{"id":1148,"date":"2026-09-10T11:29:05","date_gmt":"2026-09-10T11:29:05","guid":{"rendered":"https:\/\/www.osto.one\/resources\/?p=1148"},"modified":"2026-09-10T11:29:05","modified_gmt":"2026-09-10T11:29:05","slug":"epp","status":"publish","type":"post","link":"https:\/\/www.osto.one\/resources\/glossary\/epp\/","title":{"rendered":"EPP"},"content":{"rendered":"\n<!-- =========================================================================\n     OSTO GLOSSARY: EPP (ENDPOINT PROTECTION PLATFORM)\n     Live osto.one glossary stylesheet. Paste into one Custom HTML block. No H1.\n     ========================================================================= -->\n\n<style>\n.og{\n  --navy:#1c267a; --text:#0f1538; --muted:#0f1538; --light:#0f1538;\n  --border:#e7e9f2; --divider:#eceef5; --white:#ffffff;\n\n  --peri-50:#f4f5fd;  --peri-100:#e9ecfa; --peri-200:#cfd5f2; --peri-700:#4a52a8;\n  --sage-50:#f2f8f5;  --sage-100:#e3f0e9; --sage-200:#c3ddce; --sage-700:#3a6f5d;\n  --apri-50:#fdf6f0;  --apri-100:#fbe9dc; --apri-200:#f2cdb2; --apri-700:#a2603a;\n  --plum-50:#f8f3f9;  --plum-100:#f0e6f3; --plum-200:#dcc6e2; --plum-700:#6b4576;\n  --sky-50:#f1f7fb;   --sky-100:#e2eff7;  --sky-200:#bfd9e9;  --sky-700:#2f6a89;\n\n  --shadow:0 6px 22px rgba(15,21,56,.05);\n  --font:'Inter',-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,sans-serif;\n  font-family:var(--font); font-size:17px; line-height:1.75; color:var(--text);\n}\n.og p{margin:0 0 22px}\n.og h2{font-family:var(--font);font-size:clamp(25px,3vw,31px);font-weight:700;line-height:1.25;letter-spacing:-.5px;color:var(--navy);margin:52px 0 8px;scroll-margin-top:92px}\n.og h2::after{content:\"\";display:block;width:46px;height:5px;border-radius:3px;margin:12px 0 18px;background:var(--peri-200)}\n.og h2.c-sage::after{background:var(--sage-200)}\n.og h2.c-apri::after{background:var(--apri-200)}\n.og h2.c-plum::after{background:var(--plum-200)}\n.og h2.c-sky::after{background:var(--sky-200)}\n.og ul,.og ol{padding-left:22px;margin:0 0 24px}\n.og li{margin-bottom:9px}\n.og strong{font-weight:600}\n\n.og .dek{font-size:20px;line-height:1.6;color:var(--muted);margin:0 0 18px}\n.og .tags{margin:0 0 30px;padding:0;list-style:none;display:flex;flex-wrap:wrap;gap:8px}\n.og .tags li{margin:0}\n.og .tag{display:inline-block;font-size:12px;font-weight:600;letter-spacing:.7px;text-transform:uppercase;padding:6px 13px;border-radius:20px}\n.og .t-peri{background:var(--peri-100);color:var(--peri-700)}\n.og .t-sage{background:var(--sage-100);color:var(--sage-700)}\n\n.og .short{background:linear-gradient(135deg,var(--peri-100) 0%,var(--sage-100) 100%);border-radius:22px;padding:28px 32px;margin:0 0 30px}\n.og .short .k{font-size:13px;font-weight:700;letter-spacing:1.4px;text-transform:uppercase;color:var(--peri-700);margin:0 0 10px}\n.og .short p{font-size:19px;line-height:1.65;margin:0;color:var(--text)}\n\n.og .toc{background:var(--peri-50);border-radius:20px;padding:24px 28px;margin:0 0 34px}\n.og .toc .k{font-size:12px;font-weight:700;letter-spacing:1.3px;text-transform:uppercase;color:var(--peri-700);margin:0 0 12px}\n.og .toc ol{margin:0;padding-left:20px;columns:2;column-gap:34px}\n.og .toc li{margin-bottom:8px;break-inside:avoid;font-size:16px}\n.og .toc a{color:var(--navy);text-decoration:none;border-bottom:1px solid rgba(28,38,122,.22)}\n\n.og .callout{border-radius:4px;padding:24px 28px;margin:0 