Ask most IT teams where their backup program focuses and the answer is servers: file servers, database servers, application servers. Servers hold critical shared data and centralized systems, so this makes sense. What it misses is increasingly significant.
Laptops and workstations hold a large and growing proportion of business-critical data. Local downloads, draft documents, project files, email archives, application data, and the accumulated working files of employees who save locally rather than to shared drives. In hybrid working environments this is more true than ever: remote employees frequently work on locally stored files that may never sync to a central location.
When a laptop is stolen, a hard drive fails, or ransomware encrypts an endpoint, the question “is this data backed up?” is answered either by a working endpoint backup policy or by the realization that it isn’t.
According to the 2026 Kaseya State of the MSP Report, 79% of MSPs offer backup and recovery as a managed service, yet endpoint devices, including laptops and remote workstations, remain the most commonly under-protected environment. Datto, part of the Kaseya family, protects endpoint data for MSPs managing device fleets across thousands of SMB clients globally. Download the full report.
Protect every endpoint, including the ones off-network
Datto Endpoint Backup provides continuous protection for laptops and remote devices, with direct-to-cloud backup that works regardless of whether devices are on the corporate network.
What endpoint backup covers
Endpoint backup, also called laptop backup, PC backup, or device backup, creates copies of the data on individual user devices, enabling recovery of that data if the device is lost, fails, or is compromised.
Coverage typically includes user files and documents, application data, browser profiles, and email data stored locally (Outlook PST files), with configurable inclusion and exclusion of specific folders and file types.
Full system image backup of endpoints captures the OS, applications, and data in a restorable image, enabling full device recovery: not just data recovery, but the ability to restore a complete working environment to replacement hardware. This matters when a device fails or is replaced, eliminating the time to reinstall applications and rebuild user environments from scratch.
Datto Endpoint Backup covers Windows and Mac endpoints including desktops, laptops, virtual machines, and cloud instances, whether devices are on the corporate network or working remotely. Backup frequency can be configured as frequently as every two hours, and the solution supports end-user self-service recovery alongside admin-managed restore workflows.
Why endpoint backup is frequently absent
Several common assumptions explain why endpoint backup is missing from otherwise mature backup programs.
Misplaced trust in cloud sync. OneDrive and Google Drive sync are not backup. They sync the current state of files to cloud storage. If files are deleted or encrypted on the endpoint, the deletion or encryption propagates to the synced cloud copy. Sync is an accessibility tool, not a recovery tool. The two are often conflated, and the difference only becomes apparent when recovery is actually needed.
“Users should save to the server.” Policy and practice diverge. Regardless of what users are instructed to do, data ends up on local drives. A backup program that depends on user compliance for its coverage has unpredictable coverage. The laptops that carry the most valuable locally stored data are often the ones belonging to the employees least likely to follow file-saving policy consistently.
Perceived complexity at scale. Backing up dozens or hundreds of endpoints requires a centrally managed solution with automated deployment, policy enforcement, and compliance monitoring. Manual endpoint backup doesn’t scale. The same IT team that has server backup running reliably often defers endpoint backup because the tooling to manage it at scale isn’t in place.
Bandwidth and volume concerns. Full endpoint backup generates significant data volumes, particularly for initial backups. Backup policies using incremental backup after the initial full backup, combined with deduplication and bandwidth throttling during business hours, manage these constraints without meaningful impact on network performance or user experience. Modern endpoint backup solutions are designed around these constraints, not in spite of them.
Endpoint backup in practice
Effective endpoint backup is agent-based and centrally managed. A backup agent deployed to endpoints, via RMM policy or scripted installation, connects to a central backup management system, executes backup according to defined policy, and reports status back to the management console.
The operational ideal is integration with the RMM platform: endpoint backup status visible alongside endpoint health, patch compliance, and monitoring, giving a unified view of device protection from a single console. Datto Endpoint Backup is pre-integrated with Kaseya’s endpoint management and RMM offerings, meaning deployment, policy enforcement, and backup status monitoring all operate within the same management environment technicians are already working in.
A typical backup policy for endpoints includes:
1. Daily incremental backup of user data folders (Documents, Desktop, Downloads, AppData for application preferences)
2. Regular full or image backup for systems with image backup requirements
3. Retention of 30 to 90 days for standard compliance and accidental deletion scenarios
4. Longer retention for high-risk or compliance-sensitive endpoint environments
Built-in malware scanning and ransomware detection add a security layer to the backup workflow: protected backup copies aren’t just a recovery resource, they’re also being monitored for the kind of file-level changes that indicate an active ransomware event.
