Endpoint Security for Small Business: Devices, Patching and EDR

A 40-person firm with Windows laptops, a few Macs and staff phones on company email has the same device problem as a large company, with far fewer people to handle it. Endpoint security for small business is the set of controls that keeps those devices patched, encrypted, free of malware and recoverable when one goes missing. This guide covers the whole topic for organisations of 10 to 250 people with mixed fleets.

Every figure here was read from the publisher's own page on 14 Nov 2026: Microsoft, Apple, the UK's NCSC and CISA. Nothing was installed or trialled, and the methodology page explains that label. Narrower guides on devices sit under the devices topic.

What endpoint security for small business has to cover

An endpoint is any device a person works on: a desktop, a laptop, a tablet or a phone. Servers count too, though they are licensed differently. The UK's Cyber Essentials requirements, version 3.3, dated April 2026, are blunt about it: "A scope that doesn't include end-user devices isn't acceptable."

The same document brings personal phones in. A personally owned device that reaches organisational data or services is in scope. One used only for calls, texts or a multi-factor sign-in app is not.

Across the published guidance, the work falls into six jobs:

1. Keep software supported and patched.
2. Stop malware running, with anti-malware software or an allow list.
3. Encrypt the disk, so a lost laptop does not expose its data.
4. Limit admin rights, so one bad click does less damage.
5. Configure to a published baseline rather than from memory.
6. Manage it all centrally, so the rules reach every device and you can prove it.

The sections below take each job in turn. The last section puts them in order of priority.

Antivirus, EDR, MDR and XDR in plain terms

The acronyms describe layers, not rival products. Each one adds something to the layer before it.

Microsoft's EDR explainer says EDR "monitors endpoint activity, detects suspicious behavior, and helps security teams investigate and respond to threats in real time". It contrasts this with antivirus, which it says focuses "on detecting and blocking known threats using signature-based detection". The same page says "XDR extends the capabilities of EDR".

Its MDR page calls MDR "a combination of technology and human expertise". These are one vendor's definitions. No regulator's definition was read for this guide.

The useful column for a small firm is the last one. EDR produces alerts that need a person to read them. If nobody will look at an alert within hours, an attack can run while the warning sits unread. That gap is what MDR is sold to fill.

What Microsoft already includes

Every Windows 10 and Windows 11 device ships with Microsoft Defender Antivirus. Microsoft describes it as "built into Windows" and advises against disabling it. When another antivirus product is installed, Defender is no longer the primary scanner. It can keep scanning in a report-only passive mode, but only on devices onboarded to Defender for Endpoint.

Microsoft Defender for Business is the step up. It is built on Defender for Endpoint and "designed for small and medium sized business up to 300 users". Microsoft's comparison table lists EDR, automated investigation and remediation, and core vulnerability management. None of those three is in Defender for Endpoint Plan 1.

The product page allows "Up to 300 users and up to five devices per user, with no minimum device requirement". The Defender for Business FAQ puts servers on a separate licence "priced at $3 per server instance". That sentence gives no billing period. Firms with more than 60 servers are pointed to an enterprise server licence.

Two licensing rules catch growing firms. Defender for Business does not support mixed licensing, so adding enterprise licences for some users leaves everyone on the Defender for Business experience. And past 300 users, Microsoft points customers to its enterprise plans.

For a company already on Business Premium, EDR is paid for. For one on Business Basic or Business Standard, Microsoft names those plans as eligible for the standalone product.

What Macs and phones bring with them

Macs are not bare out of the box. Apple's platform security guide describes "built-in antivirus technology called XProtect for the signature-based detection and removal of malware". A separate engine removes infections using updates from Apple, and macOS checks for those updates daily by default. Apple also scans software for known malware before it issues a notarisation ticket.

The NCSC's macOS guide accepts XProtect as a base, then adds: "For full protection and visibility, it's best to use both". That means XProtect alongside an endpoint product. On Gatekeeper, which limits which apps can open, it says "the long-term goal should be to move towards hard enforcement".

Cyber Essentials lets each device meet its malware rule in one of two ways. Windows and macOS devices may use anti-malware software set to block malware and malicious websites. Any device may use application allow listing, where only approved, signed apps can run. Phones and tablets are not listed under the anti-malware option, so allow listing is their route.

Defender for Business covers all four main platforms. Its FAQ says it "supports protection for Windows, Mac, Android, and iOS/iPadOS devices", so a mixed fleet can sit in one console. Cyber Essentials lists email attachments, downloads and unauthorised installs as sources of malware. Mail-side controls are in the business email security guide.

Device management is the control plane

None of the controls in this guide scale without a management tool. Device management (MDM) turns "encrypt every laptop" from a request into an enforced setting with a report behind it. The NCSC's Windows guide says to "Use a Mobile Device Management service to configure, monitor and enforce technical controls".

