An endpoint is any physical or virtual device that connects to a network and sends, receives, or processes data on its own behalf - a laptop, phone, printer, virtual desktop, or point-of-sale terminal.
An endpoint is any physical or virtual device that connects to a network and sends, receives, or processes data on its own behalf - a laptop, desktop, phone, tablet, printer, point-of-sale terminal, or virtual desktop. The word marks the devices at the ends of the network, where people actually work, as opposed to the routing infrastructure in the middle that simply carries other people’s traffic. Every endpoint leads a double life: to the security team it is a possible way in, and to whoever runs hardware asset management it is a physical object with an owner, a cost, and a warranty. Most of what IT departments do day to day - patching, securing, issuing, recovering - is done to endpoints.
What you will learn
- Endpoint in networking vs API endpoint
- Types of endpoint, from laptops to virtual desktops
- What is not an endpoint
- Endpoint vs server
- Why endpoints matter
- Managed vs unmanaged endpoints
- Endpoint management acronyms decoded
- How endpoints are identified, and why the counts never match
- How to count the endpoints you actually have
- The endpoint lifecycle, purchase to disposal
- Endpoint management vs endpoint tracking
- FAQ
Endpoint in networking vs API endpoint
“Endpoint” is one of the genuinely ambiguous words in technology, and searchers arrive meaning two different things.
In IT and security, an endpoint is a device: a physical or virtual machine at the edge of a network that a person or a process uses to do work. That is the sense used for the rest of this page.
In software development, an API endpoint is an address - a URL or URI where an application programming interface accepts requests, such as /v1/assets or https://api.example.com/users. It is a route, not a machine. A single server can expose hundreds of API endpoints, and a single API endpoint can be served by hundreds of machines behind a load balancer. The two senses share only the metaphor of sitting at the end of a connection.
Two other meanings occasionally surface. In clinical research, an endpoint is a pre-specified outcome a trial measures. In networking theory, a communication endpoint is any node that terminates a connection - the formal definition the device sense grew out of. And in geometry, it is simply where a line segment stops.
A quick way to tell which sense a document means: if it talks about patching, encryption, enrolment, and stolen laptops, it means devices. If it talks about methods, payloads, authentication tokens, and status codes, it means APIs.
Types of endpoint, from laptops to virtual desktops
It helps to group them, because different groups need completely different handling.
- User devices - laptops, desktops, workstations, thin clients, smartphones, tablets, and Chromebooks. The largest group by count and the one that moves the most.
- Shared and fixed devices - networked printers and scanners, VoIP desk phones, meeting-room screens and conferencing kit, kiosks, and point-of-sale terminals. Nobody owns them personally, which is exactly why they fall through the cracks.
- Virtual endpoints - virtual desktops (VDI), virtual machines, cloud workloads, and containers. Modern security definitions include these explicitly: they run an operating system, hold data, and can be compromised, even though there is nothing to put a label on.
- Operational and specialised kit - industrial control systems, building automation, connected medical devices, security cameras, and door controllers. Often owned by facilities or engineering rather than IT, often running software nobody can patch on a normal cycle.
- Peripherals that are assets but not endpoints - monitors, docking stations, headsets, chargers, and cables. Strictly they are not endpoints, because they do not exchange data on their own account, but they cost real money and vanish at the same rate as laptops.
That last group is the honest edge of the definition. It falls out of every management console, because no console can enrol a monitor, and it only ever lives in a register. The market offers tracking technologies such as RFID or GPS tags for equipment that cannot run software at all; for most office fleets, a labelled register entry is what closes the gap.
What is not an endpoint
The working test is whether a device originates or terminates data on its own behalf, or merely moves somebody else’s. Traffic-carrying intermediaries are usually excluded: routers, switches, hubs, modems, wireless access points, network interface cards, load balancers, firewalls, and storage area networks. They are infrastructure. Endpoint-protection tooling generally does not cover them, and they are managed through network operations instead.
That does not mean they can be ignored. Every one of those boxes has firmware that needs patching, admin credentials that need rotating, a purchase price, a support contract, and a warranty end date - so networking equipment belongs in the asset register even though it sits outside the endpoint console. “Not an endpoint” is a statement about which tool manages it, not about whether it matters.
