16 endpoint security labels, 7 purchases: six of them are one agent now
How the 16 product types in our 2024 endpoint guide map to the decision guides TechBag keeps, with products counted per purchase, as of September 2026.
Six of the sixteen labels in our April 2024 endpoint guide now describe one purchase: the endpoint protection agent. Antivirus, next-generation antivirus, EDR, XDR, the host firewall and sandboxing are tiers or features of the same product, and TechBag’s Endpoint Protection guide lists 36 such products from 20 vendors.1 Seven of the other ten labels map to six further purchases. The last three, network access control, deception and web application security, are not endpoint purchases at all.2
01Sixteen labels, seven purchases
The 2024 piece was a glossary, and a glossary is the wrong shape for a budget. A buyer does not purchase “NGAV” and then “EDR”; they buy one agent at a tier that either includes detection and response or does not. UEM and MDM are one purchase now, sold by the same vendors in the same console. The label the original called endpoint exploit prevention, defined as finding and patching vulnerable software, is the job of a patch tool; the exploit-blocking half sits in the agent.
The sixteen 2024 labels reduce to seven purchases, and the endpoint agent absorbs six of them
Products by SKU on the TechBag decision guide each 2024 label maps to, 30 September 2026
Source: TechBag decision guides as committed 30 September 2026; TechBag mapping of the 2024 labels · as of 30 September 2026 · Three labels (NAC, deception, web application security) map to no endpoint guide
02Three labels belong to someone else’s budget
Network access control decides which devices join the network; it is bought with switches, wireless and firewalls, and TechBag keeps no endpoint guide for it. Deception, the decoy systems the original likened to a dummy treasure chest, is a specialist security operations tool, again with no guide of ours. Web application security protects the application, not the laptop, and is bought by whoever runs the application. SIEM is the odd one in: it does not protect an endpoint, but it is where the endpoint’s logs have to end up.2
03If you are buying this in India
Most of these products list in US dollars and are invoiced in rupees through a reseller, with 18% GST on top; Seqrite is the exception on the endpoint guide, priced in rupees from ₹799 per endpoint a year on TechBag’s record.1 Ten of the 36 endpoint products document an Indian data region.1 The rule that bites is CERT-In’s Directions of 28 April 2022: report a cyber incident within six hours and keep 180 days of logs within India, which is why the SIEM sits on this list.3 The DPDP Rules, notified on 13 November 2025, bring the security-safeguard and breach-notice duties into force on 13 May 2027; a lost, unencrypted laptop holding customer records is a reportable breach from then.4
Sources
- TechBag, Endpoint Protection decision guide (36 products, 20 vendors; depth, India-region and price tags) — as committed 30 September 2026; tags verified 22 August 2026
- TechBag, decision guides for SIEM, RMM and patch, DLP, encryption, vulnerability management and UEM/MDM (product rows) — as committed 30 September 2026
- CERT-In, Directions under section 70B(6) of the IT Act (six-hour reporting; 180-day logs within India) — 28 April 2022
- MeitY, Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025 (notified 13 November 2025; substantive duties from 13 May 2027) — 13 November 2025
Disclosure. TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view.
Keep reading
