Title: Openai/695cf919-be54-8012-abfe-890e2495a365 - freem URL Source: https://freemwiki.com/index.php?mobileaction=toggle_view_mobile&title=Openai%2F695cf919-be54-8012-abfe-890e2495a365&veaction=edit Markdown Content: ### User: EPM on all endpoints or just who needs admin rights?[edit](https://freemwiki.com/index.php?title=Openai/695cf919-be54-8012-abfe-890e2495a365&action=edit§ion=2 "Edit section: User: EPM on all endpoints or just who needs admin rights?") EPM on all endpoints or just who needs admin rights? At my current we have CyberArk EPM and it’s where I first ever used EPM. We have about 4k endpoints and another 1500 servers. EPM is only installed on roughly 900 endpoints and no servers. Is this normal? LAR is removed from all endpoints. EPM is on some of the IT departments like dev, quant, DBAs, and Sys Engineering. No servers have EPM. I was just interviewing with a company who is looking to roll out EPM to all 12k endpoints that they have. ### Assistant: Short answer: both models exist, but they serve different risk appetites and maturity levels.[edit](https://freemwiki.com/index.php?title=Openai/695cf919-be54-8012-abfe-890e2495a365&action=edit§ion=3 "Edit section: Assistant: Short answer: both models exist, but they serve different risk appetites and maturity levels.") Short answer: both models exist, but they serve different risk appetites and maturity levels. What you’re seeing at your current place is very common, but it’s also less mature than what the 12k-endpoint company is aiming for. Let’s break it down clearly. #### 1. Is it normal that EPM is only on ~900 of 4k endpoints?[edit](https://freemwiki.com/index.php?title=Openai/695cf919-be54-8012-abfe-890e2495a365&action=edit§ion=4 "Edit section: 1. Is it normal that EPM is only on ~900 of 4k endpoints?") Yes — very common. This is the “admin personas only” deployment model. ##### Typical characteristics[edit](https://freemwiki.com/index.php?title=Openai/695cf919-be54-8012-abfe-890e2495a365&action=edit§ion=5 "Edit section: Typical characteristics") * EPM installed only on: - Devs - Quants - DBAs - Sys/Platform engineers * Local Admin Rights (LAR) removed across the estate * Everyone else runs as standard user * Servers excluded entirely ##### Why orgs do this[edit](https://freemwiki.com/index.php?title=Openai/695cf919-be54-8012-abfe-890e2495a365&action=edit§ion=6 "Edit section: Why orgs do this") * EPM is seen as an “admin replacement tool”, not a universal control * Lower: - Licensing cost - Operational overhead - Policy complexity * Security teams often think: > “If users can’t elevate, why install EPM?” ##### Downsides (important)[edit](https://freemwiki.com/index.php?title=Openai/695cf919-be54-8012-abfe-890e2495a365&action=edit§ion=7 "Edit section: Downsides (important)") * No visibility into: - Credential abuse attempts - LOLBAS usage by standard users - UAC bypass attempts * Malware still executes as standard user * You only control who can elevate, not what executes So yes — normal, but reactive rather than preventative. #### 2. Is it normal that no servers have EPM?[edit](https://freemwiki.com/index.php?title=Openai/695cf919-be54-8012-abfe-890e2495a365&action=edit§ion=8 "Edit section: 2. Is it normal that no servers have EPM?") Also very common, but increasingly questioned. ##### Typical reasons[edit](https://freemwiki.com/index.php?title=Openai/695cf919-be54-8012-abfe-890e2495a365&action=edit§ion=9 "Edit section: Typical reasons") * Servers are: - “Hardened” - Managed via PAM (CyberArk Core, BeyondTrust, etc.) - Considered operationally sensitive * Fear of: - Performance impact - Breaking services * Teams rely on: - AD delegation - Just-in-Time admin - Jump hosts / PAWs ##### Reality[edit](https://freemwiki.com/index.php?title=Openai/695cf919-be54-8012-abfe-890e2495a365&action=edit§ion=10 "Edit section: Reality") * Servers are high-value targets * Lateral movement often ends on servers * Many orgs now: - Deploy EPM on jump boxes - Deploy EPM on Tier 2 / app servers - Exclude Tier 0 (DCs, PKI, etc.) So “no servers” is common, but not best practice anymore. #### 3. The 12k-endpoint rollout — what model is that?