--- title: "What percentage of endpoints have EDR deployed?" url: https://insuranceposture.com/questions/endpoint-and-patching/percentage-endpoints-edr-deployed category: "Endpoint protection and patching" canonical_key: q_edr_003 evidence_state: partial updated: 2026-08-24 --- # What percentage of endpoints have EDR deployed? URL: https://insuranceposture.com/questions/endpoint-and-patching/percentage-endpoints-edr-deployed Section: Endpoint protection and patching Evidence state: Partly verifiable from your tenant A percentage looks like a fact. It is actually two numbers, and the one nobody states is where the exposure lives. ## What the carrier is actually asking The carrier wants a coverage figure for endpoint detection and response across the estate. The implicit question is what you counted. Enrolled devices, or every device that can reach corporate data? Servers, or only workstations? Contractors, or only employees? ## Why it is underwritten Attackers do not distribute across your fleet evenly. They arrive at whatever is reachable and weakest, which is disproportionately the uncovered remainder. A carrier with claims experience knows that the gap between ninety-five and a hundred percent contains most of the risk, so the follow-up questions are about the missing devices rather than about the covered ones. ## Where the answer lives in Microsoft 365, Entra ID, and Azure The numerator comes from your endpoint console. The denominator is the harder number and it benefits from sources the console does not have. | Platform | Where the setting lives | What has to be true | | --- | --- | --- | | Entra ID | Registered and joined device inventory | A directory-side device count to compare against the endpoint console, since the two rarely agree | | Microsoft 365 | Intune enrolled device count and compliance state | Enrolment coverage, and the population of devices that access corporate data without being enrolled | | Azure | Virtual machine inventory across subscriptions, and endpoint protection extension state | The server-side denominator, including machines outside the standard deployment pipeline | | Endpoint console | Agent count, health state, and unmanaged device discovery | Devices seen on the network without an agent, which is the most useful discovery output for this answer | | Asset inventory | Whatever authoritative asset list exists | A reconciliation between inventory, directory, and console. Attested | **Reconcile three sources, not one** The endpoint console, the directory, and the asset inventory each know about a different set of machines. The union is your real denominator, and the differences between the three lists are the most interesting security finding most organisations can produce in an afternoon. ## What a defensible yes requires - The figure states both numerator and denominator, and where the denominator came from. - Servers, cloud workloads, and non-Windows devices are included or explicitly excluded with a reason. - Unmanaged device discovery has been run, so the denominator is not simply the console inventory. - The uncovered remainder is identified by name rather than left as a percentage. - There is a dated plan for the remainder, which is what turns a gap into a trajectory. ## How this answer goes wrong Organisations report the console's own coverage percentage, which is calculated against devices the console knows about and is therefore close to a hundred by construction. It is not a wrong number; it answers a different question from the one asked. The moment an incident starts on a device outside that inventory, the difference becomes the whole story. ## If this answer turns out to be wrong Agent coverage, patch state, and end-of-life software are the answers that move fastest without anyone deciding to move them, so this block is where an accurate answer most often ages into an inaccurate one before the policy expires. Whether anything follows from an inaccuracy depends on materiality, on the policy wording, and on the law of the governing state: [why an accurate answer ages, and when the policy makes that matter](https://insuranceposture.com/glossary/point-in-time-underwriting). The other consequence terms are collected in the [glossary](https://insuranceposture.com/glossary). ## Frequently asked ### What figure is good enough? Carriers look for the high nineties and react most to how the number was derived. An explained ninety-six with named exceptions beats an unexplained hundred. ### Should servers be in the same number? Give both. Workstation and server coverage often differ substantially, and the aggregate hides the difference that matters. ### What about personal devices? If they reach corporate data they belong in the analysis, usually handled through application protection rather than an agent. Explain the control rather than excluding the population silently. ### How often should we recount? Before every renewal at minimum, and ideally continuously. Coverage decays as devices are added, and it decays fastest during growth and after acquisitions. ## Related questions - [Is endpoint detection & response (EDR) deployed with central monitoring?](https://insuranceposture.com/questions/endpoint-and-patching/endpoint-detection-response-deployed-central-monitoring) - [What percentage of hardware/software connected to network is inventoried?](https://insuranceposture.com/questions/network-and-logging/percentage-hardware-software-connected-network-inventoried) - [Is next-generation antivirus (NGAV) deployed on all endpoints?](https://insuranceposture.com/questions/endpoint-and-patching/next-generation-antivirus-deployed-endpoints) - [Is endpoint security centrally managed to monitor and force signature/agent updates?](https://insuranceposture.com/questions/endpoint-and-patching/endpoint-security-centrally-managed-monitor-force-signature-agent-updates) --- Insurance Posture by SecValley. https://insuranceposture.com The question library is written in our own wording to reflect the control topics that recur across US cyber application and ransomware supplemental forms. No carrier form is republished. SecValley is not a law firm, an insurance broker, an agent, or a carrier, and holds no producer licence. Nothing here is insurance advice, legal advice, or a coverage determination, and no attorney-client relationship arises from reading it. Statements about what a party to a cited case did, knew, or intended are allegations drawn from court filings and contemporaneous reporting, not findings of fact. Your organization's authorized signer remains responsible for the accuracy of any application. Consult a licensed broker and qualified counsel before binding.