What Is ESPM (Endpoint Security Posture Management)?

ESPM evaluates endpoints against a baseline of security controls and surfaces specific failures — not risk scores, not vague warnings. Here's what it actually finds in real environments:

Encryption disabled. BitLocker or FileVault not enabled on endpoints. A lost or stolen laptop means every file on it is accessible to anyone who picks it up. The NSA's BitLocker Guidance and NIST SP 800-171 (Control 3.13.11) both treat encryption at rest as a baseline requirement — not optional.

Endpoint protection turned off. Windows Defender real-time protection disabled — sometimes by users who found it inconvenient, sometimes by malware that shut it down before running. Defense tampering — including disabling Defender — is documented in the Huntress 2025 Cyber Threat Report as standard attacker behavior, not an edge case.

Unpatched software with known vulnerabilities. Applications running with publicly documented critical CVEs. According to the Verizon 2025 Data Breach Investigations Report, vulnerability exploitation rose to the #2 initial access vector at 20% of breaches — a 34% year-over-year increase.

AutoRun enabled. Any USB drive plugged into the machine can execute code automatically on connection. CISA explicitly recommends disabling AutoRun to prevent malicious USB-based code execution — a risk documented since the Conficker worm's mass spread via infected USB drives.

Weak local administrator credentials. Local admin accounts with default or simple passwords. NSA and CISA identified default credentials and shared local admin passwords as the #1 most common misconfiguration across 1,000+ federal network assessments — and the primary enabler of lateral movement via credential reuse.

RDP exposed to the internet. Remote Desktop Protocol accessible without additional controls. According to the Microsoft Digital Defense Report 2024, RDP access accounts for 53% of offerings sold by access brokers — making it the most traded initial access commodity in the cybercrime economy.

Unmanaged endpoints. Security software not installed or not reporting in. Microsoft's research found that 80–90% of successful ransomware compromises originate through unmanaged devices — endpoints on the network but outside IT's visibility.

For MSPs, ESPM findings translate directly into client conversations. Instead of abstract risk discussions, you can show a specific list of specific issues on specific machines. "Three of your 20 endpoints have encryption disabled" is concrete and actionable — the kind of detail that makes quarterly business reviews productive. Security posture becomes a scorecard with measurable improvement over time rather than a vague concept you have to sell.