Endpoint security for research groups and small institutions

In summary

• Antivirus blocks known-bad files. EDR records endpoint behaviour so you can detect, investigate and reverse an attack that got past the block.
• NSPM-33 and CMMC-style expectations increasingly assume endpoint monitoring and incident response capability, not just anti-malware.
• Independent test results from AV-Comparatives and AV-TEST are the only vendor-neutral evidence worth weighting. Read them directly.
• Bitdefender GravityZone licenses per device annually across tiers from Small Business Security upward; get a quote against your real device count.
• The lab-specific problem is instrument PCs running unsupported operating systems that cannot be patched — plan for network isolation, not for an agent.

What each layer actually does

Use this to work out which tier your risk profile needs

Dimension	Anti-malware	Endpoint protection (EPP)	EDR	Managed detection (MDR)
Core function	Blocks known malicious files	Adds firewall, web/device control, exploit and ransomware mitigation	Records endpoint behaviour; enables detection, investigation and rollback	EDR plus a vendor security team watching it for you
Catches novel attacks	Poorly	Better	Yes, by behaviour	Yes, with human triage
Answers “what did the attacker touch?”	No	Barely	Yes — this is the point of it	Yes
Staff needed	Almost none	Part-time admin	Someone who will actually read alerts	The vendor supplies it
Right for	Nothing sensitive, low risk	Most research groups as a baseline	Controlled data, human-subjects data, federal cybersecurity expectations	Real requirement, genuinely no internal capacity

The honest failure mode: buying EDR and having nobody read the alerts. An unmonitored EDR deployment provides forensic data after an incident but very little prevention — if you cannot staff it, MDR is the more useful spend.

Why research security landed on your desk

Universities have always been attractive targets — valuable intellectual property, large amounts of personal data, and a culture of openness that is a genuine strength and a genuine attack surface. What has changed is that funders and governments now attach explicit expectations to it.

In the United States, NSPM-33 and its implementation guidance require institutions receiving significant federal research funding to maintain research security programmes, with cybersecurity as one of the named elements. Separately, CMMC applies to organisations handling controlled unclassified information under Department of Defense contracts, with formal assessment attached — and search interest in CMMC compliance tooling was up 86% year on year at the time of writing, which is a fair proxy for how quickly this is arriving on people’s desks. Institutions handling export-controlled research face requirements under ITAR and the EAR, where a foreign national accessing controlled technical data can constitute a deemed export regardless of where they are sitting. Human-subjects data brings HIPAA in the US and GDPR in Europe and the UK.

The practical difficulty is structural. These expectations assume an organisation with a security function. A research institute with forty staff, or a department within a larger university that runs some of its own infrastructure, frequently has neither the budget nor the headcount — and often does not know which category its data falls into until someone asks.

Start there: find out what you actually hold. Controlled unclassified information, export-controlled technical data, identifiable human-subjects data and commercially confidential partner data each carry different obligations. Groups routinely discover they are holding one of these because of a clause in a contract nobody read closely. That inventory, not a product, is the first deliverable.

What EDR adds over antivirus

Traditional antivirus works by recognition — it compares files against signatures of known malware and blocks matches. It is fast, cheap and genuinely effective against commodity threats, and it fails against anything novel, targeted, or built out of legitimate tools.

That last case is the one that matters. A modern intrusion frequently uses no malicious file at all: stolen credentials to log in, then PowerShell, remote administration tools and built-in utilities to move around. Every individual action looks legitimate, because every individual tool is legitimate. Signature matching has nothing to match.

Endpoint detection and response takes a different approach: it continuously records what happens on the endpoint — process launches, network connections, file changes, registry activity — and looks for patterns that indicate an attack in progress. It also keeps that history, which is what lets you answer the questions that actually matter after an incident. Which machine was first? What did the attacker access? Did they reach the machine holding the participant data? Which accounts were used? Without EDR the honest answer to all of those is usually “we don’t know”, and “we don’t know” is the answer that turns a contained incident into a full breach notification.

For a research institution that is the decisive argument. Your obligations after a suspected compromise — to a funder, an ethics committee, a data protection authority, a commercial partner — depend on being able to determine what was accessed. EDR is the thing that makes that determinable.

Instrument PCs are the real problem

Every guide to endpoint security assumes a fleet of laptops. Research environments have something much worse, and it is worth planning for explicitly because no product solves it.

The mass spectrometer’s control PC runs an operating system that went out of support years ago. The vendor’s software is validated against that exact configuration and will not be recertified. Patching it may void the service contract; upgrading it may cost more than the machine is worth; and the instrument itself has another decade of useful life. The same is true of the confocal microscope, the sequencer, the NMR console and the environmental chamber controller — and collectively they represent millions in capital equipment that cannot be treated like an office PC.