Choosing and pricing a tool has its own page: MDM for small business, compared by minimum order size. It prices each tool at 10, 25 and 50 devices and flags the minimum orders that inflate small bills. Microsoft's product page confirms that Business Premium already includes Intune Plan 1.

What matters here is what the tool must enforce. A workable minimum, drawn from the sources in this guide:

• Disk encryption on, with recovery keys held centrally.
• Updates automatic, with deadlines.
• A screen-lock PIN of at least 6 characters, and lockout after no more than 10 failed attempts.
• Anti-malware active and reporting.
• Standard user accounts for daily work.

MDM also reaches personal phones, which raises a different question: how much control staff will accept. Intune's retire action, covered below, is one answer. It removes company data and leaves personal data alone.

Patching: rings, deadlines and a 14-day clock

Cyber Essentials sets the clock. Updates that fix "critical" or "high risk" vulnerabilities, or anything scored 7 or above on CVSS v3, must be installed "within 14 days" of release. The same applies when the vendor gives no severity at all. Automatic updates must be on where possible.

On Windows, the free tool is Windows Update client policies, formerly Windows Update for Business. They work on Pro, Education and Enterprise editions through Intune, another MDM or Group Policy. Quality updates are typically released on the second Tuesday of each month. An admin can defer them by up to 30 days, defer feature updates by up to 365 days, and pause either for 35 days.

Deferral exists for rings, not for delay. The usual pattern is a small test group that gets updates first, then everyone else a few days later. With a 14-day clock, the last ring's deferral plus its install deadline must land inside the fortnight. A deadline policy forces installation a set number of days after release, with a grace period before a forced restart.

Windows Autopatch packages this approach. Microsoft says it "aims to update 95% of devices by their target compliance date", and recommends rolling updates out gradually. Its hotpatch option applies security fixes without waiting for a restart. Autopatch licensing could not be confirmed for this guide, so check your plan before relying on it.

Microsoft's monthly release is the easy part. Browsers, PDF readers, VPN clients and business apps carry their own update channels, and Cyber Essentials covers all software on in-scope devices. When everything cannot go first, CISA's Known Exploited Vulnerabilities catalog is a sensible filter.

CISA calls it "the authoritative source of vulnerabilities that have been exploited in the wild". It listed 1,781 entries on 14 Nov 2026. How small teams can use the CISA KEV catalog shows how to apply it to a patch queue.

Windows 10, Windows 11 and the end-of-support date

Microsoft's end-of-support page is plain: "On October 14, 2025, Windows 10 support ended." Without Extended Security Updates (ESU), a Windows 10 PC now gets no security fixes. Cyber Essentials requires unsupported software to be removed from in-scope devices, or the devices cut off from the internet in a separate subset.

For organisations, Microsoft's ESU page lists "$61 USD per device for Year One", read on 14 Nov 2026. "The price doubles every consecutive year, for a maximum of three years." It is cumulative, so joining in year two means paying for year one too.

Years two and three are worked out from Microsoft's doubling rule, not from separately published figures. ESU needs Windows 10 version 22H2 and brings "critical and important security updates" only, with no new features and no general support. It is free for Windows 10 virtual machines in Windows 365 and Azure Virtual Desktop. Microsoft's consumer offer, a one-off $30 or free with settings sync, covers home PCs to 12 October 2027.

Windows 11 runs on its own clock. Microsoft's release information gives each annual version "24 months of support for Home, Pro, Pro for Workstations, and Pro Education editions". Enterprise and Education editions get 36 months. On 14 Nov 2026 the table showed version 24H2 at "End of updates" for Home and Pro.

A Pro laptop still on 24H2 is therefore in the same position as an unenrolled Windows 10 machine. Many small firms buy Pro, so the shorter 24-month window is the one to track.

Apple publishes no equivalent table in the pages read for this guide. Its security releases page lists fixes for older lines, such as iOS 18.7.12 beside iOS 27.2.1 on 9 November 2026, without end dates. The NCSC's macOS guide says Macs "typically receive software updates for around 6-7 years after first release". Cyber Essentials expects vendors to state a future end date, so ask your certification body how it treats Apple devices.

Encrypt every laptop, and keep the keys

BitLocker encrypts whole Windows volumes against "data theft or exposure from lost, stolen, or inappropriately decommissioned devices". Full BitLocker can be enabled on Pro, Enterprise and Education editions. Many devices also switch on device encryption automatically. Microsoft says Windows 11 version 24H2 removed some hardware prerequisites, so more devices now qualify.

