Almost 81% of hacking-related data breaches involve either a weak or stolen employee password. How an organization manages and protects credentials is critical to cybersecurity, which is why a growing number of companies are investing time and funds into enterprise password management.

This article is a complete guide to enterprise password management (EPM). We explain the basics of EPM, present go-to strategies and best practices, plus offer detailed reviews of the 12 best EPM tools currently available on the market.

What Is Enterprise Password Management (EPM)?

Enterprise Password Management (EPM) is a set of policies and tools organizations use to manage, protect, and control access to authentication credentials. EPM enables companies to:

• Define, centrally manage, and enforce company-wide password policies.
• Ensure employees use strong and unique passwords for every account.
• Automate various password-related tasks (creation, sharing, resets, syncs, etc.).
• Monitor and audit password usage across the organization.

The goal of EPM is to keep passwords safe without overly inconveniencing the workforce. An EPM tool must ensure security, but also provide a simple way to create, store, and access passwords.

The core feature of all EPM tools is so-called password vaulting. Each employee gets a personalized virtual "locker" for storing credentials. Users access the vault with a master key, which is the only password employees must remember. Once you log into the vault, the tool provides access to all other credentials.

Here's a list of other common features you should expect from an average EPM tool:

• The ability to control and enforce password-related rules (e.g., complexity requirements and expiration periods).
• Multi-factor authentication (MFA).
• Synchronization of usernames and passwords across multiple devices.
• Reports on how employees use passwords.
• Auto-filling of forms.
• Automatic credential resets.
• Prevention of suspicious log-ins.

In addition to improving the security posture, enterprise password management also helps meet compliance requirements. Many industry and regulatory standards (PCI-DSS, HIPAA, GDPR, etc.) insist on tight control over user and employee credentials.

Why Is Enterprise Password Management Important?

Here's why implementing enterprise password management should be at the top of a company's to-do list:

• Keep sensitive data and systems safe: Passwords are the most common way of authenticating employees accessing files and systems. High levels of EPM ensure everyone uses strong and unique passwords, lowering the likelihood of intruders reaching valuable data and assets.
• Enforce company-wide policies: An EPM platform enables you to set password-related policies. You control the minimum length and complexity for each password, plus ensure no one reuses the same credentials for different accounts or services.
• Counter password-based attacks: Strong credentials are the most effective way of countering password-based attacks. You lower the risk of successful brute force, dictionary, and spraying attacks.
• Take the burden off employees: An average employee has 27 work-related passwords, which is the main reason why people reuse credentials and create easy-to-remember passwords. An EPM tool takes away the burden of having to remember credentials for each account, making it easier for employees to use unique, complex passwords.
• Lower risk of human error: An EPM tool helps prevent errors that lead to a compromised password. For example, a tool helps recognize fake phishing websites that ask for login info and prevents employees from storing and sharing passwords in plain text files.
• Boost team productivity: A password manager makes it significantly easier for employees to create and use passwords. Teams spend less time on password-related tasks and access resources with more speed.
• Monitor password usage: EPM platforms track how employees use, store, and share passwords. Such oversight boosts security and helps identify vulnerabilities you can address with training sessions and policy updates.

Enterprise Password Management Best Practices

Here's a list of the best practices for managing, storing, and protecting passwords (with or without an EPM tool):

• Enforce the use of strong passwords with rules for minimum length (at least 12 characters long) and complexity requirements (a mix of upper and lowercase letters, numbers, punctuation, and special symbols).
• Ensure every employee changes their password regularly, either biweekly or monthly (and without reverting to a previously used password).
• Never use the same password for different accounts or services.
• Ensure employees do not store or share passwords in plain-text files.
• Use multi-factor authentication to require employees to provide additional verification beyond their password (e.g., a token on a mobile device or a biometric scan).
• Lock accounts after 3-5 unsuccessful password guesses (a leading brute force prevention measure).
• Conduct regular audits of password-related policies, procedures, and usage rules.
• Keep all EPM software up to date with the latest patches.
• Change default passwords before deploying new software.
• Ensure employees know how to use and make the most out of password vaults.
• Monitor for suspicious login attempts (e.g., someone logging in in the middle of the night or from a different state).
• Use at-rest encryption and in-transit encryption to keep passwords safe.
• Organize regular training to ensure everyone is up to date with the latest password-related threats and rules.

12 Best Enterprise Password Management Solutions

Below is an in-depth look at the best enterprise password management tools currently on the market. We reviewed both free and paid platforms, so you'll find the right fit regardless of your budget.

Free Enterprise Password Management Solutions

Let's first check out the best EPM tools that offer enough "freemium" features to significantly improve password management and security at your organization. 

KeePass

KeePass is an open-source password management tool that relies on AES 256-bit encryption with plugins that support additional algorithms (GOST, Twofish, ChaCha20, and Serpent).

Despite being completely free, KeePass is rich in features. Here's an overview of what the tool offers:

• The ability to store all your passwords in one database locked with a master key.
• Encryption of the complete vault, not only the password fields.
• Password edit controls.
• The freedom to use either a master password or a key file (or combine both methods).
• A feature for exporting the password list to various formats (TXT, HTML, XML, and CSV).
• Simple database transfers and imports from other password managers.
• The ability to create, modify, and delete password groups.
• Time fields (creation, last modification, last access, and expiration times).
• Multi-factor authentication.
• Auto-type capability.
• A strong password generator.

KeePass also enables you to write custom plug-ins (or download plug-ins from other users) to extend the tool's functionality.

Compatibility: Windows, macOS, and Linux (there are unofficial editions for Android, iOS, and all major browsers).

Who should use it: Companies on the market for a free EPM tool and with teams experienced in open-source coding.

Main pros of KeePass

• The tool is completely free and open source (OSI certified).
• Compatible with most operating systems, browsers, and smart devices thanks to various unofficial versions of the tool.
• High levels of security.
• Very customizable.
• Has a portable version you carry on an external device and just plug in without installation.

Main cons of KeePass

• A steep learning curve for less tech-savvy users.
• An outdated interface.
• No live user support, so users must rely on community forums for help.

Bitwarden

Bitwarden is an open-source password manager that uses AES-CBC 256-bit encryption for vaults and PBKDF2 SHA-256 for encryption keys. Unlike KeePass, Bitwarden has both a free and paid edition.

The main trait behind Bitwarden's security is that the tool does not store your passwords. Instead, the platform keeps encrypted versions of passwords, and users are the only ones with the decryption key.

