Endpoint security

How it works

Three categories get confused constantly, and the distinction decides your architecture.

• EDR (endpoint detection and response) runs a privileged agent that watches processes, file writes, registry changes and network calls, then feeds telemetry to a console where analysts hunt. CrowdStrike, SentinelOne and Microsoft Defender for Endpoint all work this way. It needs deep OS access.
• MDM configures and enforces. It sets the passcode rule, turns on encryption, blocks the OS version you don't want, removes the app you banned, and wipes the device on demand. It doesn't hunt for malware.
• MTD (mobile threat defense) fills the gap on phones with what the OS allows: inspecting traffic through a local VPN extension, flagging malicious Wi-Fi, scanning sideloaded packages on Android, detecting jailbreak or root indicators. Lookout, Zimperium and Defender's mobile app sit here.

Now the part vendors rarely say plainly. On iOS there is no such thing as real EDR. App sandboxing means a security app cannot enumerate other apps' processes, read their files, or hook the kernel. What it can see is its own sandbox, network traffic it routes through a NetworkExtension, device attestation from Apple, and configuration facts the MDM already reports. Android is more open: Play Protect scans on-device, the Play Integrity API returns a hardware-backed verdict on device state, and a work profile agent can inventory installed packages. Still nothing like a Windows kernel driver.

So on mobile, hardening through configuration is the main lever, not detection. A forced OS update closes the vulnerability that an agent would only have watched being exploited.

Why it matters for a fleet

Phones hold the same mailbox as the laptop and travel through far more untrusted networks, yet they are routinely left out of the security program because the familiar tools don't install on them. Phishing has moved accordingly: SMS and messaging app lures target mobile users because the URL bar is short and the sender is hard to check.

Budget follows the same bias. Teams buy a second mobile threat product before enforcing minimum OS versions, which is spending money on visibility instead of closing the hole.

How Appaloosa handles it

Appaloosa is the configuration and enforcement layer, not an antivirus. It sets passcode and encryption requirements, blocks devices running an OS build you decided is too old, restricts app installation to an enterprise app store you control, locks devices into kiosk mode where the use case allows it, and wipes a lost handset fully or selectively. Compliance is evaluated continuously, so a device that drifts loses access rather than quietly staying on the allowlist. If you also run an MTD or EDR product, Appaloosa deploys and configures its agent to the right groups. The hardening policies available per platform are listed by OS.