At 2:13 a.m., EDR flags credential dumping on a finance laptop. It isolates the device minutes later. The alert explains what happened. It does not show which SaaS sessions remain valid. It also misses which internal services the user can still reach. The process may have already opened a sensitive workload connection.
Endpoint Controls: EDR vs Endpoint Controls in ZT: EDR detects and investigates harmful device activity. Endpoint controls limit where compromised devices, users, and processes can connect. In Zero Trust, neither replaces the other. EDR gives risk evidence, while other controls contain threats. Host firewalls, ZTNA, NAC, DNS controls, and microsegmentation enforce containment. The right design maps each signal to a measured action. It can block a process, isolate a host, revoke a session, restrict an app, or segment traffic.
EDR finds compromise but cannot enforce access
EDR means Endpoint Detection and Response. It watches managed devices for threats and supports incident response.
EDR records endpoint telemetry, or device events. These events include process launches, file changes, registry edits, and network connections. It spots credential dumping, ransomware behavior, suspicious PowerShell, and harmful child processes. A mature EDR can isolate a device. It usually keeps a small management channel open for cleanup.
EDR cannot reliably control unmanaged devices. Those devices lack a trusted agent that can report activity. EDR also cannot replace Network Access Control, or NAC. NAC decides if a device may join a network based on its posture. Posture means its security state, such as patches and EDR health. EDR also cannot provide app-level access control like ZTNA. ZTNA means Zero Trust Network Access.
EDR shows what happened inside the device.
Choose EDR first if: you lack sound endpoint visibility or cannot investigate incidents. Choose it if managed laptops and servers have under 90% healthy sensor coverage. Avoid EDR as your only Zero Trust control. Privileged users, SaaS sessions, lateral traffic, and unmanaged devices may remain exposed.
Endpoint network controls block different paths
Endpoint network controls stop unwanted connections at several points. They act when a device joins, resolves a domain, reaches the internet, or accesses another workload.
| Control and decision point | What it blocks | Typical U.S. Cost or effort | Operational trade-off |
|---|
| EDR on device | Known malicious process or host activity | Microsoft Defender for [Endpoint](https://zerotrustexplained.com/lax-endpoint-rules-let-hybrid-byod-bypass-defenses/) P2: $5.20 per user/month list price | Needs agent health and skilled triage |
| Host firewall | Ports, protocols, IPs, sometimes processes | Often included with OS; 1 to 4 weeks for policy cleanup | Rules can break legacy support tools |
| DNS/proxy and egress | Risky domains, web paths, outbound destinations | Cloudflare Access starts at $7 per user/month after its free tier | Broad allow rules leave C2 paths open |
| NAC | [Network](https://zerotrustexplained.com/why-endpoint-segmentation-misses-network-only-iomt-in-care/) entry by noncompliant devices | Usually quote-based; 8 to 16 weeks is common for complex sites | Printer and IoT discovery takes work |
| ZTNA and microsegmentation | App access and east-west workload flows | Usually quote-based; 6 to 20 weeks for first protected apps | Requires accurate dependency mapping |
A host firewall applies rules on the endpoint itself. A laptop can reject remote desktop traffic, even on a shared VLAN. Egress control limits outbound destinations. This helps stop command-and-control traffic and unapproved SaaS use. DNS and secure web proxy controls can block a dangerous domain. They act before the web session begins.
Choose host firewall and egress controls when compromised endpoints can reach the internet or peer devices freely. Choose ZTNA before a VPN refresh. It fits remote users who need a few internal apps. Choose NAC when unknown or unhealthy devices can join offices, warehouses, or campus Wi-Fi.
The most common mistake is buying NAC before finding unmanaged assets. That project then becomes a long list of printer and device exceptions.
Choose endpoint network controls if: your main loss path is lateral movement, outbound command-and-control, excessive VPN reach, or unmanaged device entry. Avoid a large NAC or segmentation project first. Do not start if you lack asset records or business dependency owners.
Map each attack to detection and blocking
EDR is usually the best source of process evidence. Network controls limit spread. Identity controls decide if a user session stays valid.
| Attack scenario | Best detector | Preventive block | Best response action |
|---|
| Ransomware encryption | EDR behavior alert | EDR prevention, write controls | Kill process, then isolate host |
| Stolen SaaS token | EDR plus IdP logs | Conditional access, ZTNA | Revoke sessions and require MFA |
| C2 beacon from a server | EDR, NDR, DNS logs | Egress allowlist and proxy | Block domain and destination |
| Lateral movement | EDR and NDR | Host firewall, segmentation | Restrict east-west flows |
| Unmanaged contractor device | NAC and device posture | NAC, browser ZTNA | Deny network, allow web app only |
Block a process when EDR sees high-confidence behavior. Examples include credential dumping, mass encryption, or a known harmful child-process chain. Preserve memory and process evidence where possible. This matters most on a server. Killing a suspicious payment-system process without checking its role can cause an outage.
Isolate a host when active compromise threatens other systems. Revoke an identity session when token theft suggests account abuse. Suspicious browser behavior or endpoint risk can also justify revocation. Segment traffic when evidence is incomplete. Do this when the asset is too critical to disconnect fully.
Risk-driven response path:
EDR sees behavior → SIEM correlates endpoint, identity, DNS, and NDR evidence → SOAR checks asset criticality → IdP revokes risky sessions or requests MFA → ZTNA limits app access → firewall, proxy, or segmentation blocks the threat path.
