When we retired our Forrester Wave™ evaluation on endpoint security after 2023, it looked like endpoint security had fully matured. The progression seemed obvious: Antivirus evolved into antimalware or “next-gen antivirus.” Antimalware evolved into endpoint detection and response, which then expanded into extended detection and response. Each step improved visibility, prevention, detection, and response capabilities across the enterprise.

Many security leaders assumed that endpoint security was a solved problem, but I think we were looking at the wrong problem. The issue wasn’t that endpoint security had matured but that the definition of the endpoint was changing underneath us.

For decades, endpoint security largely meant securing desktops and laptops, but today, that view is incomplete. Employees work across laptops, smartphones, tablets, and browsers while they interact with locally installed apps, SaaS applications, and an expanding set of AI-driven tools. Increasingly, many employees spend most of their working day inside a browser, not a traditional desktop environment.

That’s why one of the biggest themes emerging from our endpoint security research is that organizations must stop thinking about endpoints as individual devices and start thinking about them as interconnected workspaces. The laptop matters. The phone matters. The browser matters. Security gaps across any of these environments create opportunities for attackers. At the same time, organizations are giving users even more autonomy.

This isn’t necessarily a bad thing. Employees need flexibility to do their jobs efficiently. They want access to nonstandard applications, browser extensions, collaboration tools, and increasingly AI-driven capabilities that help them work faster or even build their own apps. But users generally optimize their workflow for productivity, not security. This isn’t a knock on your average user (they just want to get their job done), but that’s simply reality: Employees don’t analyze every website they access, every email they get, or every app they download. They expect endpoint security programs, firewalls, and messaging filters to keep them safe but forget that even security tooling makes mistakes and misses things. As organizations expand user freedom, they also expand the number of decisions, configurations, and behaviors that security teams must account for.

Then there’s the 800-pound gorilla in the room that is AI. Security leaders are currently focused on the risks associated with generative AI and autonomous agents, even if their peers on the business side are focused more on AI’s productivity and innovation benefits. What makes AI particularly interesting from an endpoint security perspective is where it’s showing up. AI capabilities are appearing on laptops (through the OS, in local apps, and agentic workflows), within browsers (as AI-enabled browsers or inside SaaS applications), and on mobile devices (in the OS, in the apps, and in the browsers). In many cases, multiple AI-enabled workflows are interacting across those environments simultaneously. The result is a dramatically larger attack surface than many organizations realize.

Attackers aren’t just limiting themselves to large enterprises. The question is no longer whether your organization is famous enough to be targeted. The question is whether you’re exposed enough to be compromised. That’s why I believe endpoint security is entering its next chapter, not because defensive technologies have failed — quite the opposite. Endpoint security has become more effective than ever, but the environments we need to secure have expanded beyond the device-centric models many organizations still use today.

In The Top 10 Trends Shaping Endpoint Security In 2026, we explore the forces driving this shift and the trends that security leaders should be tracking now. I won’t spoil all 10 trends here, but one thing became clear during the research: Organizations that continue treating endpoint security as a desktop-and-laptop problem are only defending part of today’s workspace. If you expect all your security problems to disappear because you installed one piece of software, you’re going to have a real bad day.

Forrester clients can access the full report to examine all 10 trends and their implications for endpoint security strategy. If you’d like to discuss how these trends apply to your environment, schedule an inquiry or guidance session. I’d be happy to continue the conversation.

Share