Layered endpoint defence

1. What I walked into

Four hundred workstations in a healthcare centre, with a traditional antivirus and local admin rights for almost everyone. Laptops travelled unencrypted, and the logs sat scattered across the machines.

• there were no alerts, only investigations after the fact
• the machines holding patient data looked like every other one

2. What I changed or built

Layers that overlap: EDR on every endpoint, full-disk encryption, local admin rights withdrawn, and a central log analyser that connects the signals.

• a staged roll-out, department by department
• an isolation procedure that works at night too
• a monthly report to management, in plain words

3. The numbers

400 endpoints in six weeks, without disturbing patient care. Every portable machine encrypted. A suspicious machine can be isolated within 15 minutes of the alert.

4. The tools, and why these

CrowdStrike for behavioural detection and remote isolation; BitLocker and Intune because they fit the Windows estate. Wazuh provides the central log without licence fees, and the compliance audits are answered from it too.

5. What it meant for the business

An incident now starts with an alert rather than a user’s complaint. A lost laptop is a nuisance rather than a data breach, and the technical questions at audits have ready answers.