviour and lets you investigate and respond. XDR extends that by correlating endpoint with identity, email, network and cloud signals. Most enterprises will end up with XDR or MDR in practice because the Stryker style attack began in identity, not on the device. Whichever you choose, enable tamper protection, alert when an agent stops reporting, and treat a silent endpoint as a possible incident rather than a broken agent.
4. Harden the device itself
Short answer: Remove what attackers rely on: local admin rights, unneeded services, unsigned code and vulnerable drivers.
NIST CSF 2.0 expects uniform configurations and disabling of features that do not support the mission. Commentary on the framework points to the PR.PS subcategories for this and to CIS Benchmarks as a baseline. In practice that means a standard build, no standing local administrators, application allowlisting on servers and sensitive workstations, and Microsoft's vulnerable driver blocklist with memory integrity switched on. The last item matters because of the next section.
5. Lock down the management plane
Short answer: Your MDM, EDR console, directory and software deployment tools can erase or infect every endpoint at once, so they need the strongest controls you own.
After Stryker, CISA urged organizations to apply least privilege to administrative roles, enforce phishing resistant MFA and privileged access hygiene, and use conditional access to block unauthorized privileged actions. It also recommended multi admin approval, so that high impact actions such as a device wipe need a second administrator. Add a few more of our own: separate admin accounts from daily accounts, keep break glass accounts offline and monitored, alert on creation of any new global administrator, and limit what a BYOD enrolment can be wiped for. If your Intune or EDR console can wipe 50,000 devices with one account and one click, that is your highest risk asset.
6. Contain with segmentation
Short answer: Assume one device will be compromised, and design the network so that it cannot reach everything else in 29 minutes.
Segment user, server, OT and guest networks. Restrict lateral protocols such as SMB and RDP between workstations. Use identity aware access for admin tools. Network segmentation is also where NS3's networking expertise overlaps with security; a well designed network turns a breach into an incident rather than a crisis.
7. Build backups that survive a wiper
Short answer: Backups must be isolated, immutable and restore tested, because attackers now target them first and wipers leave nothing to negotiate over.
Verizon's finding that 69% of ransomware victims did not pay suggests recovery capability is working for many. But a wiper offers no decryption key at all. Keep one copy offline or immutable, keep backup credentials outside your main directory, and test a full restore of your top five systems at least twice a year. Include endpoints: if 80,000 laptops need reimaging, how many per day can you rebuild?
8. Retire what you cannot defend
Short answer: Unsupported operating systems cannot be made safe by adding an agent; replace, isolate or pay for extended updates deliberately.
This is timely. Windows 10 commercial ESU year one ends on 13 October 2026, year two costs $122 per device (double year one), and the licences are cumulative, so an organisation that skipped year one pays $183 for its first year. Windows 10 Enterprise LTSB 2016 also reaches end of support on 13 October 2026, with Windows Server 2016 following on 12 January 2027. For 500 devices, our arithmetic on Microsoft's list prices gives $61,000 for year two if you are already enrolled and $91,500 if you are not. When Windows 10 support ended last October, Kaspersky's customer data suggested it was still present on nearly 60% of corporate systems. That is dated, but it indicates how many Indian fleets still carry the exposure. Decide device by device: upgrade, ESU, isolate or retire.
9. Monitor around the clock, with authority to act
Short answer: Detection that waits for a 9 to 6 team is slower than the attacker, so you need continuous monitoring and pre approved response actions.
Attacks like Stryker's started at night. Whether you build an internal SOC or use a managed provider, define in advance what the monitoring team can do without waiting: isolate a host, disable an account, block a hash. Measure mean time to contain, not just alert counts. IBM found that Indian organisations using extensive AI and automation for detection and response saved ₹3.1 crore on average compared with those using it in a limited way.
The less obvious risks
EDR killers. Ransomware crews increasingly switch off your defences before encrypting anything. ESET tracks nearly 90 EDR killers in active use, most using the bring your own vulnerable driver technique. SentinelOne describes one ransomware as a service operation that ships its own killer to affiliates, hunting more than 400 processes across about 48 security products. The defence is layered: driver blocklists, tamper protection, alerts on agent silence, and a second source of visibility such as network or identity telemetry. Single agent strategies have a built in off switch.
Legitimate tools as weapons. The 240% rise in remote management tool abuse and the Stryker case share a lesson. Allowlist which remote tools may run, and alert on any others.
Shadow AI. IBM found shadow AI added ₹17.9 million to the average breach cost in India, and only 37% of Indian organisations had AI access controls in place. Employees pasting data into unapproved AI tools from managed laptops is an endpoint problem and a DPDP problem.
Compliance as paperwork. The new CERT-In audit model (below) tests evidence, so a policy document with no logs behind it will not hold.
Which regulations and guidelines apply in India
CERT-In directions (April 2022). They require reporting of specified incidents within 6 hours, system clock synchronisation with NPL, and log retention for 180 days. Endpoint and server logs must therefore flow somewhere central and stay for 180 days.
CERT-In Comprehensive Cyber Security Audit Policy Guidelines (25 July 2025). Organisations are expected to audit their ICT systems at least once a year, using CERT-In empanelled auditors. The audit must be driven by a complete, up to date asset inventory, including third party and vendor managed systems. For critical applications handling sensitive personal data, a 282 control point checklist is mandatory. Practically, this makes measure 1 a compliance requirement, not just good hygiene.
DPDP Act and Rules 2025. The Rules were notified on 13 November 2025, and the substantive duties, including security safeguards and breach intimation, apply from mid May 2027. Early in 2026, MeitY consulted on shortening the 18 month window to 12 months for significant data fiduciaries, and officials said no final decision had been taken. Check the current status before you set internal deadlines, and assume that large enterprises will not get extra time.
