# Endpoint Security Glossary for Small Business (October 2026)
*Each term comes with what our product data shows, so you can see what it means for the price you pay.*
> A glossary of the endpoint security terms a small business meets when buying: product types, the people who run them, the features that change the price, the contract terms, and the tests and scores behind the rankings.
Endpoint Index research (Reference). Published 2026-10-08, updated 2026-10-08, data as of 2026-10-02. Source: https://endpointindex.com/research/endpoint-security-glossary/
Endpoint security vendors sell the same few ideas under different names. This glossary defines the terms you meet when you buy, and adds what the Endpoint Index data shows for each one: how many of the 17 products we track from 14 vendors have it, and what it costs. Counts and prices update with every price check; the last was on 2 October 2026.
## What is endpoint security?
**Endpoint security is software that protects the computers, laptops, servers and phones people use for work, each of which is an "endpoint".** It blocks malware, spots attacks and, in its more advanced forms, records what happened on each device so someone can investigate. List prices for the products we track run from $30.00 to $179.99 per endpoint or user a year. The [buyer's guide](/research/endpoint-security-small-business-buyers-guide/) explains how to choose one.
## What is an endpoint?
**An endpoint is any device that connects to your network and runs work software: a desktop, a laptop, a server, a phone or a tablet.** Vendors price per endpoint, per device or per user, and the difference matters. Microsoft licenses Defender for Business per user, with up to five devices each, so a person with a laptop and a phone counts once; most rivals count them twice. Servers are often priced separately (see [Microsoft](/research/microsoft-defender-for-business-pricing/) and [Sophos](/research/sophos-pricing/) pricing).
## What is antivirus (EPP)?
**Antivirus, sold to businesses as an endpoint protection platform (EPP), is software that blocks known and suspicious files and behaviour on each device automatically, without anyone watching it.** It is the cheapest layer: the lowest published antivirus price we track is $30.00 per seat a year (Webroot Business Endpoint Protection). The top-ranked antivirus for a small business is Bitdefender GravityZone Business Security, on the [antivirus ranking](/best/antivirus-for-small-business/).
## What is next-generation antivirus (NGAV)?
**Next-generation antivirus (NGAV) is antivirus that judges files and processes by behaviour and machine-learning models instead of only matching them against a list of known malware.** The label appears in most vendors' marketing, so on its own it does not separate one product from another. Check independent lab results instead (see [AV-Test](#what-is-av-test) and [AV-Comparatives](#what-is-av-comparatives)).
## What is EDR?
**EDR (endpoint detection and response) is software that records what happens on each device, flags suspicious activity and lets a person investigate it and respond, for example by isolating a laptop from the network.** EDR is only as good as the person reading its alerts. 8 of the 17 products we track include EDR, and the cheapest published EDR price is $36.00 per seat a year (Microsoft Defender for Business). The [EDR ranking](/best/edr-for-small-business/) orders them.
## What is XDR?
**XDR (extended detection and response) is EDR that also takes in alerts from other security tools, such as email, identity, firewall and cloud services, and links them into one incident.** For a small business with one or two security products, XDR adds less than its name suggests. The four layers are compared in [EDR vs MDR vs XDR vs antivirus](/research/edr-vs-mdr-vs-xdr-vs-antivirus/).
## What is MDR?
**MDR (managed detection and response) is a service in which a provider's analysts watch your devices around the clock, investigate alerts and contain confirmed threats for you.** It is what a business with no one to answer alerts at night buys. 3 of the 17 products we track include 24/7 managed response in the price, from $99.00 per seat a year. [What is MDR](/research/what-is-managed-detection-and-response/) covers it in full, and [MDR pricing](/research/mdr-pricing/) lists every provider's price.
## What is managed EDR?
**Managed EDR is MDR limited to endpoints: a vendor's security team watches the EDR on your devices, while full MDR can also cover email, identity, network and cloud.** Vendors use the two names loosely. 2 products we track sell their managed service as an add-on to the EDR licence rather than in the base price, so budget for both lines.
## What is a SOC?
**A SOC (security operations centre) is the team, in-house or at a provider, that monitors security alerts and responds to them.** A "24/7 SOC" means someone is watching at night and at weekends, which is when most small businesses have no cover. When a vendor says its price includes a SOC, ask what the analysts may do without asking you first, and whether a response time is in the contract.
## What is an MSP?
**An MSP (managed service provider) is an outside firm that runs a business's IT, usually for a monthly fee per user or device.** Many small businesses buy endpoint security through their MSP, which affects the price. Huntress, for example, sets no seat minimum through an MSP but a 50-endpoint minimum direct ([Huntress pricing](/research/huntress-pricing/)). The [MSP guide](/research/endpoint-security-for-msps/) covers buying from the MSP's side.
## What is an MSSP?
**An MSSP (managed security service provider) is an outside firm that runs security only: monitoring, alert handling and often firewall and email security, but not general IT support.** An MSSP may or may not respond to threats on your devices; MDR always does. Ask which actions are in the contract.
## What are RMM and PSA tools?
**RMM (remote monitoring and management) and PSA (professional services automation) are the tools MSPs use to manage clients' devices and to run tickets and billing.** An endpoint product that connects to them is easier for an MSP to run. 15 tracked products name at least one RMM or PSA integration.
## What is a multi-tenant console?
**A multi-tenant console is a management screen that lets one MSP run many client businesses' devices, each kept separate.** If an MSP will run your endpoint security, the product needs one. In our data, 16 of 17 products include one.
## What is ransomware rollback?
**Ransomware rollback is a feature that restores files ransomware encrypted on one device from copies the endpoint agent kept, within a limited window and often on Windows only.** It is a fast undo, not a backup. It is included in 13 of the 17 products. [What is ransomware rollback](/research/what-is-ransomware-rollback/) explains what it cannot undo.
