IT ISSUE · SECURITY AND THREATS
Endpoint protection warning
A device reporting a detection is working. A device that has gone quiet is the one to look at.There is an order of seriousness here that runs opposite to how it feels. A device reporting a detection is a device that is working. A device that has gone quiet is the one to look at, because silence reads as safety and isn't.
Roughly in order of concern
- The device has stopped reporting at all.
- Protection is disabled, or was switched off by somebody.
- Definitions are days or weeks behind.
- A component failed to start after an update.
- A detection was found but couldn't be actioned.
Quiet isn't clean
We check whether the device is still managed and reporting, when it last checked in, what state the protection is in and whether anything was found before it went quiet.
A dashboard showing no problems across the estate can mean everything is healthy or that several machines stopped talking weeks ago, and those look identical from a distance. That is the same reason a machine bought outside the usual arrangement matters: it never appears in the count at all. What protection covers is worth confirming occasionally rather than assuming, and it is a shorter conversation than it sounds.