Laptops and workstations hold the passwords, session tokens and keys that attackers need, and many endpoint compromises start with a gap the organisation could have closed. Unpatched software, standing admin rights, saved browser passwords and unapproved remote access tools turn one phishing click into a domain-wide incident. This list ranks ten endpoint risks by our judgement of likelihood and impact, with why each matters, an incident where one fits, and the first fix. It is for endpoint, security operations and IT teams who already run EDR and device management.
The Top 10 at a glance
- Unpatched operating systems and applications
- Standing local administrator rights
- Credential theft from memory and browsers
- No application control
- EDR coverage gaps and tampering
- Unapproved and insecure remote access tools
- Malicious and over-privileged browser extensions
- Developer machines full of secrets
- Unmanaged and personal devices
- Removable media and peripherals
| # | Risk | How attackers use it | First fix |
|---|---|---|---|
| 1 | Unpatched OS and applications | Exploit known flaws in third-party software | Automated patching with deadlines tied to exploitation |
| 2 | Standing local admin rights | Disable defences, dump credentials, reuse shared admin passwords | Remove admin rights; Windows LAPS for the built-in account |
| 3 | Credential theft from memory and browsers | Dump LSASS, harvest saved passwords and cookies | Credential Guard, LSA protection, no browser password storage |
| 4 | No application control | Run portable tools and scripts from user folders | Allowlisting in audit, then enforce |
| 5 | EDR gaps and tampering | Use devices with no agent, or stop the agent | Coverage reconciliation, tamper protection |
| 6 | Unapproved remote access tools | Legitimate RMM software for persistent access | One approved tool; block the rest |
| 7 | Browser extensions | Malicious or hijacked extensions read sessions and data | Extension allowlist by policy |
| 8 | Developer machines with secrets | Steal cloud keys, publishing tokens and SSH keys | Short-lived credentials, secret scanning on endpoints |
| 9 | Unmanaged and personal devices | Infostealers capture corporate logins | Device compliance in access policy; app protection |
| 10 | Removable media and peripherals | USB malware, data loss, rogue devices | Device control, AutoPlay off |
1. Unpatched operating systems and applications
The risk: OS updates are automated, but browsers, PDF readers, media players, runtimes and line-of-business software lag for weeks or never update.
Why it matters: a known flaw is the cheapest way in, and third-party software is where patch programmes are weakest. In the LastPass breach, LastPass says the attacker "targeted a senior DevOps engineer by exploiting vulnerable third-party software", then used it to "deliver malware, bypass existing controls" and reach cloud backups.
The fix: automate OS and application patching (CIS Control 7), set deadlines by exploitation status rather than CVSS alone, remove unneeded software, and report coverage by device. See the Patch Management Guide and the Zero-Day and Exploited Vulnerabilities Guide.
2. Standing local administrator rights
The risk: users run as local administrators so they can install software, and the built-in administrator account shares one password across the estate.
Why it matters: admin rights let malware disable protection, install drivers and read credential stores, and a shared local admin password lets one compromised laptop unlock the rest. Microsoft lists "protection against pass-the-hash and lateral-traversal attacks" as a core benefit of Windows LAPS.
The fix: remove standing admin rights and use endpoint privilege management to elevate approved applications. Deploy Windows LAPS, built into supported Windows at no cost, which backs up a unique, rotated password per device to Entra ID or Active Directory (legacy Microsoft LAPS is deprecated from Windows 11 23H2). Keep IT administration in separate admin accounts (CIS Safeguard 5.4). See the Endpoint Privilege Management Guide.
3. Credential theft from memory and browsers
The risk: credentials sit in LSASS memory, in browser password stores and as session cookies, where malware running as the user or as admin can collect them (ATT&CK T1003.001 LSASS Memory, T1555.003 Credentials from Web Browsers).
Why it matters: stolen credentials are reused far from the endpoint. A synced browser password opened the Cisco breach, and infostealer credentials without MFA unlocked customer accounts in the Snowflake breach.
The fix: keep Credential Guard on; it protects "NTLM password hashes, Kerberos Ticket Granting Tickets (TGTs), and credentials stored by applications as domain credentials" and is on by default for qualifying domain-joined Windows 11 22H2+ devices, though not for the SAM. Enable LSA protection and the ASR rule "Block credential stealing from the Windows local security authority subsystem" (audit first). Disable browser password saving by policy (Chrome: PasswordManagerEnabled) in favour of an enterprise password manager, and shorten sessions for sensitive apps. See the Credential Dumping Guide and the Infostealer Threat Guide.