Bitwarden's free tier is limited compared to the paid version of the tool, but the free edition offers a well-rounded set of features:

• Free to use across multiple devices.
• Data breach reports.
• Multiple logins for the same applications.
• Storage for unlimited passwords on an unlimited number of synced devices.
• Auto-fill and auto-capture capabilities.
• One gigabyte of available storage.
• Two-factor authentication.
• Simple password sharing.
• The option to use a physical security key.

Bitwarden's Teams edition costs $3/month per user and the Enterprise tier charges $5/month per user. Premium versions of the tool provide extra features, such as 2FA via YubiKey and FIDO2, priority support, custom management roles, and single sign-on (SSO).

Compatibility: Windows, macOS, Linux, Android, and iOS (plus extensions for Chrome, Firefox, Safari, Edge, Opera, Vivaldi, Brave, DuckDuck Go, and Tor).

Who should use it: Smaller, tech-savvy teams looking for a free or low-cost EPM tool.

Main pros of Bitwarden

• An open-source tool.
• The free version allows unlimited vault items across unlimited synced devices.
• Only keeps encrypted versions of passwords.
• An intuitive, easy-to-use interface.
• A track record of quickly detecting and updating errors (mainly due to the tool's bug bounty program).

Main cons of Bitwarden

• Limited customer support for the free version of the tool.
• No dark web monitoring or biometric 2FA for any version of the tool.
• The Send feature enables users to share passwords insecurely.

Norton Password Manager

Norton Password Manager is one of the most streamlined free password managers on the market. The tool provides users with:

• Highly secure password vaults protected with 256-bit AES encryption and TLS secure connections.
• Basic two-factor authentication (including biometric login for mobile users).
• A zero-knowledge policy.
• Unlimited password storage.
• A Safety Dashboard that helps track accounts, make updates, and prevent duplicate or weak passwords.
• Vault auditor.
• Automatic password changer.

Norton also offers a free password generator that helps quickly and easily create hard-to-crack credentials.

Compatibility: Android and iOS (plus extensions for Chrome, Firefox, Safari, and Edge).

Who should use it: Sole proprietors and small businesses looking for a free and easy-to-use password manager.

Main pros of Norton Password Manager

• The tool is completely free and does not "lock" any features behind a premium edition.
• Stores an unlimited number of passwords.
• A sleek, easy-to-navigate interface.
• Creates strong passwords automatically.
• Syncs accounts across multiple devices.

Main cons of Norton Password Manager

• Does not allow users to share passwords one-on-one.
• Lackluster documentation.
• Can't set up multiple users under the same account.

Dashlane

Dashlane is a password manager that has both free and paid editions. The main selling point of this tool is its high levels of safety as Dashlane uses the following measures to keep vaults safe:

• End-to-end AES-256 encryption.
• A zero-knowledge architecture.
• Both 2FA and universal 2FA verification.
• A built-in VPN.

The free version of Dashlane offers the following features:

• Storage of up to 50 passwords (available for up to 5 accounts).
• Password sharing for up to 5 accounts.
• A password generator.
• Health checker that searches for weak, reused, and compromised passwords.
• Form auto-fill.
• Alerts in case of incidents.
• Biometric account recovery.

Paid versions of Dashlane (which start at $4.99/month per user) include extra features, such as:

• Dark web monitoring.
• Unlimited password sharing.
• 1GB of encrypted file storage.
• An excellent dashboard that helps pinpoint password-related problems and monitor usage.
• Enforceable policy settings.
• Advanced account monitoring and reporting.
• SSO options.
• Active Directory integration.
• Remote account deletion.

High levels of security and a built-in VPN make Dashlane a sound choice for companies with remote-first workforces.

Compatibility: Windows, MacOS, iOS, and Android (plus extensions for Edge, Chrome, Firefox, and Safari).

Who should use it: Companies that rely on remote teams and are worried about login security.

Main pros of Dashlane

• Easy to set up and use.
• High levels of cybersecurity.
• Unlimited password storage and device syncing for all editions of the tool.
• A powerful and easy-to-use admin console.
• Detailed reporting.

Main cons of Dashlane

• The free plan limits users to one device.
• Too many features locked behind a "paywall."

Paid Enterprise Password Management Solutions

Let's now explore the market's top paid enterprise password management tools that offer the most value for your money.

1Password

1Password is a popular password manager with a range of excellent EPM features, such as:

• Creation of multiple vaults to store passwords, credit card data, API tokens, etc.
• Customizable controls with granular-access features (permissions by category, group, role, etc.).
• Creation of temporary guest credentials with flexible expiration options (one view, one hour, one day, 7 days, 14 days, or 30 days).
• The Watchtower feature that monitors for reused passwords, vulnerable credentials, and compromised accounts.
• Integration with identity and access management (IAM) platforms (Okta, Active Directory, and Rippling).
• Detailed health reporting.
• Biometric login options and multi-factor authentication using Duo.

This EPM tool has a detailed knowledge base that helps users set up and use the tool. 1Password also integrates with Have I Been Pwned to monitor for data breaches.

1Password Business tier pricing is $7.99/month per user, but there's also the Team Starter Pack option that costs $19.95/month for up to 10 users. The tool has a 14-day free trial for all plans.

Compatibility: Windows, macOS, Linux, Android, and iOS (plus extensions for Chrome, Firefox, Edge, Brave, and Safari).

Who should use it: SMBs that want granular password controls and in-depth monitoring.

Main pros of 1Password

• Excellent admin dashboards.
• Proactively helps employees maintain good password hygiene.
• Encrypts passwords both at rest and in transit.
• Granular security controls.
• An unlimited number of users and passwords.
• A bonus Family plan for every Business user.

Main cons of 1Password

• Only allows 20 guest accounts at one time.
• Expensive for larger teams.
• Limited import options.

NordPass

NordPass is an excellent tool that encodes all sensitive data with the xChaCha20 encryption protocol. Other security-related capabilities offered by the tool include:

• Mandatory multi-factor authentication.
• The capability to identify weak, reused, and old passwords.
• A data breach scanner that monitors the web for leaked data.
• Guaranteed GDPR and HIPAA compliance.

Additionally, NordPass keeps user activity logs that enable an organization to track password usage and overall health. You also get cross-platform support, auto-fill capabilities, and the ability to store different types of credentials.

