Cyber Defense Matrix 2.0 · Asset Row · Devices
Devices
Endpoints, servers, and hardware. The most-tooled and most-contested row in a typical enterprise stack.
Devices is the original Cyber Defense Matrix asset row from Sounil Yu — laptops, desktops, servers, mobile devices, and the hardware under them. In CDM 2.0 it remains the row with the most mature tooling, the most overlap across functions, and the highest share of security spend. For most organizations Devices coverage is the benchmark against which other rows are measured.
What belongs on the Devices row
Devices covers endpoint hardware: corporate laptops, desktops, servers (bare metal and virtual), mobile devices under MDM, and the OS-level controls that run on them. It does not cover OT/IoT assets (those have their own row), cloud-native compute without a discrete device identity (containers, serverless — those sit with Applications and Cloud), or the network fabric the devices connect through (Networks).
The row is wide because the work is layered: inventory, configuration management, patching, endpoint protection, detection, response, and recovery all have distinct tool categories. A typical stack has six to ten products contributing to Devices coverage across the seven function columns.
Coverage by function column
GOVERN × Devices is usually implicit — endpoint policies live in GRC/policy tooling. ANTICIPATE × Devices is thin except for intel feeds that correlate to device-level IOCs. IDENTIFY × Devices is where CMDB/CAASM plus vulnerability management do their heaviest work — this cell is the foundation for everything else in the row.
PROTECT × Devices is usually the most crowded cell in the matrix: EPP, EDR preventive features, application control, USB blocking, disk encryption, patching, configuration baselines, host firewalls. DETECT × Devices is dominated by EDR and XDR; supplemental tools (deception, memory forensics, file-integrity monitoring) add depth. RESPOND × Devices is EDR live response plus remote remediation tooling. RECOVER × Devices is endpoint-backup tooling plus the rebuild-from-gold-image runbook.
Overlap hotspots on this row
Cross-vendor endpoint overlap is the classic rationalization target. Organizations that migrated from Symantec/McAfee/Trend Micro to modern EDR (CrowdStrike, SentinelOne, Microsoft Defender for Endpoint, Cybereason) often kept the legacy EPP running for a transition period and never removed it. Any endpoint stack with two active vendors covering the same cell for longer than the agreed-upon migration window is pure spend.
Vulnerability management + configuration management is a second overlap cluster. Tenable, Qualys, Rapid7, and the config-assessment features of EDR products all compete for the same scan-and-report-findings work. Most organizations are better off picking one primary source of vulnerability truth and using the others only where they have unique capabilities (Snyk for source code, Wiz for cloud workloads, etc.).
Where 'You Already Own the Fix' usually shows up on Devices
The most frequent finding: EDR deployed and providing only its default telemetry while the platform has substantial additional capability sitting dormant. CrowdStrike Falcon Insight's custom IOAs, Defender for Endpoint's attack-surface-reduction rules, SentinelOne's static AI engine, Cybereason's MalOp prioritization — all are high-value capabilities that require configuration effort beyond 'install the agent.'
A second pattern: MDM products (Intune, Jamf, Kandji, Workspace ONE) with compliance policies enabled but not enforced. The policy dashboard shows green, conditional access in the IdP is not actually keying off it, and non-compliant devices continue to access production. The matrix cell reads Covered; operationally it is not.
Frequently asked
Does 'Devices' include mobile?
Yes. Corporate-managed phones and tablets sit on the Devices row, covered typically by an MDM/UEM (Intune, Jamf, Kandji, Workspace ONE) with optional mobile threat defense (Zimperium, Lookout, Check Point Harmony). Personal (BYOD) devices are only in scope to the extent that access-control policies gate their connection to corporate resources.
Are virtual machines on the Devices row or the Cloud row?
It depends on who operates them. On-prem VMs and IaaS-hosted VMs that your team manages end-to-end sit on Devices. Cloud-native compute (containers, serverless, managed services) sits on Cloud. The line is operational ownership, not deployment location.
Is IoT on the Devices row?
No. IoT has its own row in CDM 2.0 (OT/IoT). The reason is that IoT security requires specialized tooling (network telemetry, device-behavior analytics) and operates under different constraints (limited patchability, vendor-opaque firmware). Putting IoT on the Devices row hides those distinctions.
How do containers and VMs differ from physical servers for CDM purposes?
Containers and managed compute belong on the Cloud row because their security controls are cloud-native (admission controllers, runtime protection, image scanning). Physical servers and traditional VMs — where you care about the OS, the agent, and the patch level — sit on Devices. A Kubernetes node can be simultaneously a Device (the underlying VM) and part of Cloud (the orchestrator layer).