A few neighbouring words get used loosely and are worth separating:
- Host - broader than endpoint. Any machine with an address that runs services, including servers and infrastructure. Every endpoint is a host; not every host is an endpoint.
- Node - broader still. Anything addressable on the network, including the switches and routers above.
- Client - a role, not a device class. A machine acts as a client when it requests something from a server; the same machine can act as a server for something else.
- Workstation - a fixed desk endpoint, historically a higher-specification desktop for engineering or design work.
Endpoint vs server
Strictly, servers are endpoints: they terminate connections, they run operating systems, and most security vendors now cover servers, virtual machines, and cloud workloads under the same endpoint-protection umbrella. In everyday usage, though, the two are kept apart, and the distinction is role and exposure rather than technology.
| Dimension | Endpoints | Servers |
|---|---|---|
| Count | Many - roughly one to three per employee | Few, and centrally listed |
| Location | Mobile, in users’ hands, often off-site | Fixed, in racks or in a cloud region |
| Risk profile | Lost, stolen, dropped, on café wifi | Physically secured, network-restricted |
| Typical tooling | MDM, UEM, EPP, EDR | Server monitoring, hardening, patch management |
| Who touches it | One named person, daily | Administrators, under change control |
The practical consequence is that endpoints generate most of the day-to-day work simply because there are more of them and they live rougher lives. Servers need a register entry too, but they need it for warranty, capacity, and end-of-life planning rather than for custody.
Why endpoints matter
For security, the endpoint is now widely described as the new perimeter. Once work happens from anywhere, the network boundary stops being a useful control point and the device becomes the thing you actually verify. Under zero-trust models, access decisions weigh device posture alongside identity: is the operating system current, is the disc encrypted, are patches applied, is the device enrolled. A correct password from an unknown, unpatched machine is no longer good enough on its own.
For finance and operations, the endpoint fleet is usually the largest pool of movable equipment a company owns. Each device carries a purchase price, a warranty clock, and company data, and each changes hands at every hire, leave, and repair. An endpoint nobody can account for is a security hole and a write-off at the same time - a ghost asset if the record survives without the device, a zombie asset if the device survives without the record.
Managed vs unmanaged endpoints
A managed endpoint is enrolled, carries a management or security agent, and reports its posture back to a console. IT can see its patch level, push a configuration, and wipe it remotely if it goes missing.
An unmanaged endpoint connects to company systems and holds company data but reports to nothing. The usual suspects:
- A personal laptop or phone used under BYOD, never enrolled because enrolment felt intrusive.
- A contractor’s or agency machine, on the network for a six-month project.
- Kit bought on a department card without telling IT - classic shadow IT.
- A printer, meeting-room screen, or camera that nobody thought to enrol.
- A returned laptop in a drawer, unenrolled at offboarding and now simply a data-bearing box.
Unmanaged endpoints are the risk security teams name most often, and the reason is structural rather than dramatic: identity verification can prove who is asking, but it cannot vouch for a device that reports no posture at all. Asset discovery helps - it finds devices that appear on the network - but it will never find the ones that are switched off, in a cupboard, at a leaver’s house, or plugged into a home network you do not scan. Those only surface in a register that somebody maintains deliberately.
Endpoint management acronyms decoded
The endpoint category is thick with acronyms, and most of them describe overlapping software layers rather than different worlds.
| Acronym | Stands for | What it actually does |
|---|---|---|
| MDM | Mobile device management | Enrols phones and tablets, enforces passcodes and encryption, remote lock and wipe |
| EMM | Enterprise mobility management | MDM plus app distribution and content management |
| UEM | Unified endpoint management | One console for mobiles and desktops: patching, imaging, configuration, app delivery |
| RMM | Remote monitoring and management | The service-provider equivalent, used to manage many clients’ fleets |
| EPP | Endpoint protection platform | Prevention layer - antivirus, firewall, device control |
| NGAV | Next-generation antivirus | Behaviour- and model-based malware prevention rather than signature matching |
| EDR | Endpoint detection and response | Sensors that record endpoint behaviour, alert on it, and can isolate a device |
| XDR | Extended detection and response | Correlates that telemetry beyond the endpoint - identity, email, cloud, network |
| MDR | Managed detection and response | The same detection work delivered as a staffed service |
| DLP | Data loss prevention | Controls what data can leave the device or the organisation |
The load-bearing point: every one of these answers the software question. Which build is it on, is it encrypted, is it behaving. Not one of them records who signed for the device, what it cost, which invoice it sat on, or when the warranty ends. That is a different record entirely - see ITAM and CMDB for the two disciplines that do.
