Layer 2: Endpoint Security in a Decentralized IT Landscape

The rise of decentralized IT environments marked by distributed assets, mobility, and diverse endpoint configurations has intensified cybersecurity challenges, with traditional perimeter defenses proving inadequate against advanced persistent threats (APTs), fileless malware, phishing, and multi-stage intrusions. This study proposes an integrated open-source endpoint security framework within the Multi-Tiered Cybersecurity Defense Model (MTCDM), combining EDR tools (OSquery, OpenEDR, Bluespawn, Whids), an XDR platform (Open XDR), and incident response solutions (TheHive, Cortex, Google GRR) to enable unified telemetry, detection, and response across heterogeneous endpoints. In controlled tests simulating 100 targeted attacks on 50 assets, the framework achieved a 91.4% detection rate, a mean time to detect of 14.2 s, a mean time to respond of 26.7 s, and resource usage under 8% CPU and 10% memory, with a post-remediation integrity score of 95%. Additionally, OSquery delivered the best detection efficiency, Open XDR enhanced cross-platform visibility, and TheHive streamlined incident workflows. These results demonstrate that an open-source, integrated endpoint protection architecture can deliver high detection accuracy, rapid response, and low resource overhead, offering a cost-effective, transparent alternative to proprietary solutions while supporting Zero Trust and defense-in-depth strategies.