0 30px;background:var(--white);border:2px solid var(--navy)}\n.og .callout .k{font-weight:700;font-size:17px;margin:0 0 8px;color:var(--navy)}\n.og .callout p:last-child{margin-bottom:0}\n.og .callout.c-plum{background:var(--plum-50);border:none;border-radius:20px}\n.og .callout.c-plum .k{color:var(--plum-700)}\n\n.og figure{margin:0 0 30px}\n.og .sx{overflow-x:auto;-webkit-overflow-scrolling:touch;border-radius:20px;background:var(--white);box-shadow:var(--shadow)}\n.og .sx svg{display:block;width:100%;height:auto;min-width:600px}\n.og figcaption{font-size:14px;line-height:1.6;color:var(--muted);margin-top:12px}\n.og .swipe{display:none}\n\n.og table{width:100%;border-collapse:collapse;margin:0 0 28px;font-size:15px;background:var(--white);border-radius:18px;overflow:hidden;box-shadow:var(--shadow)}\n.og th{text-align:left;padding:14px 16px;font-weight:700;font-size:12.5px;letter-spacing:.8px;text-transform:uppercase}\n.og td{border-bottom:1px solid var(--divider);padding:13px 16px;vertical-align:top;line-height:1.6}\n.og tr:last-child td{border-bottom:none}\n.og .h-peri th{background:var(--peri-100);color:var(--peri-700)}\n.og .h-sage th{background:var(--sage-100);color:var(--sage-700)}\n.og .h-plum th{background:var(--plum-100);color:var(--plum-700)}\n\n.og .trio{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:0 0 28px}\n.og .tcard{border-radius:18px;padding:20px 22px}\n.og .tcard .n{font-size:16px;font-weight:700;margin:0 0 4px}\n.og .tcard .g{font-size:13px;font-weight:600;margin:0 0 10px;opacity:.8}\n.og .tcard p{font-size:14px;line-height:1.55;margin:0;color:var(--muted)}\n.og .tcard.a{background:var(--sky-50)}   .og .tcard.a .n,.og .tcard.a .g{color:var(--sky-700)}\n.og .tcard.b{background:var(--sage-50)}  .og .tcard.b .n,.og .tcard.b .g{color:var(--sage-700)}\n.og .tcard.c{background:var(--plum-50)}  .og .tcard.c .n,.og .tcard.c .g{color:var(--plum-700)}\n\n.og .pill{display:inline-block;font-size:11px;font-weight:700;letter-spacing:.8px;text-transform:uppercase;padding:5px 11px;border-radius:20px;white-space:nowrap}\n.og .p-req{background:var(--plum-200);color:#4d2f57}\n.og .p-exp{background:var(--sky-100);color:var(--sky-700)}\n.og .p-imp{background:#eef0f4;color:var(--muted)}\n.og .p-ask{background:var(--apri-100);color:var(--apri-700)}\n.og .p-yes{background:var(--sage-100);color:var(--sage-700)}\n.og .p-no{background:#eef0f4;color:var(--muted)}\n\n.og details{background:var(--white);border-radius:14px;margin:0 0 10px;box-shadow:0 2px 10px rgba(15,21,56,.04)}\n.og summary{cursor:pointer;padding:16px 20px;font-weight:600;font-size:17px;color:var(--navy);list-style:none;display:flex;justify-content:space-between;gap:16px;align-items:flex-start}\n.og summary::-webkit-details-marker{display:none}\n.og summary::after{content:\"+\";font-size:22px;line-height:1;color:var(--peri-700);flex:0 0 auto}\n.og details[open] summary::after{content:\"\\2013\"}\n.og details p{padding:0 20px 18px;margin:0;font-size:16px;line-height:1.7}\n\n.og .related{font-size:15px;color:var(--muted);border-top:1px solid var(--divider);padding-top:22px;margin-top:40px}\n\n@media(max-width:700px){\n  .og{font-size:16px}\n  .og .dek{font-size:18px}\n  .og .short p{font-size:17px}\n  .og .short,.og .toc,.og .callout{padding:22px 20px}\n  .og .toc ol{columns:1}\n  .og .trio{grid-template-columns:1fr}\n  .og .swipe{display:inline;font-weight:600;color:var(--peri-700)}\n  .og table{font-size:14px}\n  .og th,.og td{padding:11px 12px}\n}\n<\/style>\n\n<div class=\"og\">\n\n<p class=\"dek\">EPP is the prevention layer on the endpoint. It stops what it recognises before anything runs, which is most attacks and never all of them.