SMB Cybersecurity BriefingDaily cybersecurity intelligence for small and mid-sized businesses

Endpoint Protection Hardening With Built-In Controls

Published · Last reviewed

Before buying new tools, confirm that the protection already in Windows and macOS is switched on and healthy: antivirus with real-time protection and tamper protection, the host firewall, full-disk encryption, automatic updates and, on Windows, attack surface reduction rules introduced in audit mode first. A ten-minute check per device tells you what is actually running.

The baseline

Modern Windows and macOS include most of what a small business needs at the endpoint. The common weakness is not missing features but features that are off, out of date, bypassed by a half-installed third-party product, or never checked. The baseline below is a reasonable minimum for a company laptop. It is not a complete security program, and a managed detection service can be added on top.

Controls, in priority order

Action
Confirm antivirus is on, current and protected from tampering. On Windows, open Windows Security, then Virus & threat protection, and check real-time protection, cloud-delivered protection and tamper protection. An administrator can read the state with Get-MpComputerStatus in PowerShell (look at the real-time protection and signature-age fields). On macOS, built-in protections (Gatekeeper and XProtect) update with system updates; check spctl --status returns “assessments enabled”.
Why it helps
An antivirus that is off or months out of date protects nothing, and attackers routinely try to switch it off. Tamper protection stops that.
Verification
On three sample machines, confirm the status screen shows no warnings and the signatures were updated recently. Do the same for any third-party product, and note that a licence that has expired may leave the machine without protection.
Fallback if delayed
If central reporting is not available, make a monthly five-minute check of the status screen on each machine part of the IT routine.
Action
Turn on the host firewall for every network profile. On Windows, Windows Defender Firewall in Windows Security should show green for the domain, private and public profiles; on macOS, System Settings, Network, Firewall.
Why it helps
The host firewall limits what other computers on the same network can reach, which matters in a café or after a single machine in the office is compromised.
Verification
On Windows, run netsh advfirewall show allprofiles state and confirm each profile reports ON. On macOS, confirm the Firewall switch is on.
Fallback if delayed
If a particular application requires an exception, add a narrow rule for that application only, not a blanket allow.
Action
Encrypt every laptop's disk. On Windows use BitLocker (on editions that include it) or device encryption, and store the recovery key in your directory or password manager. On macOS turn on FileVault.
Why it helps
A lost or stolen laptop is a data breach unless the disk is encrypted. Encryption turns it into a hardware loss.
Verification
On Windows, manage-bde -status shows the protection status; on macOS, fdesetup status reports whether FileVault is on. Confirm you can locate the recovery key for one machine.
Fallback if delayed
If a device cannot be encrypted, do not store sensitive files locally on it, and track it as an exception.
Action
On Windows, enable attack surface reduction rules in audit mode first, review what would have been blocked for two weeks, then switch the rules you trust to block. Start with the rules that block credential theft from the security authority process, and executable content from email. Microsoft documents the full list and how to deploy by policy. Profile A Profile B/C delta: in Google Workspace environments with Windows endpoints, deploy through whichever management tool you use for those PCs; the rules themselves are the same.
Why it helps
These rules block behaviours that malware commonly relies on, even when the specific malware has never been seen. Audit mode shows you what would break before anything is blocked.
Verification
The Windows Security event log (or your management console) shows audit or block events for the rules. A rule that fires on a business application gets an exclusion, not removal.
Fallback if delayed
If you cannot use policy, apply the Microsoft security baseline for your Windows version to new machines at build time.
Action
Keep operating systems and browsers on automatic updates, and set a restart deadline.
Why it helps
Updates carry fixes for flaws that are otherwise exploited. Machines that postpone restarts for weeks stay vulnerable.
Verification
On Windows, Settings, Windows Update shows no pending restart and a recent last-checked date. On macOS, softwareupdate --list shows nothing outstanding.
Fallback if delayed
For machines you cannot restart, schedule a monthly maintenance window and tell staff the day.

Common failure mode

A trial or expired third-party antivirus quietly replaces the built-in one, so the machine appears protected but is not. A related mistake is adding wide exclusions (whole folders or drives) to fix a slow application, which gives malware a place to run unscanned. The third is switching attack surface reduction rules straight to block without an audit period, causing staff to demand they be turned off again.

How it works

Endpoint protection works in layers. Antivirus scans files and watches behaviour. The firewall limits network reach. Disk encryption protects data when the device is lost. Attack surface reduction blocks specific risky behaviours such as an Office document starting a script. No single layer is complete, so the point of a baseline is that several imperfect layers overlap, and that you can check each is working.

Verification matters more than purchase. A check you can repeat in ten minutes, on a sample of devices every month, will find the quiet failures: a disabled service, a lapsed licence, a machine that has not restarted for a month. Microsoft publishes security baselines for Windows, and Apple publishes a platform security guide describing the Mac protections; both are linked below. Pair this with least-privilege accounts, because protections are easier to remove for an administrator than for a standard user.

Worked example

Suppose, as a hypothetical, a 20-person office does a ten-minute check on three laptops. All three show antivirus running, but one shows real-time protection off because a trial copy of a third-party product was installed and later expired. Another has the firewall off on the public profile. The third has no disk encryption.

The IT lead removes the expired product, re-enables Defender with tamper protection, turns the firewall back on and enables disk encryption, saving the recovery key to the directory. The lead schedules the same check for the whole office over the next two weeks. The machines and findings are invented to show the kind of quiet gaps a routine check turns up.

Frequently asked questions

Is Microsoft Defender Antivirus enough for a small business?

For many small businesses a properly configured built-in product with monitoring is a sound baseline. What matters is that it is on, updated, centrally checked and backed by backups, MFA and patching.

What is tamper protection?

A setting that stops malware, and users, from turning off key protection features. Turn it on wherever it is available.

Do Macs need antivirus?

Macs include built-in protections that update with the system, but they are not immune. Keep them updated, use FileVault, restrict administrator rights, and add endpoint monitoring if your risks justify it.

What are attack surface reduction rules?

Windows policy rules that block behaviours often used by malware, such as running executable content from email. Start them in audit mode to see what they would block.

How often should I check endpoint health?

Spot-check a few devices monthly, and check all devices after any large change such as a new security product, a new image or a mass update.