Question 1

What is endpoint security posture management?

Accepted Answer

Endpoint security posture management (ESPM, also written as DSPM for device security posture management) is the practice of continuously measuring the security configuration of every endpoint in an organisation against a defined baseline, surfacing drift, and producing evidence that controls are operating effectively. The output is a per-device posture state, often summarised as a numeric Security Score, plus a record of every check execution suitable for audit.

Question 2

How is ESPM different from vulnerability management?

Accepted Answer

Vulnerability management is about software flaws — known CVEs in installed packages, exploitable defects in services. ESPM is about configuration — whether the device is set up correctly to resist attack regardless of what software is installed. A patched OS with disk encryption disabled is fine from a vulnerability-management view and broken from an ESPM view. Modern ESPM tools (including Lorika) include CVE scanning as one of their categories, so the two overlap, but the framing is different: configuration drift versus software flaws.

Question 3

What does an ESPM tool actually check?

Accepted Answer

Configuration state across categories like: authentication and access control (password policy, sudo configuration), network security (firewall state, listening services, exposed ports), filesystem security (disk encryption, sensitive-path permissions), kernel hardening (sysctl parameters, ASLR, KASLR), software and patches (update status, package CVEs), service configuration (running daemons, Docker security), SSH hardening (sshd_config), and audit logging (auditd / Event Log configuration). Each check evaluates a specific property and outputs pass / fail / warning.

Question 4

What's the relationship between ESPM and compliance frameworks?

Accepted Answer

ESPM checks map directly to compliance-framework controls. A check 'firewall is enabled' satisfies CIS Level 1 control 9.2, NIST 800-53 SC-7, SOC 2 CC6.6, and several others. A mature ESPM tool ships these mappings built-in, so the same check execution produces evidence for every framework the device is in scope for. Lorika ships eight frameworks built-in (CIS, NIST, ISO 27001, SOC 2, PCI DSS, NBU №143, NBU №95, ДССЗЗІ №75) plus a custom-framework builder.

Question 5

Is ESPM the same as DSPM?

Accepted Answer

ESPM and DSPM (device security posture management) are used interchangeably for endpoint configuration management. Note that 'DSPM' has a separate, distinct meaning in some contexts: data security posture management, which is about classification and access control over data stores, not endpoints. When evaluating tools, check which definition the vendor is using.

What is Endpoint Security Posture Management?

The three jobs of an ESPM tool

Measure

Detect drift

Produce evidence

The categories most ESPM tools check

Where Lorika fits

Related terms

Try endpoint posture management on your fleet