<\/p>\n\n<ul class=\"tags\">\n  <li><span class=\"tag t-peri\">Glossary<\/span><\/li>\n  <li><span class=\"tag t-sage\">Endpoint<\/span><\/li>\n<\/ul>\n\n<div class=\"short\">\n  <p class=\"k\">The short answer<\/p>\n  <p>EPP stands for endpoint protection platform: the software on laptops, servers and workstations that blocks malware, controls which applications and devices are allowed, and enforces disk encryption. It is the descendant of antivirus, broadened well beyond signature matching. It works by preventing. It is not designed to investigate what happened when prevention fails.<\/p>\n<\/div>\n\n<p>Nearly every question about EPP is really a question about where it ends and <a href=\"https:\/\/www.osto.one\/resources\/glossary\/edr\/\">EDR<\/a> begins. The short version is that one keeps things out and the other tells you what to do once something got in.<\/p>\n\n<div class=\"toc\">\n  <p class=\"k\">On this page<\/p>\n  <ol>\n    <li><a href=\"#functions\">The five EPP functions<\/a><\/li>\n    <li><a href=\"#edr\">EPP and EDR are different jobs<\/a><\/li>\n    <li><a href=\"#misses\">What EPP does not catch<\/a><\/li>\n    <li><a href=\"#frameworks\">Where frameworks require EPP<\/a><\/li>\n    <li><a href=\"#osto\">How Osto handles EPP<\/a><\/li>\n    <li><a href=\"#faq\">FAQ<\/a><\/li>\n  <\/ol>\n<\/div>\n\n<h2 id=\"functions\">The five EPP functions<\/h2>\n\n<p>Modern EPP is a suite rather than a single scanner. These five are what auditors and buyers expect to see when they ask about endpoint protection.<\/p>\n\n<table class=\"h-peri\">\n  <thead>\n    <tr><th>Function<\/th><th>What it does<\/th><\/tr>\n  <\/thead>\n  <tbody>\n    <tr><td><strong>Anti-malware<\/strong><\/td><td>Blocks known malicious files by signature and unknown ones by behaviour, before execution where possible<\/td><\/tr>\n    <tr><td><strong>Application control<\/strong><\/td><td>Decides which software is permitted to run, which stops a large class of attacks without needing to recognise them first<\/td><\/tr>\n    <tr><td><strong>Device control<\/strong><\/td><td>Governs removable media and peripherals, closing the USB path for both malware in and data out<\/td><\/tr>\n    <tr><td><strong>Disk encryption<\/strong><\/td><td>Protects data on a lost or stolen machine, and is usually the fastest question to answer on a <a href=\"https:\/\/www.osto.one\/resources\/glossary\/security-questionnaire\/\">security questionnaire<\/a><\/td><\/tr>\n    <tr><td><strong>Host protection policy<\/strong><\/td><td>Screen lock, firewall posture and web filtering enforced centrally rather than left to each user<\/td><\/tr>\n  <\/tbody>\n<\/table>\n\n<h2 id=\"edr\" class=\"c-sage\">EPP and EDR are different jobs<\/h2>\n\n<figure>\n<div class=\"sx\">\n<svg viewBox=\"0 0 760 186\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" role=\"img\" aria-label=\"Where EPP stops and EDR begins across prevent, detect, investigate and respond.