Installing a modern security agent on these is often impossible and sometimes actively harmful — real-time scanning can interfere with time-sensitive acquisition. The workable answer is architectural rather than software:

• Network isolation. Put instrument controllers on a separate VLAN with tightly restricted egress. This is the single highest-value control available, and it does not require touching the instrument.
• Move the data off, don’t work on the box. A one-way transfer to a properly protected analysis machine, rather than analysis on the controller.
• Control removable media. USB sticks moving between instruments and personal laptops are the classic infection path in a lab.
• Document the exception. An unpatched controller that is isolated, documented and risk-assessed is a defensible position in an audit. The same machine undocumented is a finding.
• Put it in the procurement spec. When buying new instruments, ask about OS support lifetime and patching policy before purchase. This is the only point at which you have leverage.

Independent test results are the only real evidence

Every vendor in this category claims outstanding detection rates, and their own benchmarks are worthless for comparison. Two independent organisations do the work properly: AV-Comparatives and AV-TEST. Both test business endpoint products against real-world threat sets and publish methodology alongside results.

Bitdefender has been a consistently strong performer in both over an extended period, which is the substantive reason to shortlist it rather than any feature claim. Read the current reports directly rather than trusting any vendor’s summary of them — including ours — because results move between rounds and a vendor will always quote its best year.

Two things to weight beyond raw detection. False positives matter enormously in research computing: a product that quarantines a researcher’s analysis binary or a compiled simulation will be uninstalled within the week, and an uninstalled product detects nothing. Both test houses publish false-positive rates; read that column. And performance impact matters where machines run long computational jobs — check the performance test, not just the protection test.

What to do before buying anything

Endpoint security is not the first control, and buying it first is a common way to spend a budget without reducing risk. In rough order of value per pound:

1. Multi-factor authentication everywhere, especially email and remote access. Credential compromise remains the most common initial access route by a wide margin, and MFA is the single most effective control available.
2. Tested backups, offline or immutable. Ransomware’s leverage is entirely dependent on your backups being reachable. A backup nobody has restored from is a hypothesis, not a backup — test the restore.
3. Patching for everything that can be patched. Isolate what cannot, as above.
4. Remove local administrator rights where the work allows it. In research it often does not, which makes the other controls more important rather than less.
5. Know what data you hold and where. You cannot protect what you have not inventoried, and this is the deliverable a research security review will ask for.
6. Then endpoint protection, and EDR where the data classification or a contractual requirement calls for it.

Get a quote against your real device count

Per-device annual licensing means the only meaningful number is your actual endpoint inventory — including instrument controllers you may decide to isolate rather than protect. Count first, then price.

Per-device annual licensing — see current offer

See GravityZone pricing Opens on the vendor’s site · CASRAI referral link

Frequently asked questions

What is endpoint detection and response (EDR)?

Software that continuously records endpoint activity — process launches, network connections, file and registry changes — and analyses it for attack patterns, rather than only matching files against known-malware signatures. It also retains that history, which is what lets you determine after an incident which machines and data an attacker actually reached.

What is the difference between EDR and antivirus?

Antivirus blocks files it recognises as malicious. EDR watches behaviour, so it can catch attacks that use no malicious file at all — stolen credentials plus legitimate administration tools, which is how a large share of modern intrusions work. EDR also provides the forensic record antivirus does not.

Does NSPM-33 require EDR specifically?

It does not name a product category. NSPM-33 and its implementation guidance require covered institutions to maintain research security programmes with cybersecurity as a named element, and the practical expectation is monitoring and incident-response capability rather than anti-malware alone. Your specific obligations depend on your funding and the data you hold — determine that classification before selecting tools.

How do we secure lab instrument computers running unsupported operating systems?

Generally not with an agent — installing one is often impossible and can interfere with time-sensitive acquisition. Use network isolation on a separate VLAN with restricted egress, move data off to a protected analysis machine rather than working on the controller, control removable media, and formally document the exception with a risk assessment. Ask about OS support lifetime when procuring new instruments.

Which is the best business antivirus?

Judge it on the independent AV-Comparatives and AV-TEST results rather than vendor claims, and read the false-positive and performance columns alongside detection. Bitdefender has been a consistently strong performer in both over an extended period, which is why we shortlist GravityZone — but read the current reports directly, because results move between rounds.

We have no security staff. Should we still buy EDR?

Only if someone will actually read the alerts. An unmonitored EDR deployment gives you forensic data after an incident but very little prevention. If you have a genuine requirement and no capacity, managed detection and response — where the vendor supplies the analysts — is the more useful spend, even though it costs more.

What should we do before buying endpoint security?

Multi-factor authentication on email and remote access, tested offline or immutable backups, patching for everything patchable, removal of local admin rights where the work allows, and an inventory of what sensitive data you hold and where. Those reduce risk more per pound than any endpoint product, and a research security review will ask for the inventory regardless.

Related on CASRAI

• EDR vs antivirus — which do you need?
• Bitdefender GravityZone reviewed
• Research integrity & compliance — full topic hub
• All research tools reviewed by CASRAI