Published: April 21, 2026
Most Dutch SMEs have a firewall. Many have a VPN. A growing number have switched to cloud-hosted software and off-site backups. These are good choices — but they leave a gap that most businesses do not talk about until after it costs them money.
That gap is the endpoint: the laptops, desktops, and phones your employees use every day.
The Threat Has Moved to the Device
A decade ago, the dominant model of IT security was perimeter-based. You defended the office network and assumed that anything inside the perimeter was trusted. That model is now obsolete.
Your employees work from home, from client sites, from hotels, and from coffee shops. They use personal devices. They click links in email. They download files from suppliers and partners. Each of these actions creates an opportunity for an attacker — and none of them are stopped by a network firewall.
Modern ransomware does not knock on the front door. It arrives in a phishing email, runs silently on a single laptop, and spends days or weeks mapping your network before it does anything visible. By the time you notice, the attacker may already have access to your file server, your accounting software, and your email.
What Traditional Antivirus Does Not Catch
The antivirus solution that came bundled with your laptops or your Microsoft 365 subscription is better than nothing. It is not good enough.
Traditional antivirus works by recognising known malware — matching files against a database of threats that have already been seen and catalogued. This approach has two fundamental weaknesses:
- Zero-day attacks — threats that have not yet been catalogued are invisible to signature-based detection
- Fileless malware — attacks that run entirely in memory, never writing a suspicious file to disk, bypass file-scanning entirely
Modern endpoint protection (often called EDR — Endpoint Detection and Response) takes a different approach. Instead of looking for known bad files, it monitors behaviour. It asks: is this process doing something that processes do not normally do? Is memory being read in a suspicious pattern? Is a script trying to disable logging?
This behavioural approach catches threats that traditional antivirus misses, and it catches them before they can spread.
How an Attack Progresses
%%{init: {'flowchart': {'curve': 'basis', 'nodeSpacing': 60, 'rankSpacing': 60}}}%%
flowchart LR
A([Phishing email]):::entry --> B[Endpoint compromised]:::bad
B --> C[Silent recon]:::bad
C --> D[Lateral movement]:::bad
D --> E([Ransomware detonates]):::danger
EDR([EDR detects here]):::good -. behavioural alert .-> C
AV([AV detects here]):::miss -. too late .-> E
linkStyle 0,1,2,3 stroke:#ef4444,stroke-width:2px
linkStyle 4 stroke:#22c55e,stroke-width:2px
linkStyle 5 stroke:#78716c,stroke-width:1.5px,stroke-dasharray:4 3
classDef entry fill:#374151,stroke:#9ca3af,color:#f9fafb
classDef bad fill:#7f1d1d,stroke:#ef4444,color:#fef2f2
classDef danger fill:#450a0a,stroke:#dc2626,color:#fee2e2
classDef miss fill:#1c1917,stroke:#78716c,color:#a8a29e
classDef good fill:#14532d,stroke:#22c55e,color:#f0fdf4
The Three Risks Most SMEs Are Taking Right Now
1. Unmanaged personal devices
When an employee connects a personal laptop to your business systems — even via a web browser — that device becomes part of your attack surface. You have no visibility into whether it is patched, whether it has been compromised, or whether it is running software you would not allow on a company device.
The fix is not to ban personal devices (that battle is usually lost). The fix is to ensure that access to sensitive systems requires a device that meets a minimum security standard — a practice called device compliance checking.
2. Software that nobody updates
Ransomware operators actively scan for outdated software. Vulnerabilities in common tools — PDF readers, browsers, collaboration software — are patched by vendors within days of discovery. But patches only protect you if they are applied.
In an SME without a managed IT function, patching often happens when someone notices the update notification and has a spare moment. That means weeks of exposure for every critical vulnerability. Managed endpoint protection solves this by automating patch deployment and alerting when devices fall behind.
3. No visibility until something breaks
If a laptop on your network was compromised six months ago and has been quietly exfiltrating data ever since, would you know? In most SMEs, the honest answer is no.
Endpoint security with centralised monitoring gives you a timeline: what ran on which device, when, and what it touched. This is not just useful for responding to incidents — it is essential for understanding whether you had an incident at all.
What Good Endpoint Security Looks Like
For a business of 10–200 employees, effective endpoint protection typically means:
- EDR on every managed device — behavioural monitoring, not just signature scanning
- Automated patch management — operating system and third-party software updates applied on a defined schedule
- Device compliance enforcement — access to business systems requires a verified, compliant device
- Centralised alerts and monitoring — someone receives and responds to security events, not just the device owner
- Incident response capability — when something suspicious is flagged, there is a defined process for investigating and containing it
This is not a luxury reserved for large enterprises. The tooling exists, the cost is predictable, and the risk of not having it — regulatory fines, recovery costs, reputational damage, and operational downtime — is far higher for a small business than for a large one, precisely because small businesses have less capacity to absorb the impact.
A Practical Starting Point
If you are running a Dutch SME and you are not sure where your endpoint security posture stands, the most useful first step is an honest inventory:
- How many devices connect to your business systems? Include personal phones and laptops.
- Are they all patched to the current OS version?
- Do you have centralised visibility into what is running on them?
- Who receives the alert if one of them is compromised at 2 AM on a Sunday?
If any of those questions do not have a clear answer, that is where to start.
Endpoint security is not the most exciting part of running a business. But it is one of the few areas where the cost of getting it wrong is high enough, and predictable enough, to warrant treating it seriously before you need to.
Logicos provides managed endpoint protection for Dutch SMEs. If you would like to discuss your current setup, request a free consult.