\">\n  <defs><marker id=\"eppA\" markerWidth=\"8\" markerHeight=\"8\" refX=\"6.5\" refY=\"4\" orient=\"auto\"><path d=\"M0,0 L8,4 L0,8 z\" fill=\"#a2603a\"\/><\/marker><\/defs>\n\n  <rect x=\"12\" y=\"46\" width=\"176\" height=\"70\" rx=\"13\" fill=\"#1c267a\"\/>\n  <text x=\"100\" y=\"74\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"12.5\" font-weight=\"700\" fill=\"#ffffff\">Prevent<\/text>\n  <text x=\"100\" y=\"95\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"10.5\" fill=\"#b9c1e6\">Block it before it runs<\/text>\n  <line x1=\"192\" y1=\"81\" x2=\"210\" y2=\"81\" stroke=\"#a2603a\" stroke-width=\"2\" marker-end=\"url(#eppA)\"\/>\n\n  <rect x=\"216\" y=\"46\" width=\"168\" height=\"70\" rx=\"13\" fill=\"#fbe9dc\"\/>\n  <text x=\"300\" y=\"74\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"12.5\" font-weight=\"700\" fill=\"#a2603a\">Detect<\/text>\n  <text x=\"300\" y=\"95\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"10.5\" fill=\"#0f1538\">Notice it running<\/text>\n  <line x1=\"388\" y1=\"81\" x2=\"406\" y2=\"81\" stroke=\"#a2603a\" stroke-width=\"2\" marker-end=\"url(#eppA)\"\/>\n\n  <rect x=\"412\" y=\"46\" width=\"168\" height=\"70\" rx=\"13\" fill=\"#fbe9dc\"\/>\n  <text x=\"496\" y=\"74\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"12.5\" font-weight=\"700\" fill=\"#a2603a\">Investigate<\/text>\n  <text x=\"496\" y=\"95\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"10.5\" fill=\"#0f1538\">Trace what it touched<\/text>\n  <line x1=\"584\" y1=\"81\" x2=\"602\" y2=\"81\" stroke=\"#a2603a\" stroke-width=\"2\" marker-end=\"url(#eppA)\"\/>\n\n  <rect x=\"608\" y=\"46\" width=\"140\" height=\"70\" rx=\"13\" fill=\"#f2cdb2\"\/>\n  <text x=\"678\" y=\"74\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"12.5\" font-weight=\"700\" fill=\"#a2603a\">Respond<\/text>\n  <text x=\"678\" y=\"95\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"10.5\" fill=\"#0f1538\">Isolate and remove<\/text>\n\n  <rect x=\"12\" y=\"16\" width=\"176\" height=\"24\" rx=\"8\" fill=\"#e9ecfa\"\/>\n  <text x=\"100\" y=\"33\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"11\" font-weight=\"700\" fill=\"#4a52a8\">EPP<\/text>\n\n  <rect x=\"216\" y=\"16\" width=\"532\" height=\"24\" rx=\"8\" fill=\"#f2cdb2\"\/>\n  <text x=\"482\" y=\"33\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"11\" font-weight=\"700\" fill=\"#a2603a\">EDR<\/text>\n\n  <rect x=\"12\" y=\"128\" width=\"736\" height=\"42\" rx=\"13\" fill=\"#e3f0e9\"\/>\n  <text x=\"380\" y=\"154\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"12.5\" font-weight=\"700\" fill=\"#3a6f5d\">They are layers, not competitors. Prevention reduces volume so the response layer stays usable.<\/text>\n<\/svg>\n<\/div>\n<\/figure>\n\n<table class=\"h-sage\">\n  <thead>\n    <tr><th><\/th><th>EPP<\/th><th><a href=\"https:\/\/www.osto.one\/resources\/glossary\/edr\/\">EDR<\/a><\/th><\/tr>\n  <\/thead>\n  <tbody>\n    <tr><td>Purpose<\/td><td>Stop the threat executing<\/td><td>Find and contain what is already executing<\/td><\/tr>\n    <tr><td>Model<\/td><td>Signatures, behaviour rules and policy<\/td><td>Continuous recording of endpoint activity<\/td><\/tr>\n    <tr><td>Output<\/td><td>A block, usually silent<\/td><td>An alert with a timeline and a containment action<\/td><\/tr>\n    <tr><td>Who operates it<\/td><td>Largely automatic once configured<\/td><td>Needs somebody to triage what it surfaces<\/td><\/tr>\n    <tr><td>Value to an audit<\/td><td>Demonstrates a preventive control<\/td><td>Demonstrates