Definition
In networking, an endpoint is one of the two ends of a connection. In the VPN world, the term most often refers to the user's device — the laptop, phone, tablet, or workstation — running the client software. In a site-to-site VPN, both ends are gateways or routers rather than user devices. In Zero Trust frameworks, 'endpoint' has expanded to encompass the entire device, its operating system, and its security posture, not merely its network interface.
Endpoint Security
A VPN protects traffic between endpoints, but it does not protect the endpoints themselves. If the user's laptop is infected with malware, the malware can read the plaintext data before the VPN encrypts it, or after it decrypts incoming traffic. A compromised endpoint defeats the entire purpose of the tunnel. Enterprise VPN deployments increasingly require an Endpoint Detection and Response (EDR) tool, an up-to-date OS, full-disk encryption, and a passing health check before allowing the VPN to connect.
BYOD and Trust
The 'bring your own device' trend has complicated endpoint security: a corporate VPN must accept connections from personal phones and home computers that the IT team did not provision and cannot fully control. The Zero Trust answer is to never grant blanket trust on the basis of being on the VPN, and instead authorize each individual application access request based on real-time device posture.