How endpoints are identified, and why the counts never match
Ask three systems how many endpoints you have and you will get three answers. The reason is that each one keys on a different identifier.
- Serial number - the manufacturer’s permanent identifier, stamped on the chassis. The only one that survives a reimage, a rename, and a change of owner, which is why it is normally the anchor.
- MAC address - unique per network interface, so a laptop with wifi and ethernet has more than one. Increasingly unreliable as an identity, because phones and laptops now randomise their MAC per network by default.
- IMEI - the identifier for cellular devices, tied to the hardware rather than the SIM.
- Hostname - human-readable and convenient, but renamed on rebuild and duplicated in practice more often than anyone admits.
- Internal asset ID - your own number on an asset tag or QR label, the one identifier you control completely.
One laptop can therefore exist as three different records in three systems: a hostname in the management console, a MAC address in the network logs, and a serial on the purchase invoice. The fix is not more tooling, it is a decision - pick one authoritative identifier, almost always the serial, and reconcile everything else to it. That process has a name: asset reconciliation, and the gaps it exposes are the point of doing it.
How to count the endpoints you actually have
The count is not academic. Endpoint security, UEM, and some software licenses are priced per device or per active endpoint, so an inflated number costs money every month and an understated one leaves devices unprotected. Rather than trusting any single console, build the number from the ground up:
- Start from headcount and multiply by role. A hybrid knowledge worker often carries a laptop plus a phone, with a dock and a monitor at the office and another set at home. A warehouse or retail role might have a shared terminal and no personal device at all.
- Add shared and fixed devices per site. Printers, meeting rooms, kiosks, POS lanes, cameras, and reception screens. Walk a floor if you have to; this is where estimates fail.
- Add virtual endpoints. Virtual desktops and cloud workloads count for licensing even though nobody can point at them.
- Add the pools nobody counts. Spares, loaners, devices in repair, devices with leavers, and stock waiting to be issued or disposed of.
Then compare that figure against three sources that will each disagree: the security agent console, the enrolment list in your MDM or UEM, and the purchase ledger. The gap between them is the finding. Devices in the ledger but not the console were never enrolled. Devices in the console but not the ledger were bought outside procurement.
One convention worth knowing: per-endpoint pricing often counts only devices seen within a recent window - the last 30 days is common. That quietly hides dormant machines, which flatters the invoice and flatters the risk picture at the same time. The IT asset inventory checklist walks through a full count end to end.
The endpoint lifecycle, purchase to disposal
An endpoint’s life runs through nine recognisable stages: specify and buy; receive and label; enrol and image; issue to a named person with a signature and a due date; support, patch, and repair; refresh at end of useful life; recover at offboarding; wipe and prove the wipe; and dispose or resell with a certificate of destruction.
The management console only covers the middle stretch, between enrolment and unenrolment. The expensive failures cluster at the two ends. At the front, a device exists, is paid for, and holds a warranty, but is not yet enrolled - so it appears in no console. At the back, a device has been unenrolled, disappeared from every dashboard, and is now simply missing while still holding company data. A retired endpoint is a data-bearing device, not just a write-off, which is why data sanitisation and a documented handover matter more than the residual value ever will. See IT asset lifecycle for the full model, and hardware recovery at offboarding for the stage that leaks the most.
Endpoint management vs endpoint tracking
Two different questions get asked about every endpoint, and they need two different records. MDM, UEM, and endpoint-protection agents answer the software question: is this device encrypted, patched, and behaving. An asset register answers the custody question: who has it, what it cost, when the warranty ends, and what has happened to it - including everything an agent can never enrol, like monitors, docks, and boxed spares.