detection and <a href=\"https:\/\/www.osto.one\/resources\/glossary\/incident-response\/\">response<\/a> capability<\/td><\/tr>\n  <\/tbody>\n<\/table>\n\n<div class=\"callout\">\n  <p class=\"k\">Prevention is the cheapest control you own<\/p>\n  <p>Every threat an EPP blocks is one that never becomes an alert, an investigation or an incident. Teams that skip prevention and buy detection alone end up paying for the same threats twice, once in tooling and again in the time spent triaging events that never needed to happen.<\/p>\n<\/div>\n\n<h2 id=\"misses\" class=\"c-plum\">What EPP does not catch<\/h2>\n\n<table class=\"h-plum\">\n  <thead>\n    <tr><th>Attack<\/th><th>Why prevention alone struggles<\/th><\/tr>\n  <\/thead>\n  <tbody>\n    <tr><td>Stolen credentials<\/td><td>Nothing malicious executes. A valid login is not a file to block, which is why <a href=\"https:\/\/www.osto.one\/resources\/glossary\/iam\/\">identity controls<\/a> matter alongside it<\/td><\/tr>\n    <tr><td>Living off the land<\/td><td>The attacker uses tools already installed and trusted on the machine<\/td><\/tr>\n    <tr><td>Fileless techniques<\/td><td>Activity happens in memory or through scripting, leaving little for a file scanner to inspect<\/td><\/tr>\n    <tr><td>Insider misuse<\/td><td>An authorised person doing something they are permitted to do, which is a <a href=\"https:\/\/www.osto.one\/resources\/glossary\/dlp\/\">data loss<\/a> problem rather than a malware one<\/td><\/tr>\n    <tr><td>Slow, quiet activity<\/td><td>Individually unremarkable actions spread over weeks, visible only when <a href=\"https:\/\/www.osto.one\/resources\/glossary\/siem\/\">correlated<\/a> across systems<\/td><\/tr>\n    <tr><td>Supply chain compromise<\/td><td>The malicious code arrives inside software you deliberately installed and trusted<\/td><\/tr>\n  <\/tbody>\n<\/table>\n\n<h2 id=\"frameworks\" class=\"c-sky\">Where frameworks require EPP<\/h2>\n\n<table class=\"h-peri\">\n  <thead>\n    <tr><th>Framework<\/th><th>What it expects<\/th><\/tr>\n  <\/thead>\n  <tbody>\n    <tr><td><a href=\"https:\/\/www.osto.one\/resources\/glossary\/pci-dss\/\">PCI DSS<\/a><\/td><td>Requirement 5 covers protection against malicious software, with defined scope and evidence that it is active and current<\/td><\/tr>\n    <tr><td><a href=\"https:\/\/www.osto.one\/resources\/glossary\/iso-27001\/\">ISO 27001<\/a><\/td><td><a href=\"https:\/\/www.osto.one\/resources\/glossary\/annex-a-controls\/\">Annex A controls<\/a> for protection against malware and management of endpoint devices<\/td><\/tr>\n    <tr><td><a href=\"https:\/\/www.osto.one\/resources\/glossary\/soc-2\/\">SOC 2<\/a><\/td><td>Preventive controls over infrastructure and software, evidenced as operating across the observation window<\/td><\/tr>\n    <tr><td>HIPAA<\/td><td>Protection from malicious software as part of the security awareness and technical safeguards<\/td><\/tr>\n    <tr><td>RBI and SEBI frameworks<\/td><td>Endpoint protection with centrally managed policy and coverage reporting for regulated entities<\/td><\/tr>\n    <tr><td><a href=\"https:\/\/www.osto.one\/resources\/glossary\/dpdp-act\/\">DPDP Act<\/a><\/td><td>Reasonable security safeguards, which in practice includes protecting the devices personal data reaches<\/td><\/tr>\n  <\/tbody>\n<\/table>\n\n<p>What gets sampled in all of them is coverage rather than product choice. A deployment report showing every device enrolled, protection enabled and definitions current answers the question. A licence count does not.