The Endpoint: Where Security Breaches Still Thrive

Despite billions spent on workspace cybersecurity, the endpoint remains one of the most vulnerable targets. Forrester analysts project that cybersecurity spending will continue to rise, reaching more than $300 billion in 2029. Cybercrime costs are projected to exceed $15 trillion in the same year. Enterprises are contending with AI-driven threats and costly data breaches that begin with human error, shadow AI, social engineering and other elements.

These threats capitalize on endpoint activities like clicking a link in a phishing email, using an unvetted AI application or sending sensitive data via unsecured and unpatched devices. Edge computing and hybrid work, with many people using multiple devices during a workday, have heightened the role of the endpoint. It isn't just a device but the main computing hub and a critical control point in securing enterprise workloads.

Security Focus Shift

CISOs and cybersecurity and IT teams now must defend an endpoint environment that can change daily. Unprotected devices and applications a worker chooses to use off the radar are now a common threat. Endpoint security, however, is losing ground to a focus on AI and detection rather than prevention.

Refocusing on endpoint security as a preventative strategy—what Harrington calls 'foundational protections'—makes sense.

Patching Vulnerabilities

Vulnerabilities show the need to refocus on prevention. Attackers thrive on endpoints that lack critical patches. They access poorly protected applications and data, setting up a path to network infiltration and a data breach.

Although patching is the never-ending story of needed updates, it's a vital security practice. Verizon's 2026 DBIR report notes that exploitation of vulnerabilities, rising to 31%, is now the most common initial breach access point. At the same time, critical vulnerability remediation fell from 38% in 2024 to 26% in 2025. Attackers benefit from a combination of the slowdown in patch resolution (43 median days to 32) and a 50% increase in critical vulnerabilities.

Device Differences

Security challenges look different in two main endpoint categories: PCs and thin clients. PCs typically store applications, software and current workload data for local, quick access. However, if access privileges are weak or a user, via social engineering, allows access, it opens the door to data exfiltration, malware, ransomware and network disruption.

Conversely, thin clients are read-only hardware devices that don't locally store data. Instead, they function as a conduit to cloud-based and VDI-delivered applications. A user signs on, and the thin client begins a secure reboot from a known good state. Data and applications don't leave the data center, or the secure, controlled environment where they're stored. This non-persistent runtime reduces the possible attack surface.

Another critical element in endpoint security is the OS. By far, the dominant OS in enterprise PCs is Windows. For thin clients, the preferred choice is Linux. Windows' large install base makes it a constant cyberattack target. Unlike general-purpose operating systems, a thin client's Linux OS is intentionally designed as a closed, purpose-built platform for access to VDI, DaaS, SaaS and web environments. Linux OS is non-persistent, reverting to a clean reboot, thereby thwarting ransomware and other threats that exploit data persistence on the device.

Future Security Challenges

As AI threats march on, enterprises need to give security basics more attention. AI attackers rely on weakly protected endpoints and human error. Strengthening access privileges, patching and user authentication are a good start. AI threat actors will get smarter. Enterprises must get tougher.