An endpoint security stack is the set of controls that protect a workstation, laptop, or server from malware and misuse. It usually includes antivirus or EDR, host firewall rules, device control, application allowlisting, patching, encryption, and telemetry that reports suspicious behavior back to defenders.
This stack matters because endpoints are where attackers often gain their first foothold. Modern intrusions may try to disable security tools, tamper with logs, or exploit a flaw in a protection component to reach System privileges. Defenders reduce that risk with tamper protection, least privilege, rapid updates, and monitoring for service crashes, policy changes, or unusual access to security processes. In practice, the security stack is both a shield and part of the attack surface.