<\/p>\n\n<h2 id=\"osto\">How Osto handles EPP<\/h2>\n\n<p>The EPP functions run from the same agent as the rest of the platform rather than as a separate product to deploy and manage. Endpoint antimalware, application control, device control, disk encryption and screen lock policy are configured centrally, alongside <a href=\"https:\/\/www.osto.one\/resources\/glossary\/dlp\/\">file access controls<\/a> and <a href=\"https:\/\/www.osto.one\/resources\/glossary\/mdm\/\">device management<\/a>.<\/p>\n\n<p>The advantage is on the layer above. Endpoint events feed <a href=\"https:\/\/www.osto.one\/resources\/glossary\/siem\/\">the same SIEM<\/a> as cloud, identity and application activity, so a blocked execution followed by an unusual login and a new access key reads as one chain rather than three tools each reporting something minor. Coverage reporting maps to <a href=\"https:\/\/www.osto.one\/resources\/glossary\/pci-dss\/\">PCI DSS<\/a>, <a href=\"https:\/\/www.osto.one\/resources\/glossary\/soc-2\/\">SOC 2<\/a> and <a href=\"https:\/\/www.osto.one\/resources\/glossary\/iso-27001\/\">ISO 27001<\/a> from one control set, feeding the <a href=\"https:\/\/www.osto.one\/resources\/glossary\/grc\/\">GRC<\/a> evidence base without a separate export.<\/p>\n\n<!-- ============ CTA ============ -->\n<div style=\"background:linear-gradient(135deg,#1c267a 0%,#3f4796 48%,#6b4576 100%);border-radius:22px;padding:38px 34px;margin:40px 0 12px;box-shadow:0 10px 26px rgba(28,38,122,.2);text-align:center;\">\n  <p style=\"display:inline-block;background:rgba(255,255,255,.16);color:#ffffff;font-family:'Inter',-apple-system,sans-serif;font-size:11px;font-weight:700;letter-spacing:1.2px;text-transform:uppercase;padding:6px 14px;border-radius:20px;margin:0 0 16px;\">Platform walkthrough<\/p>\n  <p style=\"color:#ffffff;font-family:'Inter',-apple-system,sans-serif;font-size:26px;line-height:1.3;font-weight:700;letter-spacing:-.4px;margin:0 0 12px;\">One agent, not five<\/p>\n  <p style=\"color:#cfd3ea;font-family:'Inter',-apple-system,sans-serif;font-size:16px;line-height:1.65;margin:0 auto 26px;max-width:520px;\">Antimalware, application control, device control, disk encryption and screen lock from the same agent that feeds your cloud and identity signals. One owner, one dashboard.<\/p>\n  <a href=\"https:\/\/osto.one\/book-demo\/\" style=\"display:inline-block;background:#ffffff;color:#1c267a;font-family:&#039;Inter&#039;,-apple-system,sans-serif;font-weight:700;font-size:16px;text-decoration:none;border-bottom:none;padding:14px 32px;border-radius:12px;margin:0;\" target=\"_blank\" rel=\"noopener\"><span style=\"color:#1c267a;\">Book a demo<\/span><\/a>\n  <p style=\"color:#b3b8d8;font-family:'Inter',-apple-system,sans-serif;font-size:13px;margin:18px 0 0;\">Coverage reporting built in &middot; 200+ frameworks mapped &middot; One platform, everything<\/p>\n<\/div>\n\n\n<h2 id=\"faq\">Frequently asked questions<\/h2>\n\n<details>\n  <summary>What is EPP?<\/summary>\n  <p>An endpoint protection platform: software on laptops, servers and workstations that prevents threats from executing. It combines anti-malware, application control, device control, disk encryption and centrally enforced host policy, and it evolved from traditional antivirus.