Wide uses the full column for everything, text, diagrams, code, and exercises. Narrow keeps the standard reading width.
Text size
Scales the body text. Headings and code blocks keep their size.
In this section
▾
Endpoint Security Engineering: Course Orientation
Module 0
ENDPOINT SECURITY ENGINEERING · MODULE 00
Default antivirus isn't enough. Engineer the layers that are.
Modern attacks walk past signature antivirus, and a single product was never going to stop them. This course teaches you to engineer layered endpoint defense across a Windows, macOS, Linux, and mobile fleet: hardening, attack surface reduction, behavioral antivirus, EDR, and custom detections, tuned so that each layer raises the attacker's cost and catches what the one before missed. This module shows you what you'll be able to build, the defense stack you'll work in, and how the course gets you there.
16 modules
across 4 phases
Push-ready
baselines, ASR rules, configs
Cross-platform
Windows, macOS, Linux, mobile
No prerequisites
every concept built up
Why this course exists
Signature antivirus assumes the threat has been seen before. The attacks that actually compromise endpoints have not: they run in memory, abuse the signed binaries already on the machine, execute scripts that never write a file, and steal credentials with tools that look like administration. Default antivirus does not see most of it, and installing one EDR product and calling it done leaves the same gaps a level deeper. The endpoint is where the attacker lands, escalates, and pivots, and defending it is an engineering problem, not a purchase.
This course teaches that engineering. Endpoint defense works because it is layered: hardening shrinks what is reachable, attack surface reduction blocks the techniques attackers reuse, behavioral antivirus and EDR catch execution, and custom detections find what prevention misses. Each layer raises the attacker's cost, and the layers together turn a soft fleet into one where an intrusion is expensive, loud, and contained. You build that stack across Windows, macOS, Linux, and mobile, deploy it at fleet scale, and tune it against the techniques it has to stop.
What you will be able to do
This course is built around the defenses you can engineer at the end, not the products you can name. Every module ties a control to the attacks it stops and has you deploy and tune it at fleet scale.
Onboard and harden the fleet
Deploy Defender for Endpoint, push hardening baselines and compliance through Intune, and gate access with Conditional Access.
Engineer attack surface reduction
Put ASR rules into block mode, and use exploit protection, device control, and application control to remove the techniques attackers reuse.
Tune antivirus and behavior
Engineer cloud-delivered and behavioral protection, not defaults, so prevention catches modern, fileless, and living-off-the-land techniques.
Configure EDR and response
Set up EDR, automated investigation, live response, and containment so a detected device is isolated and triaged fast.
Build detections and hunt
Write custom endpoint detections and hunt with KQL for credential access, lateral movement, persistence, and evasion that prevention missed.
Investigate, contain, and extend
Triage and contain incidents with forensic readiness, then extend the model to servers, Linux, zero trust, and a complete architecture.
You also leave with things you keep: endpoint hardening baselines, ASR rule sets, Defender for Endpoint detection configs you can push today, and a complete endpoint security architecture from the capstone.
The defense stack you will build
Every device in the fleet, Windows, macOS, Linux, and mobile, sits behind the same layered defense: hardening to shrink the attack surface, attack surface reduction to block reused techniques, antivirus and behavioral protection to stop execution, and EDR to catch and respond to what gets through, all managed and monitored from one place. An attack that defeats one layer meets the next; clean activity passes. This course builds and tunes every layer of that stack and operates it across the whole estate.
You build this against Northgate Engineering's fleet of 865 endpoints and 12 servers, with Defender for Endpoint and Intune as the management and detection plane, and a free M365 E5 developer tenant gives you a live environment to deploy and test every policy. The discipline is what carries: defense in depth, hardening, attack surface reduction, behavioral detection, and forensic readiness are how you secure endpoints on any platform, so the engineering you learn here ports to CrowdStrike, SentinelOne, and any modern EDR. Defender is the implementation; layered endpoint defense is the skill.
How the course is built
Sixteen modules move through four phases. You ground the foundations and endpoint internals, engineer the protection layers, build the detection-and-response capability, then move into advanced topics, cross-platform, and operating it all, ending with a full architecture capstone.
What you need and who this is for
There are no prerequisites, and every concept is explained the first time it appears. This course is for anyone responsible for keeping endpoints safe: endpoint and security engineers building the controls, administrators moving from managing devices to securing them, SOC and IR teams who need real endpoint depth, and architects designing the fleet-wide model.
Transferable defense-in-depth
Hardening, attack surface reduction, behavioral detection, and forensic readiness secure endpoints anywhere. Defender is the implementation; the engineering ports to CrowdStrike, SentinelOne, and beyond.
A live fleet to build in
A free M365 E5 developer tenant gives you a real Defender and Intune environment to deploy and test every baseline, rule, and detection against the techniques they stop.