NordPass Business tier pricing starts from $3.59/month per employee (up to 250 users). The Enterprise edition allows more than 250 users, plus has SSO with Azure AD, MS ADFS, and Okta. Both tiers have trial periods.

Compatibility: Windows, macOS, Linux, iOS, and Android (plus extensions for Chrome, Firefox, Edge, and Opera).

Who should use it: Organizations chiefly worried about data security compliance rules (e.g., healthcare providers or companies operating in the E.U.).

Main pros of NordPass

• Unlimited users and password storage.
• A complete overview of password-related activities.
• Premium 24/7 customer support.
• Easy user management.
• Quick and secure group password sharing.
• Detailed user activity logs.
• Actionable password health report.

Main cons of NordPass

• The Business plan does not support SSO.
• Unknown prices for the Enterprise tier.
• You cannot use the free version of the tool on multiple devices simultaneously.

LastPass

LastPass is a password manager that uses AES 256-bit encryption and operates under a zero-knowledge policy. The tool is also SOC2, SOC3, C5, ISO27001, and GDPR compliant.

LastPass's main selling point is its ease of use. The tool is very simple and convenient for employees as it enables them to easily:

• Create, store, and organize passwords.
• Perform one-to-one password sharing.
• Access work apps from anywhere and any device.
• Use the SSO feature and enable multiple platform sign-ins with a single ID.
• Use auto-fill to speed up logins.
• Go "passwordless" and get seamless access to vaults.

LastPass also emphasizes proactive security with features such as:

• Immediate alerts if a company or personal data is at risk.
• Over 100 customizable policies for personalizing security rules.
• Reports on employee password management behavior.
• Dark web monitoring.

LastPass has two tiers: the Teams edition (which costs $4.25/month per user) and the Business edition (which charges $6.25/month per user). The Teams tier limits you to under 50 users, while the Business version has no user cap. Both tiers have a trial period.

Compatibility: Windows, macOS, Linux, iOS, and Android (plus extensions for Chrome, Firefox, Safari, Edge, and Opera).

Who should use it: Teams looking for an easy-to-use password manager with well-rounded features.

Main pros of LastPass

• Unlimited passwords.
• Emphasizes user convenience.
• Over 100 customizable policies.
• In-depth admin security reports.
• Over 1,200 pre-integrated SSO apps.
• Extra free Family package licenses for each employee.

Main cons of LastPass

• The Teams tier has a limit of only 50 users.
• Only gives 3 SSO apps with MFA and requires an extra $2/month per seat for more.
• While the company bounced back, LastPass suffered a concerning data breach in August 2022.

Zoho Vault

Zoho Vault is an affordable password manager that comes in several editions. Even the free version is okay for individual users, but the Team tier (which charges $0.90/month per user) has solid EPM features, including:

• Dedicated password vaults for teams (protected with the AES 256-bit cipher).
• Centralized admin controls.
• Multi-factor authentication.
• Simplified sign-ins and password sharing.
• Password policy enforcement.
• Credential expiration alerts.
• IP address restrictions.
• Password imports from browsers.
• Integration with G Suite and Office 365.

The more feature-rich Enterprise edition charges a minimum of $4.50/month per user and adds additional capabilities, such as:

• User group management.
• A "break glass" account for emergency access.
• SSO for cloud apps.
• Custom alerts for password-related events.
• Detailed reports on user access, sharing behavior, and general password hygiene.
• Integration with Okta and OneLogin.
• Helpdesk integration.

Zoho also offers a range of other business apps (such as CRM and sales software), all of which integrate seamlessly with Zoho Vault.

Compatibility: Windows, macOS, Linux, iOS, and Android (plus extensions for Chrome, Firefox, Safari, Edge, Brave, and Vivaldi).

Who should use it: Companies on the market for feature-rich and affordable EPM services.

Main pros of Zoho Vault

• The Team tier is among the most affordable EPM solutions on the market, yet still has decent features.
• Advanced 256-bit encryption and zero-knowledge architecture.
• In-depth password security reports.
• Great transparency of password usage.
• Integration with other Zoho solutions.
• Syncs across Windows, macOS, Android, and iOS devices.

Main cons of Zoho Vault

• Monthly subscriptions are considerably more expensive than yearly plans.
• Users cannot import saved Safari passwords.
• Weekday-only 24h support.

Passbolt

Passbolt is an open-source password manager known for its flexibility and customization. The tool's Community tier is free to use for an unlimited number of users and has the following features:

• Passwords management and sharing.
• Private and shared folders.
• User and group management.
• Two-factor and 3-step authentication.
• Open API.

The Business tier (which costs $3/month per user) adds the following features:

• LDAP provisioning.
• Account recovery (escrow).
• Tags management.
• Activity logs for tracking changes.
• SSO with Microsoft.

Finally, the Enterprise tier (which has custom prices) offers additional features you won't find in many other EPM tools, such as:

• High availability consulting.
• Disaster recovery consulting.
• White glove migration.
• Custom features development.

Passbolt enables users to choose whether to self-host the tool on their servers or use the platform's cloud services.

Compatibility: The team behind Passbolt recommends you run the tool on a stable version of a major Linux distribution, such as Debian or Ubuntu. There are browser extensions for Edge, Chrome, and Firefox.

Who should use it: Organizations with teams experienced in open-source tools and looking to host an EPM on an in-house server.

Main pros of Passbolt

• Open source (under AGPLV3 license).
• A rich selection of features, some of which are rare in the EPM niche.
• A flexible number of users for the Business tier.
• Highly customizable and extensible thanks to its restful API.
• The freedom to choose whether you want to host the tool on-prem or in the cloud.

Main cons of Passbolt

• No mobile or desktop apps.
• Doesn't support advanced logs for audits.
• The Enterprise tier does not have transparent prices.

Keeper

Keeper is a password management tool that offers top-tier security and EPM services. The tool is highly secure thanks to a zero-trust and zero-knowledge architecture.

Keeper has three paid tiers, all of which allow an unlimited number of devices. The Starter plan (which costs $2.00/month per user) offers:

• Encrypted vault for every user (for passwords and other files).
• Folders and subfolders (shared and personal).
• Policy enforcement.
• Security audits and activity reporting.
• Team management.
• Two-factor authentication.

The Business tier (which costs $3.75/month per user) adds delegated administration, share admins, and advanced organizational structure. Finally, the Enterprise edition (which has custom prices) adds advanced features like:

• SSO (SAML 2.0) authentication.
• Automation features.
• AD and LDAP syncs.
• SCIM and CLI provisioning.
• Developer APIs.
• Dark web protection.
• Advanced reporting.

