Endpoint Security — small scale stack.
For each requirement below, pick the option that fits your build — recommended first, then free and cheaper alternatives — or skip what your project doesn't need. Tap the info icon next to any requirement to see why it matters.
Antivirus / NGAV Platform
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsClamAV Free unlimited OSS self-hosted, 0$; Defender for Endpoint P1 $3/user/mo or included in M365 Business Premium $22/user/mo, 90-day trial, free tier none standalone; SentinelOne Complete $15/device/mo ($179.99/device/yr) min 100 endpoints billed annually; CrowdStrike Falcon Go $59.99/device/mo ($719.88/yr per device) min 5 devices, Pro $79.99/device/mo, Enterprise $99.99/device/mo, 15-day trial, overage storage $0.40/GB over 5GB/device, extra device pro-rata
Endpoint Detection & Response (EDR)
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsWazuh Free unlimited agents self-hosted, community support; Carbon Black Standard $36/device/mo annual ($432/yr) min 50, $50/device/mo month-to-month; SentinelOne EDR $60/device/mo annual, Complete $75/device/mo, DataSet 7-day free 16GB/day; CrowdStrike Insight $99/device/mo ($1,188/yr per device) billed annually, Insight XDR $99.99/device/mo, Premium adds $10/device/mo for 90-day retention, overage $99 per additional device
Device Full-Disk Encryption Management
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsBitLocker/FileVault Native Free with OS (Windows Pro/Enterprise, macOS included), no central compliance without MDM - free unlimited; Sophos Central $28/device/yr ($2.33/device/mo) included in Intercept X Advanced, standalone $22/yr; Symantec $50/device/yr ($4.17/mo) min 25 licenses, $38/yr at 500+, management server appliance $5,000 one-time optional, overage recovery portal free
MDM / Unified Endpoint Management (UEM)
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsFleetDM OSS Free unlimited self-hosted; Mosyle Free 30 devices forever, Business $1/device/mo ($12/yr), Fuse $1.80/device/mo ($21.60/yr); Intune $8/user/mo standalone or $4/device/mo device-only, included in M365 Business Premium $22/user/mo, free trial 30 days; Jamf Pro $4/device/mo ($48/yr) min 25, Jamf Now $2/device/mo, overage $0.12/device/day, onboarding free
Patch Management Automation
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsAutomox Free 25 devices forever, Work $3/device/mo ($36/yr) after, Full $5/device/mo, API 10k calls/mo free then $0.02/call; ManageEngine Cloud Free 25 devices, $1.20/device/mo ($14.40/yr) min 75 devices, on-prem perpetual $1,095 for 100 devices; Ivanti $42/device/yr ($3.50/mo) min 100, patch content subscription $8k/yr, overage third-party patch catalog $2k/yr
Vulnerability Scanning - Endpoint Agent
Keeps you secure and compliant with regulations. Required for enterprise customers and handling sensitive data.Pricing & free-tier limitsOpenVAS Free unlimited self-hosted community; Tenable.io $2,500/yr for 100 assets ($2.08/asset/mo), Nessus Professional $3,990/yr per scanner 1 year; Rapid7 InsightVM $1.84/asset/mo min 100 ($184/mo), overage agent $1.84/mo; Qualys VMDR $20,000/yr for 100 assets ($16.67/asset/mo) min 64 assets, overage $195/asset/yr, 30-day trial, storage 1TB included
Device Control / USB / Peripheral Control
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsNative Intune/Jamf policies Free with MDM + USBGuard Free OSS unlimited devices; ManageEngine Device Control Plus Free 25 devices, then $795/yr for 50 devices ($1.33/device/mo); CrowdStrike Device Control Add-on $20/device/mo ($240/yr) requires Falcon Go/Pro base; Digital Guardian $40/device/mo ($480/yr) min 100 devices, PoC free, overage DLP add $10/device/mo
Application Control / Whitelisting
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsWDAC/AppLocker Free with Windows Enterprise/Education, unlimited policies; Airlock Digital Free 25 endpoints forever, then $2.50/endpoint/mo ($30/yr) min 50; Carbon Black App Control $44/device/yr ($3.67/mo) min 100, App Control + EDR $60/device/mo ($720/yr), overage audit $500 per compliance report
Endpoint Firewall Policy Management
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsNative firewall Free unlimited rules; ManageEngine Firewall Analyzer Free 5 devices, $595/yr for 10 devices ($4.96/device/mo) trial 30 days; Palo Alto Cortex XDR FirewallMgmt included in Cortex $44/endpoint/mo, standalone firewall add-on $5/device/mo ($60/yr), log overage $0.25/GB over 100GB; Intune firewall policies free with Intune license
Web Content Filtering / DNS Protection for Endpoints
Your human-readable address on the web plus the DNS records that point it at your servers. Skipping this is not an option — users need a domain to reach you.Pricing & free-tier limitsCloudflare Gateway Free 50 users forever 1M DNS queries/mo 24h logs, Teams $7/user/mo unlimited queries 30-day logs; OpenDNS Home Free 1 network; DNSFilter $0.90/device/mo ($10.80/yr) DNS filtering only, Roaming $1.80/device/mo min 25 ($270/yr); Zscaler ZIA Business $3.50/user/mo ($42/yr) min 100, Transformation $6.50/user/mo, overage $0.10/GB over 5GB/user, 10GB log retention included