How to get the most
Deploy each layer yourself and run the attack it stops against it. Keep the baselines, rules, and detections that work, that is how your push-ready config set gets built.
Do I already know this material?
Six quick scenarios across the full range of this course, from endpoint visibility to cross-platform coverage. Answer them to find out where you sit, and whether this course fits or it will sharpen knowledge you already have.
You deploy excellent endpoint detections, but they produce nothing on a set of machines. What is the most likely cause?
The detections are simply wrong.
Those machines are not onboarded to the endpoint platform, or are not reporting telemetry, so there is no data for the detections to act on.
Detection over a host that is not onboarded is silent by definition: there is nothing to analyse. Visibility is the prerequisite, so the first thing to confirm on a quiet machine is that it is enrolled and sending telemetry.
The attacker deliberately avoided them.
Endpoint security does not work on those machines.
You want only healthy, managed devices to reach corporate resources. Which approach fits?
Define device compliance policies and require a compliant, managed device as a Conditional Access condition for access, so unhealthy or unmanaged devices are blocked.
Device health becomes an access decision: the compliance policy defines healthy, and Conditional Access enforces it at sign-in, so an unmanaged or non-compliant device cannot reach the resource regardless of the password.
Trust any device that has the right password.
Block all mobile devices.
Rely on the corporate network perimeter only.
Attackers repeatedly gain execution through Office documents launching child processes and script abuse. Which endpoint control most directly reduces this attack surface?
Increase the screen-lock timeout.
Disable the firewall.
Attack surface reduction rules that block high-risk behaviours, such as Office applications spawning child processes and obfuscated script execution, cutting off common technique classes before they run.
Attack surface reduction targets the behaviours malware relies on rather than specific samples. Blocking Office-spawned children and obfuscated scripts removes whole classes of initial execution that signatures would chase one by one.
Remove all user accounts.
A novel malware sample has no known signature, yet your endpoint protection still catches it. What capability is responsible?
The signature database.
Behavioural and EDR detection, which flags what the process does, suspicious injection, credential access, anomalous process chains, rather than matching a known signature.
A novel sample has no signature to match, so static detection is blind to it. Behavioural and EDR engines watch what it does, and malicious actions look malicious whether or not the file has been seen before.
The device's serial-number check.
The screen saver.
You confirm an endpoint is compromised and actively communicating outbound. What is the right immediate containment using your EDR, while preserving evidence?
Power the device off to be safe.
Re-image it immediately.
Disconnect the entire subnet.
Isolate the device from the network through the EDR, which cuts the attacker's communication while keeping the system live so volatile evidence is preserved for investigation.
EDR network isolation severs the attacker without killing the host, so memory and live state survive for analysis. Powering off or re-imaging stops the threat but destroys the volatile evidence you need; subnet-wide disconnect is disproportionate.
Your endpoint security is strong on managed Windows laptops, but servers and Linux hosts are blind spots. What does mature endpoint security require here?
Ignore servers and Linux; they are different.
Buy a separate, unrelated product for each platform.
Extend the same telemetry, detection, and response coverage across servers and Linux, since attackers move to the least-monitored hosts and uniform coverage removes the blind spot.
Attackers gravitate to wherever you are not watching, and unmonitored servers and Linux hosts are exactly that. Extending consistent visibility and response across platforms closes the gap that a Windows-only posture leaves open.
Assume servers are inherently safe.
This course is for you.
You will build endpoint security from architecture and onboarding through attack surface reduction, behavioural protection, EDR, endpoint detection engineering, and full investigation and containment.
You have the fundamentals. The value here is the harder half.
You understand visibility and core controls, so the payoff is the back half: EDR and automated response, endpoint detection engineering, KQL hunting, triage and containment, forensic readiness, evasion, and cross-platform coverage.
You handled visibility, device-trust access, attack surface reduction, behavioural detection, EDR containment, and cross-platform coverage, the senior end of the discipline. Take the course to sharpen what you have, close the gaps you did not expect, and turn strong instincts into a complete endpoint architecture.
You are a student of this course now, so start by deciding what you want from it. Are you here to take a fleet from default antivirus to engineered defense, to close a specific class of attack on your endpoints, or to design an endpoint security architecture you can stand behind? Name that outcome, then turn it into a study plan: which layers and phases matter most to your environment, how much time you will give it each week, and what you want to have deployed by the time you finish.
The rest of Module 0 sets you up to do exactly that. Work through it to see why traditional antivirus fails, the modern attack chains that hit endpoints, the endpoint security stack and how to measure it, the Northgate fleet you will defend, the deployment sequence, the blast-radius problem, the maturity model, and the attacker's perspective. Then begin Module 1.
Stuck on this lesson?
Your question goes straight to the team and we'll reply by email. Sign in to ask.