Neither substitutes for the other. A console with perfect coverage still cannot tell you which invoice a laptop came from or who signed for it. A register with perfect records still cannot tell you whether the disc is encrypted. Run both, key them to the same serial number, and reconcile them on a schedule.
FAQ
What is the difference between an endpoint and an API endpoint? They share a metaphor and nothing else. In IT and security, an endpoint is a physical or virtual device sitting at the edge of a network - a laptop, a phone, a printer, a virtual desktop. In software development, an API endpoint is an address: a URL or URI where an API accepts requests, such as /v1/assets. One is a machine you can pick up and label; the other is a route in a piece of software. If a page talks about patching, encryption, and enrolment it means the device sense; if it talks about methods, payloads, and status codes it means the API sense.
Is a router an endpoint? Normally no. Routers, switches, hubs, modems, wireless access points, and load balancers are network infrastructure - they forward other devices’ traffic rather than originating or terminating it on their own account, so endpoint-security tooling usually leaves them to network management. The caveat matters though: they still have firmware to patch, admin credentials to rotate, a purchase price, and a warranty, so they belong in the asset register even when they sit outside the endpoint console.
What is an unmanaged endpoint? An unmanaged endpoint is a device that connects to company systems and holds company data but reports to nothing - no enrolment, no management agent, no posture check. Typical examples: a personal laptop used under BYOD, a contractor’s machine, a device bought on a department card, a printer nobody enrolled, and a returned laptop sitting in a drawer. It is the risk most named by security teams, because access decisions increasingly weigh device posture, and a device that reports nothing cannot be vouched for.
Is a server an endpoint? It depends who is asking. In strict networking terms, anything that terminates a network connection is an endpoint, servers included, and most security vendors now count servers, virtual machines, and cloud workloads as endpoints for protection purposes. In everyday IT usage, “endpoint” means the user-facing devices at the edge - laptops, desktops, phones - while servers are treated as a separate category with their own tooling, because they are few, fixed, and locked in racks rather than carried out of the building daily.
Is a printer an endpoint? Yes. A networked printer connects to the network, holds firmware that needs patching, often stores copies of recent print jobs, and is a classic overlooked entry point precisely because nobody thinks of it as a computer. The same goes for scanners, VoIP phones, and smart TVs in meeting rooms - if it has a network connection, it is an endpoint and belongs on somebody’s list.
What does endpoint management mean? Endpoint management is keeping every endpoint configured, patched, and secured from a central console - typically with MDM, UEM, or similar agent software that enforces encryption, pushes updates, and can lock or wipe a lost device. It covers the software state of the device. The ownership, cost, warranty, and custody side is handled separately, in an asset register.
The takeaway
An endpoint is any physical or virtual device that connects to a network and handles data on its own behalf - which today means far more than laptops and phones, and far less than every box with a cable. The strict definition includes servers, virtual desktops, and cloud workloads; the everyday one means the user-facing devices at the edge; and the traffic-carrying infrastructure in between sits outside both while still needing patching and a warranty record. Whichever definition you use, the same two questions follow every device: is its software state under control, and does somebody know who has it. Management consoles answer the first for the devices they can enrol. A register answers the second for everything, including the monitors, docks, and boxed spares no console will ever see.
Tools that make this easier
AMPthilly is the custody half of that pair. One register holds IT hardware, physical equipment, and software licenses together, with owner, serial number, purchase price, warranty end date, condition notes, and attached receipts on every record. Each item gets a printable QR label that opens the asset profile in a normal phone browser - no app to install - so checking a device out, transferring it to a new owner, or reporting a fault takes seconds. Checkouts with due dates, bulk checkout for onboarding kits, onboarding and offboarding templates, and a full audit history mean the devices your console cannot enrol are still accounted for. Start free or talk to us.
Related terms
- MDM - the software that configures and secures enrolled endpoints
- BYOD - personal devices acting as endpoints on company networks
- Hardware Asset Management - the custody and cost record for the endpoint fleet
- IT Inventory - the periodic count that keeps the endpoint list honest
- Asset Discovery - finding the endpoints nobody recorded