What Is an Endpoint? Endpoints in IT and Networking Explained

What is an endpoint? It is any physical or virtual device that connects to a network and exchanges data with it, such as a laptop, phone, server, virtual machine or smart camera. The word also has two narrower meanings in networking and software, and mixing them up is how devices go missing from security plans.

What Is an Endpoint?

An endpoint is any physical or virtual device at the edge of a network that sends or receives data. Laptops, desktops, smartphones, tablets, servers, virtual machines and Internet of Things (IoT) devices are all endpoints. Each one is a possible entry point for attackers, so each one needs to be known, managed and protected.

The National Institute of Standards and Technology (NIST) glossary, citing NIST SP 800-63-4 (2025), defines an endpoint as “any device that is used to access a digital identity on a network, such as laptops, desktops, mobile phones, tablets, servers, Internet of Things devices, and virtual environments.”

Common examples include:

• Laptops, desktops and workstations
• Smartphones and tablets, including personal ones used for work
• Physical servers, virtual machines and cloud workloads
• Printers, point-of-sale (POS) terminals and VoIP phones
• IoT and operational technology (OT) devices such as cameras, door controllers and sensors

Endpoint Meaning in Plain English

Think of a network as a road system. The roads, junctions and traffic lights are the network equipment. The endpoints are the houses and shops at the end of each road, where people live, work and keep valuables. Burglars do not break into the road; they break into the buildings.

Three Meanings of “Endpoint”: IT, Networking and APIs Compared

Search for “endpoint” and you will find three different answers, depending on who is talking. All three describe the end of a connection, but they point at different things and need different protection.

Factor	Endpoint in IT and security	Endpoint in networking	API endpoint
What it is	A device people or systems use	Any device at either end of a network conversation	A URL where an application accepts requests
Examples	Laptop, phone, server, VM	Client, server, host with an IP address	/api/orders on a web app
Who manages it	IT and security teams	Network teams	Developers and DevOps
Main risks	Malware, ransomware, stolen credentials	Unauthorized devices, spoofing	Broken authorization, data exposure
Typical controls	Patching, EDR, device management	Network access control, segmentation	Authentication, rate limits, API inventory

For security planning, the IT meaning matters most, because it is the list of devices your controls must cover. The networking and API meanings matter when you design access rules and build applications.

What Is an Endpoint in IT?

In IT, an endpoint is a managed asset: a device your organization must inventory, configure, patch and retire. The IT view cares less about where the device sits on the network and more about its state. Is it on the asset list? Is it encrypted? Is it running supported software? Who is responsible for it?

Who Owns and Manages Endpoints

Ownership is often split. IT usually handles provisioning, updates and device management. Security handles detection and response. In a small business, both jobs often fall to one person or a managed service provider (MSP). Write down who owns each task, or patching and alert review will fall between the gaps.

What Is an Endpoint in Networking?

In networking, an endpoint is any device at either end of a communication session, identified by an address such as an IP address. A laptop browsing a website and the web server answering it are both endpoints in that conversation. The term “host” means much the same thing, while “node” is broader and includes any device on the network, including routers and switches.

What Is Not an Endpoint?

Routers, switches and firewalls are generally classed as network infrastructure, not endpoints, because they pass traffic along instead of being where it starts or ends. The line blurs, though. A router’s management interface is still a device attackers can target, and Cyber Essentials (Requirements for IT Infrastructure v3.3, 2026) puts a home worker’s router in scope if the organization supplied it. Treat infrastructure as part of the attack surface even when it is not called an endpoint.

Endpoint Device vs API Endpoint

An API (application programming interface) endpoint is not a device. It is an address, usually a URL, where an application accepts requests and returns data. A mobile banking app talks to API endpoints on the bank’s servers to fetch balances.

API endpoints carry their own risks. The OWASP API Security Top 10 (2023) lists “Improper Inventory Management” as a top risk: old or undocumented API endpoints that nobody remembers to secure. That is the same problem as forgotten laptops, in software form.

Why Endpoints Are a Top Security Risk

Endpoints are where people click links, enter passwords and open files, so they are where most attacks start. Verizon’s 2026 Data Breach Investigations Report (DBIR) found that, among ransomware victims with an earlier credential or infostealer event, 50% had that event within 95 days of the ransomware attack. Infostealers are malware that copy saved passwords and session tokens from an infected device, often a personal laptop or home computer.

The same report notes that some phishing detections on phones were only visible because those devices were managed. If employees use “purely unmanaged personal devices” for work, Verizon warns, that “can represent a risky gap in your visibility.”

The Unmanaged and BYOD Endpoint Problem

Here is an illustrative example. A bookkeeper at a 15-person firm checks client email on a personal tablet that the company does not manage. The tablet picks up an infostealer from a fake app download. The company’s antivirus never sees it, because it is not installed there. A week later, an attacker signs in to the bookkeeper’s email using a stolen session token.

That tablet was an endpoint the whole time. It just was not on anyone’s list. For UK firms, Cyber Essentials v3.3 (2026) closes the loophole on paper: user-owned devices that access organizational data or services are in scope, and so are corporate or bring your own device (BYOD) home working devices. Devices used only for native voice calls, text messages or MFA apps are out of scope.

The practical decision rule: if a device can open company email, files or cloud apps, count it as an endpoint. Then either bring it under management or block it from company data.

How to Find and Protect Every Endpoint

You cannot protect devices you do not know about, so protection starts with discovery. In most SMB environments we review, the real endpoint count is higher than the asset list, usually because of personal phones, old servers and smart devices nobody logged.

Step 1: Build an Endpoint Inventory

Combine three sources: your device management console, your identity provider’s sign-in logs (which show every device that has accessed accounts) and a network scan or router client list. Any device in one list but missing from the others needs an owner or removal.

Step 2: Manage Before You Protect

Endpoint management, through mobile device management (MDM) or unified endpoint management (UEM), controls configuration: encryption, updates, passcodes and remote wipe. Endpoint security detects and stops threats. You need both. The NCSC’s device security guidance covers choosing, configuring and managing devices on Windows, macOS, iOS, Android and ChromeOS, and is a sound baseline for either country.

Step 3: Choose the Right Protection Layer

• Endpoint protection platform (EPP): prevention, including antivirus and exploit blocking.
• Endpoint detection and response (EDR): continuous monitoring and response. The US Office of Management and Budget memo M-22-01 (2021) describes EDR as combining “real-time continuous monitoring and collection of endpoint data” with “rules-based automated response and analysis capabilities.”
• Extended detection and response (XDR): connects endpoint data with email, identity and cloud signals.

Cyber Essentials v3.3 (2026) also requires a malware protection mechanism to be active on all devices in scope.

Step 4: Review and Retire on a Schedule

Endpoints drift out of control when nobody checks. Once a month, compare the device management console with the protection console: every managed device should report a healthy security agent, and every protected device should be managed. Remove leavers’ devices promptly, wipe and retire hardware that no longer receives security updates, and block sign-ins from devices that fail health checks. This one monthly comparison catches most of the silent gaps.

Can You Name Every Endpoint on Your Network Today?

What is an endpoint, in practice? It is every device that can reach your data, whether or not your company bought it. Here is the test: could you list every laptop, phone, server, printer and cloud machine that touched company data last month, and name who manages each one? If not, pull your identity provider’s device sign-in report this week, compare it with your asset list, and if you want help closing the gaps it reveals, Cyber Security Solutions Ltd offers a free, no-obligation cyber security assessment, available through our contact page.