Endpoint response is the part of a security program that detects suspicious activity on endpoints and then contains it. Endpoints are user devices and systems such as workstations, laptops, and servers. Response actions can include isolating a host from the network, killing a malicious process, quarantining files, collecting forensic data, and alerting analysts for triage.
It matters because many attacks begin or end on an endpoint: phishing payloads execute on a laptop, ransomware encrypts a server, or an intruder uses a workstation to move laterally. Strong endpoint response reduces dwell time and limits blast radius before the threat spreads across the environment. In practice, it is delivered through EDR or XDR tools, scripts, and playbooks that let defenders react quickly without waiting for manual cleanup.