An agent service is a background process installed on a workstation, server, or other endpoint so a central management platform can control it. The service usually checks in with a console, receives policy or update commands, reports inventory and health, and can carry out tasks such as software deployment, configuration changes, or security scans.
In cyber security, agent services matter because they sit close to privileged administration functions. If an attacker can stop, disable, or manipulate the service, defenders may lose visibility and control over the endpoint fleet. In other cases, attackers try to abuse the service’s communication channel, local permissions, or update mechanism to run code, hide activity, or persist. Defenders protect agent services by restricting administrative access, patching them quickly, monitoring for crashes or tampering, and validating that only trusted management servers can issue commands.