Endpoint Information Profile (EIP) is a Versa SASE construct that collects and evaluates a connecting device’s identity and security posture – antivirus status, disk encryption, OS version, and more – before granting network access. EIP objects define match criteria, EIP profiles group objects into policy, and EIP agent profiles tell the SASE client what to collect.
Key takeaways
- EIP checks a device’s security posture before granting network access.
- EIP objects define match criteria; profiles group objects into policy.
- Agent profiles tell the SASE client what endpoint data to collect.
- Categories span antivirus, disk encryption, OS version, and more.
- EIP profiles attach to protection, access, and decryption rules.
On this page: Why it mattersHow it worksTypesEIP & VersaFAQ
Why is EIP important?
Enterprise users connect from laptops, phones, tablets, and IoT devices, over networks the organization doesn’t control – and every one of those endpoints is a potential point of entry for an attacker. Verifying who a user is has never been enough on its own; a stolen-but-valid credential on a compromised, unpatched laptop is still a compromised connection. Zero Trust models close that gap by evaluating the device alongside the user, continuously, not just at login.
EIP is Versa’s mechanism for that device-side check. It lets policy ask whether an endpoint is actually compliant – patched, encrypted, running required security software – before it reaches sensitive applications, and it can re-evaluate posture through the session rather than trusting a one-time check. That turns access control from an identity gate into an enforced compliance requirement.
What is EIP?
A naming note first: some Versa document titles render EIP as “Endpoint Identity Profile”. Both names refer to the same configuration object; this glossary uses Endpoint Information Profile, the form Versa’s configuration articles use throughout their bodies.
EIP is built from three components. EIP objects are the match criteria – a rule like “antivirus is installed and running” or “disk is encrypted” – filtering the raw posture data an endpoint reports. EIP profiles group objects into a policy unit: a set of rules evaluated together to decide whether a device is compliant. EIP agent profiles are separate from EIP profiles – they define what data the SASE client actually collects and reports from the endpoint in the first place, which the agent then sends to the gateway for evaluation against a profile.
Evaluation follows fixed logic: objects from different categories in one rule use AND (all must match), objects in the same category use OR (any match suffices), multiple rules evaluate top-down with the first match winning, and multiple profiles on one policy are OR’d together.
Types of EIP
Versa ships roughly 156 predefined EIP objects across around 19 categories, and administrators can define custom ones. Most categories evaluate security software posture: anti-malware, anti-phishing, endpoint security suites (including named support for CrowdStrike Falcon and SentinelOne), firewall, disk encryption, disk backup, data loss prevention, patch management, and related agent-based protections. A General category checks device identity – hostname, host ID, Windows domain, username, and OS vendor/product/version. A Mobile category adds phone-specific checks: passcode, biometric support, jailbreak status, and mobile disk encryption. Management status confirms whether a device is enrolled in enterprise management, and a Custom category matches on arbitrary process names, file paths, or Windows registry values for cases the predefined categories don’t cover.
EIP & Versa
EIP is configured per tenant in Concerto, under Configure > Security Service Edge > Profiles and Connectors > Endpoint Information Profile (EIP), where administrators build EIP objects, profiles, and agent profiles from predefined building blocks or custom ones. EIP profiles are then associated with internet protection rules, secure client-based access rules, and TLS decryption rules, so the same posture check can gate web access, VPN-style connections, or whether traffic gets decrypted for inspection. EIP agent profiles are attached to secure access policy separately, controlling what the SASE client extracts from the endpoint; how often that data refreshes is governed by the posture check interval configured in the secure access profile.
Versa’s step-by-step configuration guides frame EIP as part of the broader Zero Trust story: it works alongside Versa Secure Private Access (VSPA) to enforce least-privilege, continuously evaluated access for both managed and unmanaged devices, rather than a one-time login check.
Frequently asked questions
What is the difference between an EIP object, an EIP profile, and an EIP agent profile?
An EIP object is one match criterion, such as “antivirus is installed.” An EIP profile groups objects into a policy rule set evaluated at connection time. An EIP agent profile is separate – it defines what data the SASE client actually collects from the endpoint to evaluate against.
How does EIP rule evaluation logic work?
Within one rule, objects from different categories use AND logic – all must match. Objects within the same category use OR logic – any match is enough. Multiple rules in a profile evaluate top-down, first match wins, and multiple profiles on one policy are OR’d together.
What kinds of endpoint posture can EIP check?
EIP spans roughly 19 categories: security software like anti-malware, firewall, and disk encryption; general device identity such as hostname and OS version; mobile-specific checks like jailbreak and biometric status; management enrollment; and a custom category for arbitrary process, file, or registry matches.
Where do EIP profiles get enforced?
EIP profiles attach to internet protection rules, secure client-based access rules, and TLS decryption rules in Concerto. That lets the same posture evaluation gate general web access, client-based remote access, and whether a session’s traffic is selected for TLS decryption.
How often is endpoint posture data refreshed?
The SASE client collects and reports endpoint data on a schedule set by the posture check interval in the secure access profile, rather than only once at connection time – so EIP can revoke or restrict access if a device’s compliance state changes mid-session.
More on EIP
If you want to learn more, these are sources we trust.
| NIST SP 800-207: Zero Trust Architecture | Cloud Security Alliance research |
|---|---|
| The NIST reference architecture for Zero Trust, where continuous subject and device evaluation replaces one-time network-perimeter trust. | Vendor-neutral guidance on Zero Trust and device-posture practices for enterprise, cloud, and remote access. |
Related terms
If you’re reading about EIP, these are worth looking at next.
| Access Rule | Antivirus | Microsegmentation |
|---|---|---|
| A Versa Director rule, evaluated top to bottom, that allows or denies client-subnet traffic reaching Director by username or role. | Malware detection and blocking applied to files in transit; Versa NGFW provides antivirus scanning – the same status EIP objects can check on a device. | A technique that isolates network segments and enforces granular access policy between them – the Zero Trust posture model EIP feeds into. |