All tiers have access to a helpful password generator that enables users to quickly create strong and unique credentials.

Compatibility: Windows, macOS, Linux, iOS, and Android (plus extensions for Chrome, Firefox, Brave, Safari, Edge, and Opera).

Who should use it: Sizable companies looking for advanced EPM services and good per-user prices.

Main pros of Keeper

• Highly secure and rich with features.
• Very customizable.
• Excellent UI/UX.
• Free family plan for every user.
• Smooth password capture and replay.
• Multiple forms of MFA.

Main cons of Keeper

• You need a skilled in-house team to make the most out of the tool.
• Unknown prices for the Enterprise tier.
• Relatively small storage limits.

Roboform

RoboForm is an excellent password manager that excels at enforcing EPM rules at larger companies thanks to:

• Centralized employee onboarding and company-wide policy deployment features.
• An unlimited number of admins.
• The capability to easily monitor and customize access to passwords based on employee roles.
• Excellent SSO support.
• Highly customizable policies.

This EPM tool enables users to store various data in their vaults (passwords, usernames, bookmarks, business-related files, etc.). All stored data is easily sharable across teams.

Teams with 1 to 10 members will have to pay $39.95/year per user for RoboForm. The tool does have 3-year and 5-year subscription options that bring the per-user price down, plus larger teams get significant discounts.

Compatibility: Windows, macOS, iOS, and Android (plus extensions for Chrome, Firefox, Safari, Edge, and Opera).

Who should use it: Bigger companies looking for top-tier EPM for large teams spread across multiple departments.

Main pros of Roboform

• End-to-end AES256-bit encryption for password creation, storing, and sharing.
• The tool decrypts data locally.
• Enables companies to easily manage large numbers of people.
• Intuitive and easy-to-use password automation.
• Excellent onboarding and training materials.
• Detailed knowledge base and 24/7/365 support.

Main cons of Roboform

• On the expensive side for smaller teams.
• Clients outside the USA occasionally have problems getting quick tech support.
• Limited importing options.

Sticky Password

Sticky Passwords is a cost-friendly password manager with a solid offering that includes:

• Simple and safe password sharing.
• 2FA.
• Auto-fill capabilities.
• Customizable permissions.
• A built-in password generator.
• Various syncing options.
• USB password vaults (so-called Portable Passwords).

One of Sticky Password's main selling points is that the tool guarantees clients never permanently lose employees' credentials. In case of an incident or a disgruntled employee, there's an Emergency Access feature that allows admins to gain access to a specific account.

Sticky Password charges clients $29.99/year per user. The tool has a free edition, but that version of Sticky Password does not allow syncing or password sharing. There is also the premium version that charges $39.99/year per user and adds syncing across devices and dark web monitoring.

Compatibility: Windows, macOS, iOS, and Android (plus extensions for Chrome, Firefox, Safari, Edge, Opera, and Brave).

Who should use it: Less tech-savvy teams with many shared machines that wish to ensure there's no way to permanently lose credentials.

Main pros of Sticky Passwords

• Simple to use and cost-effective.
• Users can use a flash drive as a plug-and-play password management device.
• A helpful Emergency Access feature.
• Excellent form filling.
• Each license includes a donation to save endangered manatees.

Main cons of Sticky Passwords

• The Premium version does not add enough features to justify the price difference.
• No password inheritance.
• If you forget your master password, the account is gone for good.

Which Enterprise Password Management Solution Should You Choose?

The first decision you must make is whether you'll use a free or paid enterprise password management tool. Most platforms keep advanced features behind a "paywall," but basic features are enough for some companies and use cases.

If you opt for a paid EPM tool, remember to both consider the initial purchase and ongoing maintenance costs. Other factors you must account for when choosing a tool are:

• Specific security features offered by the tool (e.g., end-to-end encryption or MFA).
• How much you'll have to customize the tool.
• Any relevant compliance requirements.
• Your in-house team's preference and previous experience.
• Whether the tool will be able to scale alongside your needs without impacting performance.
• Integrations with existing IT infrastructure and systems.
• The level of required customer support.
• How much time the tool requires for day-to-day maintenance.

Consider these factors and go with one of the enterprise password management tools discussed above. Every tool we covered here is a worthwhile choice, but some fit certain use cases better than others.

We also recommend you test the tool before going all-in on a paid edition. All the platforms discussed above have some form of trial, so there's no harm in giving several tools a go and seeing which one performs the best before choosing a long-term solution.

Free or Paid, an EPM Tool is a Must

Manual management of your company's passwords is too complex, time-consuming, and outright risky. Even a single password falling into the wrong hands is enough to cause a data leakage or breach, so invest in EPM and ensure your credentials are safe from prying eyes.

While relatively harmless at first sight, shadow IT causes major risks for companies. In 2022, nearly 7 out of 10 organizations experienced a security incident due to employees using unsanctioned hardware or software.

In addition to security concerns, shadow IT is also among the leading causes of app sprawl, operational inefficiencies, and compliance violations.

This article explains the dangers of shadow IT and its potentially devastating effects on security postures and bottom lines. We'll take you through all you need to know about this widespread problem and present the most effective ways of keeping shadow IT at a minimum.

What Is Shadow IT?

Shadow IT refers to any unauthorized device, IT service, or app employees use without the knowledge of the company's security department. When the security team is unaware of a certain application or piece of hardware, the organization cannot support the tech or ensure that it's secure.

Employees typically turn to shadow IT because of convenience or when an app offers better functionality than what the company approved for using. While convenient for employees, shadow IT poses several considerable risks for an organization, including:

• Security vulnerabilities (misconfigurations, accounts with easy-to-crack passwords, malware-infected devices, etc.).
• Compliance violations (e.g., someone keeping sensitive customer data in a personal Dropbox account).
• Inefficiencies within the organization (e.g., teams using different tools to accomplish the same task or unoptimized apps using up too much network bandwidth).

Here are a few statistics that show just how prevalent shadow IT is:

• Over 80% of employees regularly rely on some form of shadow IT.
• Over 50% of workers use at least one unauthorized app.
• Almost 81% of IT leaders believe employees introduced rogue cloud assets into the environment.
• An average company uses around 1,220 cloud services. Only 7% of them completely comply with security and compliance requirements.
• Over 35% of employees feel like they must work around security measures or protocols to perform their duties effectively.
• Almost 63% of employees regularly send work-related documents to personal emails.
• Around 32% of workers use unapproved communication and collaboration tools.

