EPRisk domain
Endpoint and device
Endpoint and device covers the devices people use and the systems they own: malware and infostealer detections, exploitable vulnerabilities, EDR tampering, USB storage, patching, mobile posture, lost devices and physical access. The domain joins device telemetry to the person who uses the device. Access here means local admin rights and ownership of internet-facing or critical systems. The device is where a click becomes code.
Classification
- Dimensions Every signal answers one of 3 questions.
- Evidence levels
- Maturity practices One capability a program performs, scored on its own: See, Understand, Act, Prove, Govern and Culture.
- Leads to The kind of breach the evidence beneath it points toward, each anchored to a Verizon DBIR or VERIS pattern or an FBI IC3 category.
- NIST CSF 2.0
-
- PR.PS-01
- PR.PS-02
- DE.CM-09
- ID.RA-01
- MITRE ATT&CK
-
- TA0002 Execution, TA0005 Defense Evasion · T1204 User Execution, T1562 Impair Defenses, T1091 Removable media, T1190 Exploit public-facing application
The Verizon DBIR tracks ransomware and malware intrusions under its System Intrusion pattern, and VERIS records Malware as its own action. A phishing click or a malicious download becomes an incident on the device, so device posture decides whether the click stops there.
Three dimensions in endpoint and device.
- Threat5 signals
- Threat is what the device has already met: malware detected, an exploitable vulnerability, infostealer indicators, a credential-theft or lateral-movement alert, or a quarantine.
- Access2 signals
- Access is local admin rights on endpoints and ownership of internet-facing or critical systems.
- Behavior12 signals
- Behavior is how a person treats the device: tampering with EDR, connecting USB storage, rooting a phone, failing MDM or encryption policy, running unapproved software, deferring patches, leaving a device unlocked, reporting a loss late or tailgating on the risky side; installing updates promptly, keeping a compliant device and reporting a loss within 24 hours on the vigilant side.
Signals
19 signalsScroll sideways to see every column.
Headline metrics and grade bands
4 metricsA to F bands for the numbers a program reports in this domain. Bands marked "framework benchmark" are authored targets until the HRM Benchmark publishes measured values.
Scroll sideways to see every band.
| Metric | Unit | A | B | C | D | Anchor |
|---|---|---|---|---|---|---|
| M-EP-1Device patch compliance | % of user devices inside patch SLA | ≥ 95 | ≥ 90 | ≥ 80 | ≥ 65 | DBIR 2026 vulnerability-exploitation share |
| M-EP-2Protection tampering | EDR disable or bypass events per 1,000 devices per quarter | ≤ 0 | ≤ 1 | ≤ 3 | ≤ 8 | Framework benchmark |
| M-EP-3Malicious destinations | blocked malicious-site visits per 100 people per month | ≤ 1 | ≤ 3 | ≤ 8 | ≤ 15 | Framework benchmark |
| M-EP-4Lost devices wiped | % of lost or stolen devices wiped within 24 hours | ≥ 100 | ≥ 95 | ≥ 85 | ≥ 70 | DBIR Lost and Stolen Assets pattern |
Indicator library
92 indicators- I.0104Signs into enterprise apps from unmanaged devices
- I.0116Downloads executable files from suspicious domains
- I.0183Runs unsupported operating system versions
- I.0184Disables endpoint security controls
- I.0185Uses devices without full-disk encryption
- I.0186Delays software updates repeatedly
- I.0187Uses devices with excessive admin privileges
- I.0188Uses devices with unnecessary or risky software
- I.0189Uses devices with malware detections
- I.0190Runs files from suspicious or unrecognized USB devices
- I.0191Uses devices that communicate with command-and-control infrastructure
- I.0192Downloads and executes malicious files
- I.0193Uses devices exhibiting lateral movement behaviors
- I.0194Uses devices missing critical patches
- I.0195Runs unsupported legacy applications
- I.0196Delays reboots after patch installation
- I.0197Installs unapproved software
- I.0198Runs portable applications from external drives
- I.0199Uses personal devices for enterprise work without enrollment
- I.0200Connects to unknown USB peripherals
- I.0201Uses devices that boot from removable media
- I.0202Charges devices from untrusted USB sources
- I.0206Uses devices observed to frequently visit risky websites
