Endpoint custody is the chain of control over a device: who receives it, where it is stored, and who is allowed to use it. In security terms, it describes whether an endpoint is truly in the hands of the expected user or quietly controlled by someone else.
This matters because many defenses assume a laptop or phone is being used by the person assigned to it. In remote-work fraud, attacker-controlled laptop farms can keep employer-issued devices in one place while a different operator accesses them remotely. That can weaken location checks, inventory controls, and trust in onboarding. Defenders reduce this risk with shipping verification, asset tracking, device enrollment checks, and policies that confirm the device stays with the intended employee. When custody is unclear, the endpoint itself can become an access path into corporate systems.