NIST CSF 2.0, CIS Controls v8.1 and NIST SP 800 61r3. These are not Indian mandates, but they are the reference frameworks auditors and customers use. NIST SP 800 61r3 aligns incident response with all six CSF 2.0 functions, so older four phase response plans need updating.
CISA's March 2026 alert on hardening endpoint management systems is guidance, not law, but it is the clearest official checklist for measure 5.
A 30, 60 and 90 day action plan
Days 1 to 30: Stop the bleeding
Decide the Windows 10 and 2016 LTSB question before 13 October, or accept the exposure in writing.
Enforce phishing resistant MFA on all privileged and management console access.
Turn on multi admin approval for wipe and bulk actions; alert on new global administrators.
List every internet facing system and cross check against the KEV catalogue.
Days 31 to 60: Close the gaps
Complete the asset inventory, including contractors and BYOD.
Enable tamper protection and agent health alerting everywhere.
Apply the driver blocklist and remove standing local admin.
Confirm 180 day central log retention and NPL time sync.
Days 61 to 90: Prove it works
Run a restore test for the top five systems and time a mass reimage drill.
Run a tabletop on "our MDM console is compromised at 3 a.m."
Map controls to the CERT-In baseline and DPDP safeguards.
Review SOC response authority and mean time to contain.
What changes over the next two to five years
Forecasts, not facts. Gartner has named preemptive cybersecurity a top strategic trend for 2026 and predicts that by 2028, products without preemptive capabilities will lose market relevance. Expect endpoint tools to add exposure validation, deception and automated hardening, and expect vendors to sell consolidated platforms. Speed will keep falling: CrowdStrike reports AI enabled adversary activity up 89% in 2025, so manual triage will struggle. Destructive attacks tied to geopolitics may become more common; analysts described Stryker as part of Handala's shift from espionage towards disruption. Finally, expect Windows 10 ESU costs to peak at $244 per device in year three, which makes migration the cheaper path for most fleets.
How NS3TechSolutions Strengthens Endpoint Security for Enterprises
Endpoint security sits across several disciplines that rarely share a team: network design, identity, cloud, device management and monitoring. NS3TechSolutions works across IT infrastructure, enterprise networking, cybersecurity, cloud and managed services, including SOC and NOC capabilities, so the conversation is about the full path an attacker would take and not one product.
Where that is useful in practice:
Assessment and consulting: an endpoint and management plane review mapped to CERT-In and DPDP expectations.
Network security and segmentation: limiting lateral movement.
Deployment: standardised builds and rollout of agents across sites.
Managed monitoring: SOC and NOC coverage so that detection and response do not depend on office hours.
The test of any partner is whether they challenge your assumptions, for example by asking who can wipe your fleet today and how long a mass rebuild would take.
Endpoint security checklist
Save this and send it to your team.
Asset inventory covers laptops, servers, BYOD, contractor and OT devices
KEV driven patching with a target time for internet facing systems
Phishing resistant MFA on all administrator and console accounts
Separate admin and daily accounts; break glass accounts monitored
Multi admin approval on wipe, retire and bulk deployment actions
Alert on new global or domain administrators
EDR or XDR on all supported devices with tamper protection enabled
Alert when an agent goes silent
Driver blocklist and memory integrity enabled
No standing local admin; application control on servers
Segmentation between user, server and sensitive networks
Immutable or offline backups with credentials outside the main directory
Restore and mass reimage tested in the last six months
Unsupported OS plan decided for each device
180 day central logs and NPL time sync
24x7 monitoring with pre approved isolation authority
Annual audit scoped to CERT-In guidelines
FAQ
Q. What endpoint security measures should enterprises implement first?
A. Start with identity and management: phishing resistant MFA for administrators, multi admin approval on device management consoles, and fast patching of internet facing systems. These close the paths used in the largest recent attacks.
Q. Is EDR enough to prevent ransomware?
A. No. EDR is necessary but attackers actively disable it. ESET tracks nearly 90 EDR killers. You also need hardening, driver control, backups, segmentation and monitoring that notices when the agent goes quiet.
Q. What is the difference between EDR, XDR and MDR?
A. EDR monitors and responds on endpoints. XDR correlates endpoint with identity, email, network and cloud data. MDR is a service where a provider's analysts run detection and response for you. Many enterprises combine XDR tooling with an MDR or SOC service.
Q. What is BYOVD and why does it matter?
A. Bring your own vulnerable driver means attackers load a legitimately signed but flawed driver to gain kernel access and terminate security software. Block known vulnerable drivers, enable memory integrity and alert on agent tampering.
Q. Does the DPDP Act require specific endpoint controls?
A. It requires reasonable security safeguards and prescribes a penalty of up to ₹250 crore for failing that duty. It does not list products, so endpoint hardening, access control, logging and breach detection are how you demonstrate "reasonable".
Q. What should we do about Windows 10 devices now?
A. Classify each device: upgrade to Windows 11, buy ESU, isolate, or retire. Year one ESU ends on 13 October 2026, and year two is $122 per device, with cumulative licensing for late joiners.
Q. How often should we audit endpoint security?
A. CERT-In's July 2025 guidelines expect a comprehensive audit of ICT systems at least annually by an empanelled auditor. Test restores and run a management console compromise exercise at least twice a year in addition.
The takeaway
The best endpoint programmes in 2026 will not be the ones with the longest list of tools. They will be the ones that can answer three uncomfortable questions: who can wipe or reconfigure every device you own, how fast would you know if your security agent was switched off, and how long would a full rebuild take? Stryker was operational again within weeks, but the 80,000 devices were gone in hours. Answer those three questions on paper this month, and the rest of the checklist becomes a plan rather than a hope.