An endpoint baseline is the known-good software and configuration profile for a device: operating system version, installed applications, services, startup items, security settings, and trusted drivers. Security teams use baselines to spot drift, because a change from expected state may indicate a new tool, misconfiguration, or compromise.
Baselines matter in cyber security because attackers often survive by adding persistence, installing unwanted utilities, or modifying startup behavior. If a monitor, USB device, or installer causes software to appear on a Windows PC, defenders can compare the endpoint against its baseline and flag the unexpected package, autostart entry, or policy change. Good baselines also support incident response, patch validation, and fleet-wide hardening by making unusual changes easier to detect and remove.