There are a few reasons why shadow IT got out of control in recent years:

• The rise of remote work due to COVID-19 restrictions.
• On-demand cloud services that enable anyone with limited technical know-how to deploy advanced systems and platforms.
• The increased popularity of DevOps principles that encourage teams to work as quickly as possible.
• More reliance on Bring Your Own Device (BYOD) hardware.

Examples of Shadow IT

Below are some of the most common examples of shadow IT:

• Using personal devices (smartphones, tablets, laptops, etc.) to access company data or services without explicit IT department approval.
• Installing unsanctioned software without the approval of the company, such as third-party tools or social media platforms.
• Creating cloud workloads using personal accounts.
• Setting up rogue servers or networking infrastructure to support work.
• Using personal storage devices (such as USBs or portable hard drives) to store and share company data.
• Sharing company data or collaborating with colleagues via social media profiles.
• Accessing corporate data or the back end of a website from a BYOD device on a home network or public Wi-Fi.
• Secretly deploying a rogue cloud environment for testing purposes.
• Using SaaS apps (file-sharing services, collaboration tools, project management software, etc.) without the approval of the InfoSec team.
• Using unauthorized instant messaging or chat apps to communicate with coworkers, clients, or vendors (e.g., chatting on Viber when the company requires all communication to go through Skype).
• Creating self-developed Excel spreadsheets and using them to store and share company data.
• Connecting IoT devices (such as smart speakers or watches) to the corporate network without the knowledge of the security department.
• Sharing work files on a personal Dropbox account or sending data to a private email.
• Opening a secret Slack channel despite the company wanting its workforce to use Microsoft Teams.
• Logging into both personal and business accounts in the same app and using both profiles to manage company assets.
• Secretly using unsanctioned workflow or productivity apps (such as Trello or Asana).
• Using business devices for online gaming.

What Are the Cons of Shadow IT?

The use of shadow IT rarely has malicious intent, but the practice often leads to severe consequences, including:

• Security gaps: Security staff cannot secure systems and apps they do not know exist. Introducing rogue hardware and software creates vulnerabilities malicious actors could exploit for several types of cyberattacks.
• Data exposure: Employees store, share, and access sensitive data via insecure shadow IT devices and apps, increasing the attack surface for data breaches.
• Lack of standardization: You increase the chance of incompatibilities whenever teams use different tools and systems to accomplish the same tasks. There's also the increased risk of teams working with unofficial, invalid, or outdated data.
• Data leaks: Employees sharing corporate data on unauthorized apps or private devices often leads to data leakage (accidental release of data to an unauthorized recipient).
• Higher costs: Shadow assets often increase IT costs by causing unexpected expenses and budget overruns. For example, a personal cloud storage someone scales to serve enterprise-level needs is far less cost-effective than services intended for corporate usage.
• Compliance risks: Teams could secretly use technologies or data storage that do not comply with regulatory requirements (such as those imposed by GDPR or HIPAA). Even if employees do so without the company's consent, organizations are still liable for violation fines.
• App sprawl: Shadow IT is a leading cause of app sprawl (excessive proliferation of apps). Sprawl occurs when teams purchase and deploy too many programs without proper consideration for value, fit, or functionality.
• Performance bottlenecks: Adding extra programs and apps on top of existing systems often results in performance issues.
• Risky data silos: Any files stored on unauthorized or personal devices aren't accessible to others in the company. You lose access to that data if the employee leaves the company.

Are There Any Positives to Shadow IT?

While the cons by far outweigh its pros, there are some positives to shadow IT. The most notable benefits are:

• Teams become more agile when they have the freedom to choose software.
• Making ad hoc IT decisions sometimes enables a team to respond to changes and threats with more speed.
• The ability to choose preferred apps and devices encourages employees to innovate. Teams experiment with new technologies and tools, which gives the organization a slight competitive edge.
• Some shadow IT leeway enables teams to quickly test out new tools that may turn out to be a better fit or more cost-effective than current solutions.
• Teams that work with preferred apps are more likely to be invested in their jobs. This morale boost helps improve employee satisfaction and retention rates.

Since most companies see shadow IT as an inevitability, many organizations are now trying to control the practice with security protocols. There are some mandatory precautions if you opt for that route, such as:

• Attack surface management (ASM) tools: These platforms continuously monitor all internet-facing assets to identify signs of shadow IT. Once a new asset appears, ASM tools automatically evaluate potential flaws and help eliminate threats.
• Cloud asset security broker (CASB): These platforms ensure secure connections between employees and any cloud asset they use (known or unknown). A CASB discovers all shadow cloud services and enforces extra security measures (such as encryption, access control policies, and malware detection).

In the fast-paced business world, giving employees some freedom to solve problems and experiment is advantageous. However, allowing shadow IT to go on uncontrolled is a massive mistake, so let's see how companies keep the practice in check.

How Do You Handle Shadow IT?

Here are the most effective ways of preventing shadow IT:

1. Create IT policies: Create detailed policies that outline all allowed software, hardware, and services within the organization. Policies must also explain exactly how employees should use authorized tech, as well as state any consequences of violating the rules. 
2. Provide IT support: Ensure all teams have adequate IT support to address their tech needs and issues.
3. Encourage communication: Encourage an open dialogue between IT and other departments to ensure all teams are happy with their assigned technologies. Open lines of communication lower the chance of anyone secretly using unauthorized tech.
4. Educate employees: Organize regular awareness training to educate teams about the risks of shadow IT. Ensure everyone understands why you insist on using only approved software and hardware.
5. Create a quick (but safe) approval process: If someone in your team proposes adding a new tool to operations, the approval process must be quick and secure.
6. Conduct regular tool audits: Carry out regular audits that track what tools different departments use to perform their tasks.
7. Boost endpoint security: Improve your endpoint security to prevent employees from installing unapproved apps on their devices (either company-owned or as a part of the BYOD policy).
8. Monitor network activity: Your security team must monitor network activity for signs of unauthorized solutions and services. Make full use of intrusion detection systems and firewalls to analyze traffic and user actions.
9. Regular reviews: Periodically review and update your IT policies, approval processes, and security measures. Ensure you're both up to date with the latest technology trends and security threats.
10. CASB and ASM tools: Regardless of whether you opt to tolerate some amount of shadow IT or not, the aforementioned CASB and ASM tools are a worthwhile investment.

