An endpoint connector is agent software installed on a laptop, server, or workstation to enforce security policy and connect the device to central endpoint protection services. It can collect telemetry, receive commands, apply antivirus or EDR settings, isolate a host, and route scanning or inspection tasks through local security components.
This matters because the connector is part of the protection path, not just a management tool. If the agent or one of its embedded components fails, inspection can stop or become incomplete. In real attacks, adversaries may target the software that parses untrusted files or handles updates, aiming to crash the scanner or disable controls. Defenders rely on connector health monitoring, rapid patching, and version control to keep visibility and enforcement active across Windows, Linux, and macOS endpoints.