# What questions should we ask any endpoint security vendor?

**Short answer:** Ask where decisions are made, what happens without connectivity, what the tool depends on to function, and whether it prevents or merely reports. The answers separate architecture from marketing quickly.

## Questions worth asking

1. **Where is the protective decision made — on the endpoint or in your cloud?** A network round trip in the critical path cannot beat a millisecond-scale attack.
2. **What happens when the machine is offline or air-gapped?** If protection degrades, it wasn't local.
3. **Does your agent depend on Windows system libraries to function?** If yes, an attacker who compromises those libraries in memory can blind or silence it.
4. **Do you require signatures or threat intelligence feeds?** If yes, protection trails the attacker by definition.
5. **Does a response require a human?** If yes, response time is bounded by human biology.
6. **Do you store our encryption keys or upload sensitive data for analysis?** Centralized storage creates a target and a compelled-disclosure risk.
7. **What is your false positive rate, and what does a response actually do?** Full-system lockdown as the only containment option is expensive in a hospital or a plant.

## Why these questions matter

Most endpoint tools look similar in a datasheet. These questions surface the architectural decisions that determine whether a tool can act in time — or can only explain, afterward, what happened.