Endpoint Asset Inventory & Discovery
Where you keep files users upload or you serve — images, videos, documents — and how fast they reach visitors around the world.Pricing & free-tier limitsSnipe-IT/FleetDM OSS Free unlimited assets self-hosted; Lansweeper Free 100 assets, Pro $1.20/asset/mo ($14.40/yr) min 500 assets $7,200/yr; PDQ Inventory Free 14-day trial, Enterprise $500/yr per admin unlimited devices; Tanium Asset $6/device/mo ($72/yr) min 1000 $72k/yr requires Tanium Core $10/device/mo, overage API 100k queries/mo included
FileVault / BitLocker Key Escrow & Recovery Portal
Moves money — charges, payouts to sellers, taxes, fraud checks. Highest-stakes integration: get it wrong and you break compliance or lose revenue.Pricing & free-tier limitsAD/iCloud native Free unlimited keys manual workflow; Mosyle Business $1/device/mo includes escrow free, Free tier 30 devices escrow free; Intune escrow free with Intune $8/user/mo or $4/device/mo device-only, Entra ID storage unlimited free; Sophos recovery portal $1,200/yr base + $4/device/mo, included in $28/yr encryption license, overage API calls free
Endpoint Logging & Telemetry Aggregation (SIEM Agent)
Keeps you secure and compliant with regulations. Required for enterprise customers and handling sensitive data.Pricing & free-tier limitsWazuh/Osquery Free unlimited self-hosted; Elastic Security Agent Free up to 200MB/day free cloud 14-day retention, Standard $95/mo per 1GB/day ingest; Graylog Open Free 5GB/day self-hosted, Cloud $250/mo for 5GB/day 30-day retention; Splunk Cloud $135/GB/mo ($1,620/GB/yr) ingestion min 5GB, free 500MB/day trial, LogScale free 16GB/day 7-day retention $0.40/GB after
Endpoint Remote Wipe & Lock
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsFind My Mac/Windows free unlimited with iCloud/MS account; Intune Wipe/Lock free with Intune $8/user/mo, selective wipe included; Mosyle wipe included in $1/device/mo Business; Absolute $4.50/device/mo ($54/yr) min 250 devices persistence module included, overage remote wipe API $0.05/action, freeze $0
Removable Media Encryption
Where you keep files users upload or you serve — images, videos, documents — and how fast they reach visitors around the world.Pricing & free-tier limitsVeraCrypt Free unlimited volumes self-hosted, audit community; BitLocker To Go free with Windows Pro/Enterprise; ESET FDE + Media $40/device/yr ($3.33/mo) includes removable; Symantec Media Encryption $30/device/yr ($2.50/mo) standalone, $50/yr bundled with FDE, overage USB policy audit $500 per report
Endpoint Compliance & Posture Assessment
Keeps you secure and compliant with regulations. Required for enterprise customers and handling sensitive data.Pricing & free-tier limitsWazuh + OpenSCAP Free unlimited checks; ManageEngine Device Compliance $4/device/yr ($0.33/mo) min 100; Intune compliance free with $8/user/mo, 500 compliance evaluations free/included, $0.01 per extra evaluation over 100k/mo; Tanium Comply $6/device/mo ($72/yr) requires Core $10/device/mo, CIS benchmarks $100/pack/yr, overage reports $2k/yr
Endpoint Isolation / Remote Quarantine & Containment
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsIntune network isolation free with Intune; SentinelOne isolation free with Singularity Complete $15/device/mo, RemoteOps add-on $8/device/mo ($96/yr); Carbon Black isolation included in Enterprise EDR $50/device/mo ($600/yr); CrowdStrike Contain included in Falcon Pro $79.99/device/mo and up, standalone containment $15/device/mo, overage forensic snapshot $5/snapshot over 100/mo
Secrets / Credential Management for Endpoints
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsVault OSS Free self-hosted unlimited secrets; HCP Vault $0.03/hr per cluster (~$21.90/mo) + $0.50 per 10k transactions; Doppler Free 5 users 100 secrets, Team $12/user/mo ($144/yr) unlimited secrets 30-day log; CyberArk Endpoint $45/device/mo ($540/yr) min 100 + $5k setup fee, overage API $0.10 per 1k calls over 100k/mo, free trial 30 days
Endpoint Certificate Management & SCEP
Encrypts traffic between your users and your servers. Without it browsers flag your site as insecure and you lose trust and search ranking.Pricing & free-tier limitsSmallstep OSS Free unlimited certs self-hosted, Let's Encrypt Free 90-day certs rate 50/domain/week; SCEPman Free 50 managed certs; EJBCA Cloud $199/mo for 250 certs ($0.80/cert/mo) overage $0.50/cert/mo; DigiCert Client Cert $4/device/yr ($0.33/mo) + platform $5,000/yr base, auto-renewal included, overage $1/cert replacement, free ACME trial
How this small scale endpoint security checklist works.
Each requirement below is something a small scale endpoint security build typically needs. Pick one of the four researched options — recommended, free, cheaper or paid — add your own with "Other", or skip the requirement if your project doesn't need it. Nothing is mandatory; the plan on the right tracks what you've decided so nothing gets forgotten.
Your picks are saved in this browser automatically, so you can come back anytime. Options are researched per build level and refreshed as vendors change their plans — always verify details on the provider's page before committing.