IT explained · 6 min read
What is an endpoint? A plain-English definition for IT teams
Written for: IT managers, support staff and business owners who keep meeting the word 'endpoint' in security and licensing documents and want a precise definition.
What counts as an endpoint
In short
An endpoint is any device sitting at the end of a network connection that a person or a service uses to do work: a laptop, a desktop, a server, a tablet, a phone, a till, a kiosk. In IT management the word has a second, harder meaning: an endpoint is a thing you are responsible for keeping patched, monitored and reachable. That second meaning is the one that shows up on invoices, because most management tools price per endpoint.
Key takeaways
- An endpoint is a device that terminates a network connection: a computer, server, phone, tablet or purpose-built device like a till or kiosk.
- Network infrastructure such as switches, routers and firewalls are usually counted separately, as network devices rather than endpoints.
- In security, endpoint means attack surface. In licensing, endpoint means a billable unit. Both definitions matter and they do not always match.
- Count your endpoints before you evaluate any management tool: per-endpoint pricing turns a small counting error into a large annual one.
- An unmanaged endpoint is worse than a missing one, because it looks like coverage on a report while receiving no patches.
The definition, stated plainly
An endpoint is a device at the edge of a network that sends and receives data on behalf of a user or a service. The name comes from the network's own geometry: traffic travels between two ends, and the devices at those ends are the end points. Everything in the middle — switches, routers, access points, firewalls — moves traffic rather than terminating it.
That is why a laptop is an endpoint and a switch normally is not, even though both have an address and both can be managed. The distinction is about role, not capability.
- Laptops, desktops and workstations
- Servers, physical and virtual
- Phones and tablets, company-owned or personal
- Purpose-built devices: tills, kiosks, digital signage, medical carts, handheld scanners
- Virtual desktops, which count individually even though they share hardware
Why security teams use the word constantly
In security, endpoint is shorthand for attack surface. Each device is a place where credentials are typed, files are opened, browsers run scripts and USB sticks get plugged in. Perimeter defences do not help once something is already executing on a laptop, which is why an entire product category — endpoint protection, endpoint detection and response — grew up around defending the device itself rather than the network around it.
This is also why the word appears in the phrase 'endpoint visibility'. A device nobody is watching cannot be defended, and in most estates the devices nobody is watching are the ones that never come into the office.
Why the endpoint count decides what you pay
Most remote monitoring and management platforms price per endpoint per month. That makes the count a commercial figure, not just a technical one. Teams routinely discover mid-contract that servers count double, that virtual desktops each count as one, or that a device retired six months ago is still being billed because nobody removed the agent.
Before evaluating any tool, write down four numbers: staffed computers, servers, mobile devices, and purpose-built devices. Then ask the vendor which of those four they bill for and how a decommissioned device leaves the count. The answers vary far more than the marketing pages suggest.
- Does a server count as one endpoint or several?
- Are virtual desktops billed individually?
- Do mobile devices consume a licence?
- How quickly does removing an agent stop the billing?
- Is there a minimum commitment that makes small estates expensive per device?
Endpoint, device, asset, node: which word to use
These words overlap and people use them loosely, which causes real confusion in procurement documents. A useful convention: device is the physical thing, asset is the finance record of the thing, node is anything with a network address including infrastructure, and endpoint is a device you are responsible for managing and defending.
Under that convention a decommissioned laptop in a cupboard is a device and an asset but not an endpoint, and a core switch is a node but not an endpoint. Being explicit about which word you mean prevents the classic argument where two teams report different totals for the same estate.
Endpoint or not?
| Staff laptop | Endpoint |
|---|---|
| File or application server | Endpoint, sometimes at a higher rate |
| Virtual desktop | Endpoint, one per session host |
| Core switch or router | Network device, not an endpoint |
| Firewall appliance | Network device, not an endpoint |
| Warehouse handheld scanner | Endpoint |
| Printer or MFD | Varies; often monitored, rarely licensed as an endpoint |
Select any column heading to sort, or filter with the box above.
Common mistakes
- Counting only staffed computers and forgetting servers, which are usually the expensive ones.
- Leaving agents installed on retired machines, so the billed count drifts above the real count.
- Assuming personal phones used for work email are outside scope. For security purposes they rarely are.
- Reporting endpoint coverage as a percentage without stating the denominator, which hides the unmanaged devices entirely.
Frequently asked questions
- What is an endpoint in simple terms?
- Any device someone uses to do work that connects to a network: a laptop, desktop, server, phone, tablet or purpose-built device like a till. It is the thing at the end of the connection rather than the equipment carrying traffic in between.
- Is a server an endpoint?
- Yes, for both security and management purposes. Many licensing models charge more for a server than for a workstation, so check how your tool counts them.
- Is a router an endpoint?
- Normally no. Routers, switches, access points and firewalls move traffic between endpoints, so they are classed as network devices and are usually monitored under a different part of a management platform.
- What is endpoint security?
- Protecting the devices themselves rather than the network around them: anti-malware, disk encryption, patching, controlled administrative rights and the ability to isolate a device that starts behaving badly.
- What does endpoint mean in an API context?
- A different meaning entirely. In web development an endpoint is a specific URL a service exposes. The device meaning and the API meaning share only the metaphor of being at the end of a connection.
How this works in 247connect
If your endpoint count is the reason management tooling looks expensive, 247connect is priced per operator rather than per device, with unlimited managed endpoints and five concurrent sessions per user, so growing the estate does not change the bill.
More IT explainers
What is bandwidth?
Bandwidth is how much data a connection can carry at once, measured in megabits per second. It is not speed, and it is not the reason most remote sessions feel slow. What bandwidth is, how it differs from latency, and how much a remote session actually needs.
What is a node in networking?
A node is any device with a network address that can send, receive or forward data: computers, servers, phones, printers, switches, routers and cloud gateways. What counts as a node, how nodes differ from endpoints, and why node counts appear on invoices.
How to reset network settings
A network reset clears learned network state and rebuilds it from defaults. What a reset actually clears, the exact steps on Windows, macOS, iPhone and Android, what you lose, and the cheaper checks to try first.