Keep Unauthorized Apps and Devices at a Minimum

While shadow IT boosts employee productivity and helps drive innovation, uncontrolled use of technology introduces potentially devastating risks. Keep shadow IT at a minimum by educating employees, setting up effective preventive measures, and encouraging teams to be open about their IT needs.

Rate limiting is a simple yet highly effective technique for protecting APIs from unintentional and malicious overuse. Without a rate limit, anyone can bombard a server with requests and cause spikes in traffic that eat up resources, "starve" other users, and make the service unresponsive.

This article is an intro to rate limiting and the importance of restricting the number of requests that reach APIs and services. We explain what rate limits are and how they work, plus cover the different types of algorithms you can use to adopt rate limiting for your use case.

What Is Rate Limiting?

Rate limiting is the practice of restricting the number of requests users can make to a specific API or service. You place a cap on how often users can repeat an action (i.e., attempting to log into an account or send a message) within a certain time frame. If someone reaches their limit, the server begins rejecting additional requests.

Rate limiting is both a cybersecurity precaution and a key part of software quality assurance (QA). Companies use rate limits to:

• Prevent a large number of requests from overwhelming a web or application server.
• Ensure all users have equal access to the API and that no one consumes too much bandwidth, data storage, or memory.
• Stop human users, bots, and applications (anyone or anything with the ability to issue calls to an API) from abusing a web property.
• Prevent different kinds of malicious bot activity (namely DoS/DDoS and brute force attacks).

Technically, rate limiting is a form of traffic shaping. The practice lets you control the flow and distribution of traffic to prevent infrastructure overload or failure.

Most systems with a rate limit have caps well above what even a high-volume user could realistically request. The most common example is social media messaging. All social media websites have a cap on the number of direct messages you can send to other users. If someone decides to send a thousand messages to other profiles, rate limiting kicks in and stops the user from sending messages for a certain period.

Why Is Rate Limiting Important?

Here's a list of the main reasons why rate limiting is an essential aspect of any healthy service:

• Preventing overloads: Too many requests can overwhelm a server, causing it to slow down or even become unresponsive. Limiting the number of requests a server or API processes helps maintain the performance and availability of your service.
• Ensuring fairness: Rate limiting prevents any user from monopolizing resources at the expense of others. Placing a cap on allowed requests gives everyone a fair opportunity to use the service.
• Managing costs: If there's a cost associated with each request made to the service, rate limiting is essential to controlling expenses and ensuring efficient use of resources.
• Usage metering: If a user signs up for a plan that allows, for example, 1000 API requests per hour, rate limiting ensures the client stays within the set cap.
• Controlling data flow: Rate limiting enables an admin to control data flows, which is key for APIs that process large volumes of data. For example, you could distribute data evenly between two APIs by limiting the flow into each element.
• Protecting against malicious activity: Rate limiting is vital to preventing several types of cyberattacks. The practice is the go-to counter to denial-of-service attacks (flooding the server with requests in an attempt to make it unresponsive), brute force attacks (bots trying to guess login passwords by typing in random characters), and credential stuffing (using a list of compromised user credentials to breach into a system).

How Does Rate Limiting Work?

To set a rate limit, an admin places a cap on the number of requests users can make to a server or API within a certain time frame. Typically, the rate-limiting mechanism tracks two key factors:

• The IP addresses of users sending requests.
• How much time elapses between each request.

The main metric for rate limits is the Transactions Per Second (TPS). If a single IP address makes too many requests within a certain period (i.e., goes over its TPS limit), rate limiting stops the server or API from responding. The user gets an error message and is unable to send further requests until the timer resets. 

Rate limiting always relies on some form of throttling mechanism that slows down or blocks requests. Admins implement rate limiting on the server or client side, depending on which strategy better fits the use case:

• Server-side rate limiting is more effective at preventing overload and stopping malicious activity.
• Client-side rate limiting is better at managing costs and ensuring fair use of resources.

Many admins also set rate limits based on usernames. This approach prevents brute force attackers from attempting to log in from multiple IP addresses.

Types of Rate Limits

Let's look at the different types of rate limits you can use to control access to a server or API. Just remember that you can combine different types into a hybrid strategy. For example, you may limit the number of requests based on both IP addresses and certain time intervals.

Time-Based Rate Limits

Time-based rate limits operate on pre-defined time intervals. For example, a server may limit requests to a certain number per time period (such as 100 per minute).

Time-based rate limits typically apply to all users. You can set these limits to be either fixed (timers count down regardless of when and if users make requests) or sliding (the countdown starts whenever someone makes the first request).

Geographic Rate Limits

Geographic rate limits restrict the number of requests coming from certain regions. These caps are an excellent choice when running location-based campaigns. Admins get to limit the requests from outside the target audience and increase availability in target regions.

These rate limits are also good at preventing suspicious traffic. For example, you could predict that users in a certain region are less active between 11:00 PM and 8:00 AM. You set a lower rate limit for this time, which further constraints any attacker hoping to cause problems with malicious traffic.

User-Based Rate Limits

User-based rate limits control the number of actions individual users can take in a certain time frame. For example, a server may limit the number of login attempts each user can make to 100 per day.

User-based limits are the most common type of rate limiting. Most systems track the user's IP address or API key (or both). If the user exceeds the set rate limit, the app denies any further requests until the per-user counter resets.

Keep in mind that this type of rate limiting requires the system to maintain the usage statistics of each user. Such setup often leads to operational overhead and increases overall IT costs.

Concurrency Rate Limiting

Concurrency rate limits control the number of parallel sessions the system allows in a certain time frame. For example, an app might prevent more than 1000 sessions within a minute.

Server Rate Limits

Server rate limiting helps admins share a workload among different servers. For example, if you run a distributed architecture with five servers, you could use a rate limit to place a cap on each device.

If one of the servers reaches its cap, the device either routes it to another server or drops the request. Such a strategy is vital to achieving high availability and preventing DoS attacks that target a specific server.

API Endpoint-Based Rate Limiting

These rate limits are based on the specific API endpoints users are trying to access. For example, an admin may limit requests to a specific endpoint to 50 per minute, either due to security or overloading concerns.