4. No application control
The risk: any executable, script or portable tool a user downloads will run, including from Downloads, Temp and AppData.
Why it matters: legitimate tools used badly pass antivirus. CISA, NSA and MS-ISAC found attackers running AnyDesk and ScreenConnect as portable executables that "launch within the user's context without installation", so blocking installation and removing admin rights did not stop them.
The fix: deploy allowlisting (App Control for Business on Windows, formerly WDAC) in audit mode, build rules from what runs, then enforce in rings, starting with fixed-function and high-risk devices. Cover scripts too (CIS Safeguards 2.5 and 2.7). Until then, use the ASR rule "Block executable files from running unless they meet a prevalence, age, or trusted list criterion". See the Application Allowlisting Guide.
5. EDR coverage gaps and tampering
The risk: the EDR console looks healthy, but servers, virtual desktops, Macs, Linux hosts and rebuilt machines are missing, and attackers stop or blind the agent before acting (ATT&CK T1685 Disable or Modify Tools, under the v20 Defense Impairment tactic).
Why it matters: attackers stage from the device with no agent, and a vulnerable signed driver is one route to stopping security processes from the kernel.
The fix: reconcile EDR enrolment against the asset inventory weekly (CIS Control 1) and alert when an agent stops reporting. Turn on tamper protection: in Microsoft Defender it keeps real-time protection, behaviour monitoring and cloud protection on and stops exclusions being added, and each attempt raises an alert, which Microsoft says "typically indicate[s] that a larger cyberattack has taken place". Enable the ASR rule "Block abuse of exploited vulnerable signed drivers" and audit exclusions monthly. See the EDR Evasion and Defence Guide.
6. Unapproved and insecure remote access tools
The risk: several remote support tools are installed, some by former suppliers, and users can run portable versions (ATT&CK T1219 Remote Access Tools).
Why it matters: CISA notes that RMM tools generally do not trigger antivirus alerts and give attackers persistent, interactive access. Vendors and consoles are in the trust chain too: the AnyDesk breach forced a code signing certificate revocation, and in the Stryker attack one hijacked admin account used the device management platform itself to wipe devices.
The fix: pick one approved tool, inventory and remove the rest, and block both installation and execution of portable versions, as CISA advises. Allow approved tools only through managed channels, block common RMM ports at the perimeter, and protect management consoles with phishing-resistant MFA and approval for mass actions. See the Remote Access Identity Guide.
7. Malicious and over-privileged browser extensions
The risk: users install any extension from the store, and trusted extensions auto-update to whatever their publisher ships (ATT&CK T1176.001 Browser Extensions).
Why it matters: an extension with access to all websites sees sessions, SaaS data and typed credentials. In the Cyberhaven extension breach a single OAuth consent let an attacker publish a malicious update to a security vendor's own extension.
The fix: block all extensions by default and allow an approved list (in Chrome, ExtensionInstallBlocklist set to * plus ExtensionInstallAllowlist; equivalent policies exist in Edge and Firefox), review permissions on updates, and remove broad-access extensions without a business owner (CIS Safeguard 9.4). See the Enterprise Browser and Browser Security Guide.
8. Developer machines full of secrets
The risk: developer laptops hold cloud keys, publishing tokens, SSH keys, kubeconfig files and AI API keys in plain-text files, environment variables and IDE settings, often with local admin and unrestricted extensions (ATT&CK T1176.002 IDE Extensions).
Why it matters: these are non-human identity credentials with production reach, and malware hunts them. The GlassWorm campaign used a VS Code extension worm to steal developer tokens, the Nx s1ngularity attack turned a build tool into a credential stealer, and in the Bybit hack one developer's AWS session tokens enabled a $1.5 billion theft.
The fix: replace static keys with short-lived, SSO-issued credentials, keep secrets in a vault or OS keychain, scan developer endpoints for plaintext secrets, and allowlist IDE extensions and AI coding tools. Treat developer devices as privileged, with rapid revocation playbooks. See the Secrets Management Guide and the AI Coding Agents Security Guide.
9. Unmanaged and personal devices
The risk: staff, contractors and partners reach corporate SaaS from home PCs and personal browser profiles that IT cannot see or patch.