- I.0207Disables screen lock or timeout
- I.0208Leaves devices unlocked in public or shared spaces
- I.0209Uses jailbroken or rooted mobile devices for work
- I.0210Installs remote access tools without approval
- I.0211Runs browser-based games or crypto mining on work devices
- I.0212Operates outdated device models with unsupported hardware
- I.0213Installs software updates promptly after release
- I.0214Locks devices during inactivity
- I.0215Isolates devices immediately after suspicious behavior
- I.0216Uninstalls unused or risky software proactively
- I.0217Uses devices with full-disk encryption
- I.0218Uses only approved USB devices for file transfers
- I.0219Responds to EDR warnings before IT intervention
- I.0220Avoids running executables from unverified sources
- I.0221Maintains baseline system configurations
- I.0222Engages with endpoint health check tools proactively
- I.0223Badges in without badging out
- I.0224Badges out without prior badge in
- I.0225Allows additional person to enter without authorization
- I.0226Holds secure door open beyond expected duration
- I.0227Attempts to access unauthorized areas with badge
- I.0228Accumulates excessive denied access attempts
- I.0229Accesses facilities more frequently than expected
- I.0230Accesses facilities outside expected hours
- I.0231Accesses facilities using unexpected badge
- I.0232Accesses facilities while on leave
- I.0233Accesses facilities after offboarding
- I.0234Accesses multiple facilities simultaneously
- I.0235Visits sensitive zones for unusually short durations
- I.0236Loiters in sensitive zones beyond expected durations
- I.0237Appears onsite while also appearing remote
- I.0238Fails to display badge when onsite
- I.0239Sponsors visitors more frequently than expected
- I.0240Attempts to sponsor unauthorized visitors
- I.0241Fails to respond appropriately during security drills
- I.0242Fails clean desk policy audit
- I.0294Uses shared home device to access corporate systems
- I.0298Fails device posture checks during remote access
- I.0299Rarely connects to device management platform
- I.0300Delays applying patches while remote
- I.0301Disables device encryption outside office environments
- I.0302Uses unmanaged personal device for corporate access
- I.0304Accesses work apps from consumer devices
- I.0305Installs unapproved remote access tools
- I.0311Works remotely without connecting to VPN
- I.0315Leaves work device unattended in public places
- I.0320Connects from geolocations inconsistent with work profile
- I.0321Uses open Wi-Fi networks without VPN
- I.0322Uses corporate VPN consistently during remote work
- I.0324Validates Wi-Fi security before connecting remotely
- I.0327Connects regularly to device management platform while remote
- I.0364Operates rooted or jailbroken mobile device
- I.0365Disables full-disk encryption on mobile device
- I.0366Connects mobile device to untrusted Wi-Fi
- I.0367Fails to maintain secure VPN tunnel on mobile device
- I.0368Installs sideloaded or unapproved applications on mobile device
- I.0369Grants excessive mobile app permissions
- I.0371Removes or tampers with MDM profile
- I.0372Operates mobile device from restricted geolocation
- I.0373Lacks remote wipe capability on mobile device
- I.0374Runs mobile device with preinstalled riskware
- I.0375Adheres to authorized mobile device maintenance
- I.0376Applies security patches on mobile device
- I.0377Maintains secure bootloader configuration on mobile device
- I.0378Practices safe public Wi-Fi usage on mobile device
- I.0379Installs apps on mobile device only from trusted sources
- I.0380Adheres to secure BYOD policies
- I.0381Applies least privilege to app permissions on mobile device
- I.0383Maintains MDM compliance
Cohorts in this domain
3Sequences that start here
1Cite this term
"Endpoint and device" (EP), Human Risk Management Framework v2.0.0, Living Security, CC BY 4.0. https://www.humanriskmanagement.com/taxonomy/domains/endpoint-and-device
Part of the open HRM Taxonomy, CC BY 4.0. Download the taxonomy as JSON · What's new in 2.0.
The initial assessment
Find your level.Then fix what matters.
18 questions, about 4 minutes and nothing to type before the result: your level, a score for each practice and three first playbooks, each Easy, Medium or Hard.