[edit](https://freemwiki.com/index.php?title=Openai/695cf919-be54-8012-abfe-890e2495a365&action=edit§ion=11 "Edit section: 3. The 12k-endpoint rollout — what model is that?") That company is going for “EPM as a security control”, not just an admin tool. ##### Why orgs do full-estate EPM[edit](https://freemwiki.com/index.php?title=Openai/695cf919-be54-8012-abfe-890e2495a365&action=edit§ion=12 "Edit section: Why orgs do full-estate EPM") * Prevent: - LOLBAS abuse - Script abuse (PowerShell, WMI, mshta, rundll32, etc.) - Living-off-the-land malware * Gain: - Full execution visibility - Forensic telemetry - Consistent control plane * Enforce: - App control - Elevation only when explicitly approved This aligns with: * Zero Trust * MITRE ATT&CK * NIST / CIS benchmarks * Insurance & audit pressure #### 4. Pros & cons — side-by-side[edit](https://freemwiki.com/index.php?title=Openai/695cf919-be54-8012-abfe-890e2495a365&action=edit§ion=13 "Edit section: 4. Pros & cons — side-by-side") ##### Admin-only EPM (your current place)[edit](https://freemwiki.com/index.php?title=Openai/695cf919-be54-8012-abfe-890e2495a365&action=edit§ion=14 "Edit section: Admin-only EPM (your current place)") Pros * Faster rollout * Fewer tickets * Easier policies * Cheaper Cons * Blind spots on ~75% of endpoints * No protection against standard-user attacks * Security value capped ##### All-endpoints EPM (12k rollout)[edit](https://freemwiki.com/index.php?title=Openai/695cf919-be54-8012-abfe-890e2495a365&action=edit§ion=15 "Edit section: All-endpoints EPM (12k rollout)") Pros * Strong security posture * Full visibility * Better malware containment * Consistent enforcement Cons * Heavy policy design effort * More noise initially * Requires mature: - App packaging - Certificate hygiene - Change control * Needs strong L2/L3 Cyber involvement #### 5. What’s “best practice” today?[edit](https://freemwiki.com/index.php?title=Openai/695cf919-be54-8012-abfe-890e2495a365&action=edit§ion=16 "Edit section: 5. What’s “best practice” today?") Hybrid, phased maturity model: ##### Phase 1 – Admin personas[edit](https://freemwiki.com/index.php?title=Openai/695cf919-be54-8012-abfe-890e2495a365&action=edit§ion=17 "Edit section: Phase 1 – Admin personas") ✔ What your org has now ##### Phase 2 – High-risk users[edit](https://freemwiki.com/index.php?title=Openai/695cf919-be54-8012-abfe-890e2495a365&action=edit§ion=18 "Edit section: Phase 2 – High-risk users") * Finance * Execs * Developers using unsigned tools ##### Phase 3 – All endpoints[edit](https://freemwiki.com/index.php?title=Openai/695cf919-be54-8012-abfe-890e2495a365&action=edit§ion=19 "Edit section: Phase 3 – All endpoints") * Elevation mostly disabled * EPM used for: - Blocking abuse - Monitoring execution - Just-Enough-Admin ##### Phase 4 – Select servers[edit](https://freemwiki.com/index.php?title=Openai/695cf919-be54-8012-abfe-890e2495a365&action=edit§ion=20 "Edit section: Phase 4 – Select servers") * Jump hosts * App servers * Exclude Tier 0 #### 6. Interview signal (important)[edit](https://freemwiki.com/index.php?title=Openai/695cf919-be54-8012-abfe-890e2495a365&action=edit§ion=21 "Edit section: 6. Interview signal (important)") The fact that the new company wants EPM on all 12k endpoints usually means: * They’ve had: - Incidents - Audit findings - Insurance pressure * They see EPM as endpoint protection, not an IT tool * They will need: - Strong engineering - Good runbooks - People who understand friction vs security Given your background with: * CI/CD signing * Certificate governance * macOS + Windows EPM * LOLBAS awareness 👉 You’re exactly the kind of profile they need, whether they realise it yet or not. ##### TL;DR[edit](https://freemwiki.com/index.php?title=Openai/695cf919-be54-8012-abfe-890e2495a365&action=edit§ion=22 "Edit section: TL;DR") * Your current setup is normal but limited * Full-estate EPM is more mature and security-driven * Servers excluded is common but slowly changing * The 12k rollout suggests higher ambition — and higher pain If you want, I can help you: * Frame this comparison for interviews * Design a realistic phased rollout model * Or draft talking points that show you understand both security and ops reality