An endpoint scan is a security check performed directly on a device, such as a laptop, server, or workstation, to find suspicious files, malicious behavior, or risky configuration changes. It is one of the core tasks of endpoint protection software, including antivirus and endpoint detection tools.
Endpoint scans matter because the device is often where malware executes, credentials are used, and persistence is established. A scan can inspect files, running processes, registry changes, scheduled tasks, and other local indicators of compromise. In defense, scans help confirm whether a system is clean and whether controls are working as expected.
In attacks, the goal is often to reduce what the scan can see. Adversaries may use exclusions, tamper with security settings, or hide activity so the scanner skips the relevant files and paths. That turns a routine inspection into a blind spot and makes detection and response harder.