Endpoint hardening means turning off anything the device doesn't strictly need — legacy protocols, unused ports, needless local privileges — so an attacker has fewer doors to try. Here four services (HTTPS, DNS, OS updates, the antimalware agent) are essential and stay on; six others are classic unnecessary attack surface: legacy SMBv1 file sharing, Telnet, an internet-exposed RDP port, the Print Spooler (PrintNightmare-class), FTP and a local Guest account. Each active service adds to a surface score, drawn as a translucent sphere around the endpoint — hardening it visibly shrinks that sphere.
Launching an attack picks the riskiest currently open vector, injects a malicious process into a running process (process injection, MITRE ATT&CK T1055), and races two clocks: how fast the injected process reaches a damaging action ("breach"), against how fast the EDR agent's behavioral monitoring — watching system calls and process ancestry rather than file signatures — flags the anomaly and auto-isolates it.
surfaceScore = Σ essentialWeight + Σ active(hardenable) weight
detectionTime ≈ base − hardenedCount × Δ (fewer distractions ⇒ faster signal)
breachTime ≈ base − vector.risk × Δ (riskier open vector ⇒ faster damage)
outcome = detectionTime ≤ breachTime ? "contained" : "breach before containment"
- Service checkboxes — unchecking a service simulates disabling it (hardening); its node greys out, its line to the endpoint disappears, and the attack-surface sphere shrinks.
- Surface score / Hardened — a running tally of how much attack surface is currently exposed and how many of the six hardenable services are off.
- Launch attack simulation — spawns an attacker that targets the single riskiest open service, injects into a process, and lets EDR detection race the breach in real time.
- Time to detection / Outcome — how long behavioral monitoring took to flag and auto-contain the injected process, and whether that happened before or after a breach event fired.
Real-world relevance: this is why hardening and EDR are deployed together rather than as alternatives — a smaller attack surface doesn't just block more attacks outright, it also makes the ones that do get through easier for behavioral detection to spot quickly, because there's less legitimate noise for anomalous activity to hide inside.