## What is threat hunting?
**Threat hunting is a person searching a company's devices for signs of an attacker that the software has not flagged.** It is usually sold as part of MDR or as a paid add-on to EDR. For a small business, round-the-clock response to the alerts the software does raise comes first.
## What is ITDR?
**ITDR (identity threat detection and response) is software that watches user accounts and sign-ins, for example in Microsoft 365, for signs that an account has been taken over.** Stolen passwords are a common way in, so vendors increasingly bundle ITDR with EDR or MDR. SentinelOne includes it from Singularity Commercial, and Microsoft in its Defender Suite add-on ([SentinelOne](/research/sentinelone-pricing/) and [Microsoft](/research/microsoft-defender-for-business-pricing/) pricing).
## What is a SIEM?
**A SIEM (security information and event management system) is a platform that collects logs from many systems in one place, so they can be searched, kept for audits and correlated into alerts.** Most small businesses do not run one; a regulator or an insurer is the usual reason to start. [EDR with SIEM integration](/research/best-edr-siem-integration-small-business/) covers which products send data to which SIEMs.
## What is a HIPAA BAA?
**A HIPAA business associate agreement (BAA) is a contract in which a vendor that handles protected health information on your behalf promises to safeguard it, as HIPAA requires.** A medical or dental practice needs one from any vendor whose product touches patient data. 4 of the 17 products we track are recorded as offering one; several large vendors' websites do not say. The [HIPAA BAA register](/research/hipaa-baa-endpoint-security-vendors/) quotes each vendor, and the [medical and dental guide](/research/endpoint-security-medical-dental-practices-hipaa/) ranks the options.
## What is a seat minimum?
**A seat minimum is the smallest number of licences a vendor will sell in one order.** It decides the real price for a small office: 7 of the 17 products we track have a minimum above one seat, and Huntress Managed EDR bought direct starts at 50 endpoints. Every vendor's smallest and largest order is in [seat minimums by vendor](/research/endpoint-security-seat-minimums/).
## What is auto-renewal uplift?
**Auto-renewal uplift is a contract clause that renews your subscription automatically at a higher price unless you give notice in time.** SentinelOne's master subscription agreement, for example, renews at 120% of the last order without 30 days' written notice. Diary the notice date the day you sign; each product page records the terms we found.
## What is AV-Test?
**AV-Test is an independent German lab that tests business security products and scores each on protection, performance and usability, out of 6 points each.** It is one of three lab programmes the SMB Fit Score counts. [How to read lab results](/methodology/reading-lab-results/) explains what the scores do and do not show.
## What is AV-Comparatives?
**AV-Comparatives is an independent Austrian lab whose twice-yearly Business Security Test reports how many real-world attacks each product blocked and how many false alarms it raised.** A product with high protection and many false alarms costs a small business time, so read both numbers.
## What are MITRE ATT&CK Evaluations?
**MITRE ATT&CK Evaluations are tests in which MITRE replays a simulated attack and publishes what each EDR product detected at each step, without ranking anyone.** Vendors choose whether to take part, and some skip rounds. Endpoint Index treats results older than 18 months as dated. How to read a result, and every vendor's counts for the last two rounds, are in [MITRE ATT&CK Evaluations explained](/research/mitre-attack-evaluations-explained/).
## What is the SMB Fit Score?
**The SMB Fit Score is Endpoint Index's published formula for how well a product suits a small business without security staff: lab efficacy (35 points), price (25), ease of running (25) and coverage (15).** It measures fit, not absolute protection, and every input is a sourced field. The [methodology](/methodology/) gives the formula, and the [rankings](/best/edr-for-small-business/) apply it.
## Frequently asked questions
### Which of these does a small business need?
A small business with no IT staff needs antivirus at the least, and a business that holds client data and has no one to answer alerts needs MDR. EDR on its own suits a business with an IT person or an MSP who will read the alerts. The top-ranked product in each case is Bitdefender GravityZone Business Security for antivirus, Microsoft Defender for Business for EDR and ThreatDown Elite for managed response.
### Is Windows Defender the same as Microsoft Defender for Business?
No. Windows ships with Microsoft Defender Antivirus, which protects one PC at a time with no central console and no EDR. Microsoft Defender for Business is a separate paid product with EDR and central management, at $36.00 per user per year, and it is included in Microsoft 365 Business Premium.
### What does "per seat" mean in a price?
A seat is one licence. Depending on the vendor it covers one user or one device, so check the unit before you compare prices. Every price on Endpoint Index is the list price per seat per year, with the unit and seat count shown next to it.
## Methodology and caveats
Definitions are written by Endpoint Index for small-business buyers; vendors use several of these terms loosely, and a product's own documentation decides what it includes. Counts and prices come from the 17 products Endpoint Index tracks, as of 2 October 2026, using each product's published capabilities and list prices. "Recorded as offering" a BAA means we found vendor evidence for it; a product without that flag may still sign one if asked.
## Sources
- Endpoint Index, product pages and the [SMB endpoint security price index](/research/smb-endpoint-security-price-index/): capabilities, prices, seat minimums and BAA flags, each with its vendor source.
- Microsoft, [Defender for Business plans and pricing](https://www.microsoft.com/en-us/security/business/endpoint-security/microsoft-defender-business): per-user licensing and device limit.
- SentinelOne, Master Subscription Agreement, section 11.1: renewal terms, as recorded on the [SentinelOne Singularity Complete page](/products/sentinelone-singularity-complete/).
- AV-Test, [business test results](https://www.av-test.org/en/antivirus/business-windows-client/); AV-Comparatives, [Business Security Test](https://www.av-comparatives.org/); MITRE, [ATT&CK Evaluations](https://evals.mitre.org/): what each programme measures.