<\/p>\n<\/details>\n\n<details>\n  <summary>What is the difference between EPP and EDR?<\/summary>\n  <p>EPP prevents threats from running. EDR records endpoint activity so you can detect, investigate and contain something that got past prevention. They address different stages of the same problem, and most teams run both rather than choosing between them.<\/p>\n<\/details>\n\n<details>\n  <summary>Is EPP the same as antivirus?<\/summary>\n  <p>Antivirus is the ancestor of EPP and now one component of it. Traditional antivirus matched known signatures. A modern EPP adds behavioural detection, application and device control, encryption enforcement and central policy management.<\/p>\n<\/details>\n\n<details>\n  <summary>Do we still need EPP if we have EDR?<\/summary>\n  <p>Almost always yes. Without prevention, every threat becomes an alert somebody has to triage. Prevention keeps the volume low enough that the detection layer stays usable, and several frameworks specifically require a preventive anti-malware control.<\/p>\n<\/details>\n\n<details>\n  <summary>What evidence do auditors want for EPP?<\/summary>\n  <p>Coverage, not product name. A report showing every in-scope device enrolled, protection enabled, definitions current, and an explanation for any exclusions. Licence counts and vendor invoices do not answer the question.<\/p>\n<\/details>\n\n<p class=\"related\"><strong>Related glossary terms:<\/strong> <a href=\"https:\/\/www.osto.one\/resources\/glossary\/edr\/\">EDR<\/a> &middot; <a href=\"https:\/\/www.osto.one\/resources\/glossary\/mdm\/\">MDM<\/a> &middot; <a href=\"https:\/\/www.osto.one\/resources\/glossary\/dlp\/\">DLP<\/a> &middot; <a href=\"https:\/\/www.osto.one\/resources\/glossary\/siem\/\">SIEM<\/a> &middot; <a href=\"https:\/\/www.osto.one\/resources\/glossary\/incident-response\/\">Incident Response<\/a> &middot; <a href=\"https:\/\/www.osto.one\/resources\/glossary\/pci-dss\/\">PCI DSS<\/a> &middot; <a href=\"https:\/\/www.osto.one\/resources\/glossary\/soc-2\/\">SOC 2<\/a> &middot; <a href=\"https:\/\/www.osto.one\/resources\/glossary\/iso-27001\/\">ISO 27001<\/a><\/p>\n\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>EPP is the prevention layer on the endpoint. It stops what it recognises before anything runs, which is most attacks\u2026<\/p>\n","protected":false},"author":8,"featured_media":1149,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[180],"tags":[550,549,551],"class_list":["post-1148","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-glossary","tag-endpoint-protection-platform","tag-epp","tag-epp-vs-edr"],"_links":{"self":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/1148","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/comments?post=1148"}],"version-history":[{"count":1,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/1148\/revisions"}],"predecessor-version":[{"id":1150,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/1148\/revisions\/1150"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media\/1149"}],"wp:attachment":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media?parent=1148"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/categories?post=1148"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/tags?post=1148"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}