Why endpoint backup is a compliance requirement
Beyond the operational case, endpoint backup has become a compliance requirement across several frameworks, and the scope is frequently broader than IT teams assume.
HIPAA requires covered entities to maintain backup copies of electronic protected health information (ePHI). For healthcare organizations whose staff work on laptops, clinicians, administrators, remote workers, endpoint backup is directly within scope of the HIPAA Security Rule’s technical safeguard requirements. A server backup program that doesn’t extend to clinical laptops leaves a documented compliance gap.
GDPR requires that personal data be protected against accidental loss, destruction, or damage (Article 32). Endpoint devices containing personal data about EU residents must be covered. An employee laptop with client data, patient records, or HR information is squarely in scope.
Cyber insurance policies have tightened requirements following ransomware claims where endpoint data was unrecoverable because laptop backup was excluded from scope. Underwriters increasingly require documented evidence of backup coverage that includes endpoint devices, not just servers, as a condition of coverage.
SOC 2 Availability criteria assess whether an organization has the processes and tools to restore data in a timely manner following a disruption. Endpoint backup coverage is part of demonstrating that capability systematically rather than selectively.
For IT teams and MSPs, the compliance argument provides a clear, documentable justification for endpoint backup investment that the operational case alone sometimes can’t close.
Endpoint backup for MSPs: the service opportunity
For MSPs delivering backup as a managed service, endpoint backup is both a protection gap to close and a revenue line to add. The clients most likely to have that gap are the same ones running hybrid workforces with laptops off-network for extended periods.
The service conversation is straightforward: most clients assume their backup program is more comprehensive than it is. A simple audit of what’s currently protected versus what’s at risk on endpoint devices makes the gap visible. The delta between “server backup only” and “server plus endpoint backup” is usually significant, often including the most business-critical work in progress sitting on a sales director’s laptop or a project manager’s workstation.
Datto Endpoint Backup’s multi-tenant architecture and pre-integration with Datto RMM and Kaseya’s platform make it operationally practical to add endpoint backup across a client base without proportional increase in management overhead. Centralized policy management, automated deployment, and consolidated reporting across clients are the operational elements that make endpoint backup viable as a managed service at scale.
Adding endpoint backup to a client’s program also addresses the compliance requirements that server-only backup leaves open, creating an evidence-backed justification for the additional service line.
Explore Datto Endpoint Backup for MSPs and IT teams.
The Unified Cyber Resilience Portal
Managing backup across on-premises infrastructure, SaaS applications, endpoint devices, and cloud environments has historically meant managing multiple separate tools, each with its own console, alerting system, and recovery workflow. For MSPs managing multiple clients across all of these environments, that fragmentation creates significant operational overhead.
Kaseya’s Unified Cyber Resilience Portal, announced at Kaseya Connect 2026, consolidates on-premises, SaaS, endpoint, and cloud backup management into a single integrated interface, eliminating the tool sprawl that forces technicians to manage recovery across disconnected vendors. Powered by Kaseya Intelligence, it delivers AI-driven screenshot verification with greater than 99.9% accuracy, connected recovery workflows with intelligent prioritization, and compliance coverage including FIPS capabilities and FedRAMP readiness.
For MSPs delivering endpoint backup alongside server and SaaS backup, the practical impact is a single compliance evidence trail, unified alerting, and automated backup verification across all protected environments, without the overhead of correlating results across separate platforms.
Key Takeaways
- Endpoint backup addresses a significant and growing data vulnerability: laptops and workstations hold business-critical data that server-only backup doesn’t protect, and hybrid working has made this gap larger.
- Cloud sync (OneDrive, Google Drive) is not backup. It propagates deletions and encryption alongside normal file changes. The two are often confused until recovery is actually needed.
- HIPAA, GDPR, cyber insurance requirements, and SOC 2 Availability criteria all extend backup obligations to endpoint devices, not just servers. A server-only backup program has documented compliance gaps in regulated environments.
- Agent-based, centrally managed endpoint backup with RMM integration is the scalable approach for IT teams and MSPs managing large device fleets. Datto Endpoint Backup’s pre-integration with Kaseya’s platform keeps deployment, management, and monitoring in a single environment.
- For MSPs, endpoint backup is both a protection gap to close for existing clients and a clear additional service line with compliance-backed justification.