Rate Limiting Algorithms

Here are the most common algorithms companies rely on to implement rate limiting:

• Token bucket: Each time a user makes a request, the system removes a token from the so-called token bucket. Once the bucket is empty, the user cannot make further requests until a refill resets the number of session tokens.
• Greedy token bucket: This algorithm allows users to accumulate unused tokens and build up a bigger bucket. Users who do not fully utilize their quota use more tokens (i.e., requests) in the future.
• Leaky bucket: Each time someone makes a request, the system adds a token to the user's bucket. If the bucket is full (i.e., users reach the set limit), the system drops all further requests. The leaky bucket is easy to implement on a load balancer and is highly memory-efficient.
• Fixed window: This algorithm limits the number of requests users can make within a fixed time window (typically either a minute or an hour). For example, the server may only serve 100 requests between 11:00 and 11:01 AM. At 11:01 am, the window resets.
• Rolling window: Instead of using a fixed time window like the previous algorithm, this method relies on a rolling window. The time frame only starts when a user makes a new request. For example, if the first request arrives exactly at 10:15:48 and the rate limit sits at 20 per minute, the server will allow 19 more requests until 10:16:48.
• Sliding log: This algorithm requires the system to maintain a time-stamped log (set or table) of requests for every individual user. The system calculates the sum of logs to determine the request rate. If the rate exceeds the threshold rate, the system holds the request; otherwise, the system serves the request.

How To Implement Rate Limiting?

Below is a step-by-step guide to implementing rate limiting (although the exact way you set limits depends on your specific tech stack):

• Determine rate limit rules: Decide the specific rate limit you'll use. Determine the type of rate limit (time-based, request-based, etc.), the limit itself (i.e., the number of allowed requests), and the duration of the limit.
• Choose a rate limiting algorithm: Choose an algorithm that best fits your requirements. In general, the token bucket is suitable for most user-based rate limits. Likewise, the fixed window is excellent for time-based rate limits.
• Decide where to implement the rate limit: Decide whether the team should implement rate limiting on the server or client side (or both).
• Implement the rate limit: Next, deploy the chosen rate limiting algorithm. This process usually involves a public module that provides rate limiting functionality, although your team might have to write some custom code.
• Test the rate limit: Once set up, the rate limiting mechanism requires extensive testing. Use a mix of manual and automated testing to simulate different traffic conditions. Test the system periodically and adjust the rules as needed to keep performance levels up.

Implementing rate limiting is a simple process for most use cases. For example, if you're using Nginx as a web server and wish to set a rate limit at the server level, you'll use the ngx_http_limit_req_module module. Simply add the following code to the Nginx configuration file to set up rate limits based on the user's IP address:

http {
    limit_req_zone $binary_remote_addr zone=one:10m rate=2r/s;
    ...

server {
    ...
    location /promotion/ {
        limit_req zone=one burst=5;
    }
}

The code above allows no more than 2 requests per second on average, while bursts cannot exceed 5 requests.

A Simple, Yet Highly Effective Defensive Practice

Rate limiting is essential both for the security and quality of your APIs, apps, and websites. Failing to limit the number of requests leaves you open to traffic-based attacks and leads to poor performance (which causes higher bounce rates, problems with customer retention, etc.). Considering how easy it is to implement this precaution, setting a rate limit is a no-brainer decision for most use cases.

Every endpoint (PC, laptop, smartphone, etc.) that connects to a network is a potential entry point for a hacker. These devices are typically the first attack vector criminals test when trying to hack into a system. If an endpoint turns out to be vulnerable, the intruder breaks into an otherwise secure network without having to "crack" its primary cyber defenses.

This article is an intro to endpoint security that explains how companies protect what many describe as the weakest link in network security. Read on to learn what it takes to keep would-be hackers out of endpoints and ensure these devices do not become a doorway to your assets and data.

What is Endpoint Security?

Endpoint security (or endpoint protection) is the practice of keeping endpoint devices safe from external and insider threats. The primary goals of endpoint security are to:

• Prevent unauthorized access to assets.
• Detect suspicious user behavior.
• Stop in-progress attacks.
• Detect and isolate threats before they do damage to the network.
• Help the team identify and mitigate the root cause(s) of threats.

Any device or system that communicates with the network from outside its firewall is an endpoint. Nowadays, this definition extends far beyond the PCs we use for work — here's a list of all the endpoints modern organizations must secure and account for:

• Laptops.
• Tablets.
• Desktop computers.
• Mobile phones.
• Internet of Things (IoT) gadgets and sensors (thermostats, biometric scanning devices, security cameras, etc.).
• Wearables (i.e., smart watches or medical devices).
• Smart printers.
• Servers (both on and off-site).
• POS devices.
• Industrial machines.
• Network hardware (routers, switches, etc.).
• Virtual machines.
• Operational Technology (OT) systems.

The number of internet-enabled devices is at an all-time high, so companies have their hands full when preparing for attacks. Here are some of the most common endpoint security risks a team is likely to face:

• Lost or stolen devices.
• Phishing attacks (a social engineering strategy that tries to trick the user into sharing sensitive data (such as a password) or clicking on a malware-infected link).
• Ransomware (a type of malware that encrypts the victim's data and asks for money in exchange for the decryption key).
• An endpoint becoming a part of a DDoS bot.
• Malvertising (infected ads that install malware if the user clicks on them).
• Drive-by downloads (hidden software downloads that occur without the user's knowledge).
• Spyware (malware that tracks user activity).
• Installation of unsafe applications.

Why is Endpoint Security Important?

Any device with access to a network is a potential target for an attack, but some devices are easier to hack than others. For example, a personal phone connected to the office Wi-Fi is significantly less challenging to crack than the main server. While there's less to gain from hacking an endpoint, the phone is still a worthwhile objective as it likely has access to some business data.

Sometimes, going after data accessible to a specific endpoint is not the primary goal of an attack. More skilled hackers know how to compromise an endpoint and then use the device for lateral movement to reach valuable databases or set up an APT threat.

A recent study reveals that almost 70% of successful data breaches originate at an endpoint device. Here are a few other figures that show the criticality of keeping endpoints safe:

• In 2022, almost 68% of organizations have experienced at least one endpoint attack that impacted data or IT infrastructure.
• Over 48% of organizations are unsatisfied with their current level of endpoint security.
• An average organization allows 55% of all endpoints to access some sensitive data.
• One in three U.S. employees uses a personal, non-BYOD device to work remotely.
• The cost of a successful endpoint attack in the US now sits at $8.94 million (this figure was $7.1 million in 2021).