Why it matters: infostealers on personal devices capture corporate logins and session cookies. In the Okta support system breach a service account saved in a personal Google profile exposed 134 customers, and in the Scania breach an IT partner's infostealer-stolen login exposed claim documents.
The fix: require device compliance for sensitive apps, use app protection policies or an enterprise browser on personal devices, block personal browser profiles on managed devices, and give partners managed or virtual desktops. See the Device Trust and Posture Guide and the Mobile Device Security Guide.
10. Removable media and peripherals
The risk: USB storage is open to everyone, AutoPlay is on, and any keyboard-like device is trusted (ATT&CK T1091 Replication Through Removable Media).
Why it matters: removable media carries malware into otherwise isolated networks, and data leaves on it unrecorded. ATT&CK's examples include Stuxnet and Conficker, both of which used AutoRun.
The fix: disable AutoRun and AutoPlay (CIS Safeguard 10.3), scan removable media on insertion, enable the ASR rule "Block untrusted and unsigned processes that run from USB", and use device control to allow only approved, encrypted drives by vendor and product ID, read-only where possible. See the Data Loss Prevention (DLP) Guide.
Mapping to OWASP
The OWASP Top 10:2025 covers web applications, so most endpoint risks map to it only loosely; the OWASP NHI Top 10 fits where endpoints hold machine credentials. CIS Controls v8.1 is the stronger map.
| Risk | OWASP Top 10:2025 | OWASP NHI Top 10 (2025) | CIS Controls v8.1 |
|---|---|---|---|
| 1. Unpatched software | A03 Software Supply Chain Failures (weak fit) | Not applicable | 7 Continuous Vulnerability Management |
| 2. Local admin rights | A01 Broken Access Control (weak fit) | Not applicable | 5 Account Management, 6 Access Control Management |
| 3. Credential theft | A07 Authentication Failures (weak fit) | NHI2 Secret Leakage (cached service credentials) | 4 Secure Configuration, 10 Malware Defenses |
| 4. No application control | Not mapped | Not applicable | 2 Inventory and Control of Software Assets |
| 5. EDR gaps and tampering | A09 Security Logging and Alerting Failures (weak fit) | Not applicable | 1 Inventory and Control of Enterprise Assets, 10 Malware Defenses |
| 6. Remote access tools | Not mapped | NHI3 Vulnerable Third-Party NHI (weak fit) | 2, 6, 12 Network Infrastructure Management |
| 7. Browser extensions | A03, A08 Software or Data Integrity Failures | NHI3 Vulnerable Third-Party NHI | 9 Email and Web Browser Protections |
| 8. Developer machines with secrets | A03 Software Supply Chain Failures | NHI2 Secret Leakage, NHI7 Long-Lived Secrets | 3 Data Protection, 16 Application Software Security |
| 9. Unmanaged devices | Not mapped | NHI10 Human Use of NHI (service accounts on personal devices) | 1, 4, 6 |
| 10. Removable media | Not mapped | Not applicable | 3 Data Protection, 10 Malware Defenses |
For detection content, the matching ATT&CK v20 techniques are T1003.001 and T1555.003 (risk 3), T1685 (risk 5), T1219 (risk 6), T1176.001 (risk 7), T1176.002 (risk 8) and T1091 (risk 10).
Where to start
If you can do only three things this quarter: remove standing local admin rights and deploy Windows LAPS (risk 2), reconcile EDR coverage against your asset inventory and turn on tamper protection everywhere (risk 5), and allowlist one remote access tool while blocking portable RMM software (risk 6). Track five numbers monthly: devices with users in the local Administrators group (target zero outside exceptions), assets with a healthy EDR agent (target 100%), median days to patch exploited third-party vulnerabilities, remote access tools seen running (target one), and extensions outside the allowlist. See the Endpoint Security Guide and the Windows Endpoint Hardening Guide.
Primary sources: CISA advisory AA23-025A on malicious use of RMM software, MITRE ATT&CK T1003.001, T1685, T1176, T1219 and T1091, Microsoft Learn on Windows LAPS, Credential Guard, tamper protection and attack surface reduction rules, CIS Controls v8.1, the OWASP Top 10:2025 and the OWASP NHI Top 10.
Related NHI Mgmt Group resources: Living off the Land Guide · macOS Security Guide for Enterprises · UEM Buyer's Guide · Ransomware Prevention Guide