Each response decision should keep evidence. That evidence must explain why access changed and what the action affected. EDR gives the process tree, command line, file hash, user context, and endpoint telemetry. DNS, proxy, and egress tools add the domain, address, URL, destination, and blocked connection.
NAC and ZTNA add device identity, posture results, requested apps, and matched policies. A blocked SMB connection becomes more useful with this context. Analysts can then show that new PowerShell on an unhealthy laptop targeted a finance server. That server sat outside the approved app path.
A good containment action must be explainable after the incident.
Preserving this evidence in the SIEM helps teams separate justified containment from rules that need tuning.
Feed EDR risk into IAM, ZTNA, and SOAR
EDR telemetry gains value when it changes an access decision.
Automate reversible actions when confidence is high. Block a known malicious hash or deny a confirmed domain. Revoke a risky session or remove privileged app access. Require analyst approval for actions that can stop manufacturing, patient care, payment processing, or emergency communications.
Measure healthy sensor coverage, not installed agents. A practical target is between 95% and 99% healthy coverage for supported managed endpoints. Report unsupported assets separately. Also track false-positive rate and mean time to contain. Track denied lateral connections, revoked risky sessions, and active exceptions with expiration dates.
In Zero Trust, evaluate identity, device posture, and least privilege together. Do not treat them as separate checkboxes. Valid MFA should not grant equal access in every case. An unmanaged device or missing EDR sensor changes the risk.
A high risk score or new location can also affect the access decision. The IdP authenticates the user. EDR and device management give posture signals. ZTNA then enforces a narrow app-level decision. A finance employee on a healthy laptop may open the accounting app.
That same identity may get read-only access on an unmanaged browser. It may also be denied access.
If endpoint risk rises during a session, access can change. SaaS session revocation, step-up MFA, and reduced app access can occur. This avoids granting broad network access.
Match controls to remote, cloud, and OT risk
Remote staff need EDR, device posture checks, ZTNA, and DNS or proxy enforcement. Their traffic may never pass through a corporate office.
A startup with 50 to 500 managed endpoints should start with core controls. EDR, phishing-resistant MFA, central logs, and basic egress filtering cut more risk than a large NAC project. This order gives detection, identity protection, and containment. It avoids a major network redesign.
Do not prioritize microsegmentation before asset inventory, patching, logging, MFA, and EDR coverage are dependable. Controls need known assets and known traffic flows. Unknown assets and flows create piles of exceptions. The Cybersecurity and Infrastructure Security Agency makes the same maturity point. Build visibility and identity foundations before expecting advanced policy automation to work.
For most firms, buy EDR and basic egress controls before NAC or microsegmentation. Add ZTNA when remote app access is the real gap. This order fails only when unmanaged devices can enter sensitive sites. In that case, NAC may come first. Use automatic isolation carefully for servers, medical systems, and OT assets. Choose the control that closes the proven attack path.
Do not make advanced endpoint network controls the first project. First build asset inventory, phishing-resistant MFA, patch management, centralized logs, and baseline EDR coverage. In OT, medical, and industrial environments, test automatic isolation and network blocks for functional safety. Get asset-owner approval and define continuity procedures.
Servers and cloud workloads need different containment than user laptops. Their business dependencies often persist. Their outages can affect many apps. For a cloud workload, microsegmentation should allow only documented service-to-service paths. An app tier might reach a database through one specific port.
Cloud security groups or host firewall rules should deny other east-west traffic. EDR can find a harmful process on a server. Immediate device isolation can interrupt production APIs, scheduled jobs, or backup agents.
A safer response may block the process egress destination. It may remove the workload from a load balancer. It may revoke cloud role credentials and restrict only the suspicious flow. This protects service continuity while reducing lateral movement and credential abuse.
What people ask
Is EDR enough for zero trust?
No. EDR detects and responds on managed devices. Zero Trust also needs identity checks, least-privilege access, and controls for networks, apps, and unmanaged devices. EDR alone cannot enforce lasting egress or ZTNA policy.
Is ZTNA better than a VPN?
ZTNA is usually safer for named app access. It avoids exposing a broad network segment. VPN may still be needed for legacy administration or protocols that cannot use an app proxy.
What should block lateral movement?
Host firewalls and microsegmentation should block lateral movement. They restrict east-west traffic before an EDR alert occurs. EDR gives evidence and can isolate the host when prevention fails.
Can EDR block command-and-control traffic?
Sometimes, but EDR should not be the only barrier. DNS filtering, secure web proxy rules, and egress allowlists can block a command-and-control destination. They work even when the endpoint agent misses a new technique.
How fast should endpoint containment be?
High-confidence ransomware behavior should be contained in minutes, not hours. Critical servers and OT assets may need human approval. Test whether containment stays below 15 to 30 minutes without unsafe outages.
What does NAC do that EDR cannot?
NAC decides if a device may join or remain on a network. It uses identity and posture. EDR cannot assess or control a device without an installed, healthy agent.
Does microsegmentation help PCI compliance?
Yes, when it limits which workloads can reach cardholder data. It must also produce policy evidence. It does not replace PCI rules for logging, vulnerability management, encryption, and incident response.
What is the cheapest effective starting stack?
For most small U.S. organizations, start with phishing-resistant MFA and EDR. Cover at least 95% of supported endpoints. Add central logs and basic DNS or egress controls. Add ZTNA before NAC when remote app access is the immediate problem.
Choose EDR first, then close the proven gap
For most organizations, choose EDR plus targeted endpoint network controls. Do not choose EDR alone or a network-only project. Build identity and asset foundations first. Prove coverage with data. Automate only actions that your business can safely reverse.
