The Endpoint: Where Security Breaches Still Thrive
Kevin Greenway, CTO at 10ZiG, has 25+ years in IT and leads technology and product strategy, with a focus on VDI and End User Computing.
gettyDespite billions spent on workspace cybersecurity, the endpoint remains one of the most vulnerable targets. Forrester analysts project that cybersecurity spending will continue to rise, reaching more than $300 billion in 2029. Cybercrime costs are projected to exceed $15 trillion in the same year. Enterprises are contending with AI-driven threats and costly data breaches that begin with human error, shadow AI, social engineering and other elements.
These threats capitalize on endpoint activities like clicking a link in a phishing email, using an unvetted AI application or sending sensitive data via unsecured and unpatched devices.
Edge computing and hybrid work, with many people using multiple devices during a workday, have heightened the role of the endpoint. It isn’t just a device but the main computing hub and a critical control point in securing enterprise workloads. CISOs and cybersecurity and IT teams now must defend an endpoint environment that can change daily. Unprotected devices and applications a worker chooses to use off the radar are now a common threat.
Endpoint security, however, is losing ground to a focus on AI and detection rather than prevention. That’s a mistake, Forrester senior analyst Paddy Harrington says: “Agentic systems are ultimately taking actions on endpoints, applications, networks, and operational systems. They use the same paths, identities, permissions, and connectivity that humans use. That means they inherit the same risks.”
Refocusing on endpoint security as a preventative strategy—what Harrington calls “foundational protections”—makes sense.
Vulnerabilities show the need to refocus on prevention. Attackers thrive on endpoints that lack critical patches. They access poorly protected applications and data, setting up a path to network infiltration and a data breach.
Although patching is the never-ending story of needed updates, it’s a vital security practice. Verizon’s 2026 DBIR report notes that exploitation of vulnerabilities, rising to 31%, is now the most common initial breach access point. At the same time, critical vulnerability remediation fell from 38% in 2024 to 26% in 2025. Attackers benefit from a combination of the slowdown in patch resolution (43 median days to 32) and a 50% increase in critical vulnerabilities.
Beyond keeping up with patching updates, enterprises need to ensure data security through effective user privileges and access control, and an OS that supports clean reboots to avoid application persistence, a weakness attackers favor.
User privileges continue to be a challenge for enterprises and an opportunity for attackers to infiltrate networks. Granting users privileges beyond their job requirements, weak password and MFA management, and leaving privileges open after someone leaves the company are main culprits. All of these create fertile ground for credential theft that can lead to a data breach.
Security challenges look different in two main endpoint categories: PCs and thin clients.
PCs typically store applications, software and current workload data for local, quick access. However, if access privileges are weak or a user, via social engineering, allows access, it opens the door to data exfiltration, malware, ransomware and network disruption. Local storage can also be an issue if files are left open and another person can access the device without authorized privileges.
Conversely, thin clients are read-only hardware devices that don’t locally store data. Instead, they function as a conduit to cloud-based and VDI-delivered applications. A user signs on, and the thin client begins a secure reboot from a known good state. Data and applications don’t leave the data center, or the secure, controlled environment where they’re stored. This non-persistent runtime, with each sign-on starting with a clean data environment, reduces the possible attack surface. Thin clients also support read-only mountable file and application packages that enable localized computing but aren’t permanently stored. In industries where an endpoint device is often shared, such as healthcare, call centers and manufacturing facilities, all of which feature shift work, thin clients are a popular choice.
Another critical element in endpoint security is the OS. By far, the dominant OS in enterprise PCs is Windows. For thin clients, the preferred choice is Linux. Windows’ large install base makes it a constant cyberattack target. If an attack succeeds, the computing damage can be widespread. This is also why related patching and security updates need to be addressed quickly.
Unlike general-purpose operating systems, a thin client’s Linux OS is intentionally designed as a closed, purpose-built platform for access to VDI, DaaS, SaaS and web environments. Linux OS is non-persistent, reverting to a clean reboot, thereby thwarting ransomware and other threats that exploit data persistence on the device.
As AI threats march on, enterprises need to give security basics more attention. AI attackers rely on weakly protected endpoints and human error. Strengthening access privileges, patching and user authentication are a good start. AI threat actors will get smarter. Enterprises must get tougher.
Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?
