EDR visibility depends on the sensor being alive
Endpoint tooling only sees machines where it is installed and running, which is fewer than the dashboard suggests.
Sensors fail, get disabled during troubleshooting, never install on some builds, or are turned off by an attacker who got there first. The blind spots are not random: they cluster on the unusual machines, which are frequently the interesting ones. The number worth watching is not detections, it is how many endpoints are reporting compared with how many exist.
More on Endpoint security
- Application allowlisting controls execution, not intentThe list checks the name
- Local admin changes the consequence of compromiseOne click, two blast radii
- Device compliance is a snapshot, not permanent healthA tick is a photograph
- Full-disk encryption protects a powered-off device bestAt rest means switched off
- USB controls are a system design problemDesign the socket, not the poster
- Patch compliance percentages can hide critical exceptionsWhat the number covers