Endpoint Security for Remote SaaS Teams

With no office network, the laptop is the perimeter. Customer data lives in the cloud, but the keys to it (SSO sessions, API tokens, SSH keys, cookies) live on employee devices.

The Verizon 2025 Data Breach Investigations Report makes this concrete. Among compromised systems in the dataset whose infostealer logs contained corporate logins, 46% were non-managed devices. Nearly half came from machines the company did not manage. The same report found ransomware present in 44% of breaches reviewed, and in 88% of breaches at smaller organizations in the dataset.

The DBIR also shows how slowly fixes land. Exploitation of vulnerabilities reached 20% of initial access, and for edge devices and VPNs the median time to fully remediate was 32 days, with only about 54% fully remediated across the year. For laptops too, patching that depends on someone remembering does not happen on time.

Neither framework names a product. Both ask you to prove a control exists, works and covered the whole period. For SOC 2, endpoint evidence usually maps to the logical access and malicious software criteria in the Trust Services Criteria. For ISO/IEC 27001:2022, Annex A includes controls for user endpoint devices, protection against malware and management of technical vulnerabilities.

In practice, across our SOC 2 and ISO readiness assessments, auditors request the same evidence set:

Notice what is missing: a brand name. If you are preparing for SOC 2 or ISO 27001, the auditor cares about coverage and evidence across the period, not which vendor's logo is on the console.

Here is how I rank endpoint controls for a 30 to 200 person remote SaaS company. Vendors will dispute this order. It reflects what closes audit findings and real attack paths at this size.

Antivirus alone is not a control auditors accept. Antivirus on unmanaged laptops tells an auditor nothing about coverage or response. It is a tool, not a control. The control is "malware protection is deployed on every in-scope device, centrally reported and reviewed," and you need the inventory and MDM in rows 1 and 2 to prove it.

The CIS Critical Security Controls back this ordering. Implementation Group 1, which CIS describes as essential cyber hygiene, contains 56 Safeguards, and it opens with Control 1 (enterprise asset inventory) and Control 2 (software inventory) before secure configuration in Control 4 and malware defenses in Control 10. Detection comes after knowing what you own. Safeguard 7.3 also asks for automated OS patch management monthly or more often.

Canadian teams have a parallel reference. The Canadian Centre for Cyber Security's Baseline Cyber Security Controls for Small and Medium Organizations, written for organizations with fewer than 499 employees, includes automatic patching, anti-malware that updates and scans automatically, secure device configuration, encrypted storage of sensitive data on mobile devices, and restricting administrator privileges. If you want to see where you stand against IG1 before an auditor does, our CIS gap assessment maps each Safeguard to evidence you can show.

Remote teams always have personal phones in the mix. You have three honest options:

NIST SP 800-124 Rev. 2 covers organization-provided and personally owned mobile devices across the lifecycle; use it when you write the policy. The common mistake is having no written rule, then discovering mid-audit that a contractor's personal laptop held production SSH keys. For more on securing the phone side, see our post on secure mobile communications.

This is the newest endpoint risk, and most policies predate it. Your team is installing AI coding assistants, desktop AI apps, meeting recorders and browser extensions that read page content. Some can see source code, customer records in your admin panel, and anything pasted into a prompt.

The 2025 DBIR found that roughly one in seven employees in its data routinely accessed generative AI on corporate devices, and 72% of those users signed in with non-corporate email addresses. That is shadow AI on your managed hardware, outside your SSO and contracts.

Practical controls that fit a small team:

A full detection stack (EDR plus XDR correlation plus a 24/7 managed detection and response contract) is more than many teams under 100 people need on day one. You may not need it yet if:

Then spend on identity hardening, SaaS configuration and an incident response plan that names who does what. Buy managed detection when you have enterprise customers contractually requiring it, sensitive regulated data on endpoints, or a team too small to watch an EDR console.

One more case: if an MSP already manages your devices, do not duplicate their stack. Compare their coverage report with the table above and close specific gaps. The right order is inventory, hygiene, then detection. Buying detection first is how companies end up with expensive dashboards and the same unpatched machines.

This sequence is the core of how we run endpoint workstreams inside our virtual CISO services. At this size it usually fits our Crawling or Walking tiers; see our pricing.

Not on its own. Auditors expect evidence that malware protection is deployed on every in-scope device, centrally managed and reviewed. Unmanaged antivirus with no reporting usually leads to an exception.

Yes. MDM is how you prove encryption, patching and screen lock across the audit period. Without it, you are collecting screenshots from each employee.

EDR detects and responds to threats on endpoints. XDR correlates signals across endpoints, identity, email and cloud. MDR is an outside team that watches and responds for you. Small teams need EDR plus a clear owner first.

The CIS Controls call for automated OS and application patching monthly or more often. Most SOC 2 programs we see set critical patches at 14 days or less. Pick an SLA you can actually meet, then prove it.

If you want a second set of eyes on your endpoint posture before an auditor or a customer questionnaire finds the gaps, book a consultation and we will start with your device inventory.