Key takeaway
Check device support, patches and protective controls; assign separate measures for IoT that cannot run an agent.
What a device posture check establishes
A posture scan checks a device against a defined baseline: installed updates, active and current malware protection, host firewall and other required settings. Inventory laptops, phones, tablets, servers and smart devices. Define restricted access, remediation and rechecking for a failing device. A configuration scan and EDR monitoring serve different purposes and need assigned owners. Record supported checks for each device family; the scan does not establish all behavior or certification.
Challenge: IoT and firmware gaps
IoT devices may not support an agent or automatic updates. Record manufacturer, model, firmware, support status and an update path. Segment unsupported devices, disable unnecessary remote access and plan replacement. Check scanner coverage rather than assuming a Windows posture check can assess every connected smart device. Approve segmentation and replacement with the person responsible for safe operation.
Challenge: ransomware and operational disruption
Ransomware can disrupt production and device-dependent services as well as user files. Document critical-device dependencies and the effect of isolation. Route EDR alerts to responders, separate backups from the incident and practise restoration. In operational environments, coordinate changes and shutdown with people responsible for safe operation rather than applying an office-device response blindly.
Challenge: unknown and fileless activity
Fileless attacks can use trusted system tools and scripts; absence of a conventional malicious file does not establish a clean device. Review EDR process, command, login and connection telemetry. Investigate behavior with context, search for related activity and combine file analysis with expert review for unknown executables. Pair baseline scanning with detection and investigation. A signal alone does not prove an attack; check device and tool coverage.
Challenge: missing endpoint policies
Write use and access rules for personal and corporate devices. Define updates, privileges, software installation and exceptions. Assign findings a device owner, priority and remediation date, considering critical and exposed devices first. Recurring gaps can indicate a policy or deployment problem, so report trends as well as individual results.
Challenge: physical device security
Protect data on a lost phone or laptop with disk encryption, screen locking and strong authentication. Establish loss reporting and approved session and access revocation; use remote wiping where supported and authorized. Manage removable media and recovery keys. Include physical protection in the endpoint baseline alongside software posture and monitoring.
Combine scanning, EDR and analyst review
A configuration scan, EDR and analyst review provide different evidence. During an evaluation, demonstrate applicable features with actual device coverage and test the handoff of isolation, notification and recovery responsibilities. Check which early warnings, process visibility, unknown-file analysis and response actions are in scope, then exercise a case from alert to closure.
| Check | What it shows | Follow-up |
|---|---|---|
| Posture scan | Settings against the chosen baseline. | The owner corrects and rechecks failures. |
| EDR telemetry | Supported device events and behavior. | A responder investigates context. |
| Analyst review | Correlated evidence and a proposed response. | Authorized containment and recovery with closure evidence. |