The recovery key is where it goes wrong. On a device joined to Microsoft Entra ID, the key is backed up to Entra ID automatically. Microsoft warns: "If a device uses only local accounts, then it remains unprotected even though the data is encrypted." A laptop set up with a local account outside your normal process is the case to hunt for.

On a Mac, FileVault "protects your organization's data if a Mac is lost or stolen" by "making its contents unreadable without valid credentials". The NCSC's macOS guide asks organisations to "Enable encryption" and to escrow Activation Lock keys to the MDM. Your MDM should enforce encryption and hold the recovery key.

For phones and tablets, the Cyber Essentials unlock rule carries the load. A PIN or password of at least 6 characters is required, with lockout after 10 failed attempts or throttling to 10 guesses in 5 minutes.

Take admin rights off everyday accounts

Cyber Essentials makes the case with an example. A user called Jody, signed in with an administrative account, opens a malicious attachment. The ransomware inherits Jody's privileges and encrypts "far more data than would have been possible with standard user privileges".

The requirement that follows is to use "separate accounts to perform administrative activities only", with no email or web browsing from them. The NCSC's Windows guide goes further at setup: "Provision non-administrative accounts during setup, removing the need for local admin accounts." Microsoft's baselines assume the same, being designed for organisations "in which standard end users don't have administrative rights".

Someone still needs a way in when a device breaks. Windows LAPS handles that. It is built into supported Windows versions and "available at no cost". It rotates a local administrator password regularly and backs it up to Entra ID or Active Directory.

Microsoft's reason is direct. Shared local admin passwords let attackers "move laterally across your environment". Software that staff need can be pushed from the MDM on Windows and Mac alike, which removes most reasons to hand out admin rights at all.

Baselines worth copying

Nobody should write a device configuration from scratch. Microsoft notes there are "over 3,000 group policy settings for Windows 10". Its security baselines guide recommends "an industry-standard configuration that is broadly known and well-tested" over a home-made one.

The NCSC device collection is "Guidance for organisations on how to choose, configure and use devices securely", with a guide per platform. Microsoft's baselines come as a download in its Security Compliance Toolkit, or as security baselines inside Intune. The CIS Benchmarks are "prescriptive configuration recommendations for more than 25+ vendor product families".

A sensible order is Cyber Essentials first, because it is short and certifiable, then a platform baseline on top. How the main frameworks fit together is covered in the security frameworks guide.

When a laptop or phone goes missing

A lost device is a small incident with a short checklist. With encryption on and keys escrowed, the data is protected. The work is cutting access and deciding what to erase. Write the steps into your incident response plan so nobody improvises.

1. Record it. Who reported it, when, which device, and whether it was encrypted.
2. Cut sign-in access. End the user's sessions and reset the password if it might be known. Multi-factor sign-in, covered in the MFA guide, limits what a password alone is worth.
3. Choose wipe or retire. In Intune, Wipe is a factory reset that "removes all personal and organizational data, apps, and configurations". Retire "removes company data from a device without performing a full wipe", which suits a staff member's own phone.
4. Expect a delay. Retire runs "the next time the device checks in", so an offline device keeps its data until it reconnects. Encryption is what protects it meanwhile.
5. Close the record. Remove the device from your inventory and from Entra ID, and release Apple devices in Apple's business portal.

Microsoft adds a warning for Windows. Before retiring an Entra-joined device, back up its BitLocker recovery key and local admin credentials, because retiring it suspends BitLocker on the operating system drive. A lost device whose files were backed up elsewhere costs only the hardware; the backup strategy guide covers that side.

A prioritised checklist

If you can only do some of this, do it in this order. Steps 3 to 7 rest on Cyber Essentials requirements; the rest make them workable.

1. Make an inventory. List every device that reaches company data, personal phones included. Cyber Essentials scope depends on it.
2. Enrol devices in an MDM, so every later step is enforced and reported rather than requested.
3. Replace or cover unsupported systems. Windows 10 without ESU and Windows 11 Pro on 24H2 or older both need action now.
4. Turn on automatic updates with at least two rings and a deadline inside 14 days.
5. Confirm anti-malware is active on every Windows and Mac device, with app allow listing on phones.
6. Remove everyday admin rights, with Windows LAPS for the local admin account.
7. Enforce screen locks: a 6-character PIN minimum and lockout after 10 failed attempts.
8. Enforce encryption with BitLocker and FileVault, and check that recovery keys are stored centrally.
9. Apply a baseline from Microsoft, the NCSC or CIS through the MDM.
10. Add EDR, and decide who reads the alerts: your team, your IT provider or an MDR service.

Two habits keep the list current. Check the Windows 11 release table each autumn, when a version's end of updates arrives. And patch anything on CISA's catalogue first, well inside the fortnight.