Security concerns aside, high levels of endpoint protection are often a prerequisite for meeting compliance. Many industries and regions require a business to keep endpoints safe to comply with regulations (especially if devices have access to sensitive user data).

What Are the Types of Endpoint Security?

There are three main types of endpoint security: Endpoint Protection Platforms (EPP), Endpoint Detection and Response (EDR), and Extended Detection and Response (XDR).

Endpoint Protection Platform (EPP)

EPPs primarily focus on preventing malware and are comparable to what you'd expect from a reactive antivirus program. These platforms help deal with threats by:

• Comparing files against a database of known attack signatures.
• Using machine learning to detect suspicious activity on an endpoint.
• Enabling the creation of lists that block or allow certain apps, URLs, ports, IP addresses, etc.
• Providing sandboxes to test suspicious executables.

Admins deploy an EPP directly on endpoints, but there's always a central platform that analyzes data (either on-prem or in the cloud).

Endpoint Detection and Response (EDR)

An EDR offers the same features as EPPs but also has the capability to respond to active threats in real-time. These platforms enable an admin to:

• Set up automatic remediation processes (e.g., isolate a dangerous file or wipe the endpoint's memory if something goes wrong).
• Identify indicators of compromise (IoC).
• Get real-time alerts on security incidents.

EDRs detect various threats that are invisible to an EPP, such as file-less malware or polymorphic attacks.

Extended Detection and Response (XDR)

An XDR platform offers better protection and deeper risk analysis than an EDR. XDRs provide more visibility and rely heavily on automation to correlate and eliminate threats.

An XDR tool crosses multiple security layers (endpoints, network traffic, etc.) and consolidates data from:

• Security information and event management (SIEM) tools.
• EPPs and EDRs.
• Network analytics.
• Identity and access management (IAM) tools.

The main goals of XDR is to reduce incident response times, enable more context during threat inspection, and provide in-depth analysis of affected endpoints to identify the root cause of the threat.

How Does Endpoint Protection Work?

Endpoint security relies on a client/server model. There's a centrally managed server that hosts the primary security program (which analyzes threats and makes decisions) and an accompanying client program on each endpoint (which collects data and sends info to the main server).

There are three different strategies based on where you host the primary security program:

• On-premises deployment: In this strategy, the client software runs in an on-site server room.
• Software-as-a-service (SaaS) model: In the SaaS model, a cloud provider hosts and manages the client software.
• Hybrid model: A hybrid approach mixes both on-prem and cloud solutions.

No matter where you run the primary endpoint security software, the protection principles stay the same. Programs on endpoints gather data and send it to the central platform which checks the files, processes, and systems for suspicious activity. Platforms primarily detect oddities in two ways:

• Checking data packets against a database of known attack signatures (excellent at detecting known threats).
• Performing behavioral analysis to uncover potentially suspicious activity of users or systems (excellent at identifying new hacking tactics and even some zero-day exploits).

If the platform discovers a threat, it instructs the endpoint to block traffic and isolate the file from the network. Then the security team investigates the threat (or the platform performs a series of predefined mitigation steps). The endpoint does not connect back to the network until the team eliminates the risk.

What's the Difference Between Antivirus and Endpoint Security?

An antivirus is a type of cybersecurity software that detects and isolates malicious files (malware, viruses, worms, Trojans, etc.). Endpoint security, on the other hand, is a broader term that encompasses a wider range of measures for protecting endpoints and their associated networks from threats (including malicious software).

Antivirus programs are a subset of endpoint security. No endpoint security strategy is complete without an antivirus (firewalls are the other bare-bones necessity). Even the most basic EPP will have some form of antivirus protection.

Here are the most notable differences between antivirus and endpoint security:

• Scope: Antivirus software protects one device, whereas endpoint security aims to protect all connected devices across an enterprise network.
• Go-to threats: Antivirus programs only stop malware-based attacks, while endpoint security entails protection from a broader set of dangers (data theft, CEO fraud, SQL injections, etc.).
• Protection strategy: An antivirus protects a device by comparing traffic against a database of known threats. Endpoint security platforms also rely on a similar database, but these tools also check for advanced vulnerabilities based on behavioral analysis.
• Updates: Most traditional antiviruses require manual updates. Modern EPPs and EDRs running in the cloud update automatically, taking the burden off the security team and end-users.
• Protection against insider threats: Antiviruses typically offer little to no protection against insider threats (e.g., someone putting sensitive data on a USB drive and stealing valuable files). Endpoint security offers far greater protection from threats like intentional file deletion, unauthorized access, and data leakage.

Features to Look for in an Endpoint Security Tool

Here is a list of features you should expect to get from a top-tier endpoint security tool:

• An antivirus program that detects and removes threats from endpoint devices.
• A firewall that filters outgoing and incoming traffic on endpoints.
• Intrusion Prevention Systems (IPS) that monitor network traffic for signs of malicious activity and block threats before they do any damage. An IPS is a more advanced version of an Intrusion Detection System (IDS).
• Capability to detect suspicious behavior of users, apps, and network services.
• Automated incident response plans.
• End-to-end data encryption (at rest, in transit, and in use).
• App controls that enable you to create "allowlists" and "blocklists," ensuring users install only approved software on endpoints.
• Mobile device management (MDM) features for managing and securing mobile devices.
• Internet-of-Things security that ensures IoT devices and sensors are free of exploits.
• Continuous monitoring capabilities that ensure you're safe around-the-clock.
• Device controls that enable you to control which devices can upload or download data.
• Data loss protection features that prevent intentional or unintentional data deletion.
• Protection from threats that spread via email (anti-malware scans for attachments and phishing detection).
• Browser protection that bans certain websites and stops drive-by downloads.
• Anti-exfiltration capabilities that block files transmitted via email, collaboration tools, or the Internet.
• Real-time reporting and alerting that provide prioritized warnings regarding threats.
• Sandboxing features that enable endpoints to test suspicious executables in an isolated environment without access to any sensitive network areas.
• Rollbacks to a previous device state (one of the key practices in ransomware prevention).
• Threat forensics that help identify the scope and root cause of dangers.

Despite Advances, Endpoints Are Still a Go-To Target for Attacks

Modern endpoint security has come a long way from old-school antiviruses and firewalls. Nowadays, platforms provide a far broader set of defenses to counter both known and unknown threats. Despite these advancements, however, endpoints continue to be an enticing target for attacks, so ensure hackers cannot use these devices as an easy-to-crack door into your network.