What is a posture assessment?
A posture assessment, also called a posture check or health check, is the step in network access control (NAC) that examines a device's security state before deciding what it may reach. Authentication answers who the user is and whether the device is known. The posture assessment answers a different question: is this device safe to admit right now? An employee with valid credentials on a laptop whose antivirus is switched off and whose patches are three months old passes the first test and fails the second. The device's security state is its posture; the assessment is the act of checking that state against policy.
What a posture assessment checks
Policies differ, but common requirements are:
- a supported operating system with no critical update outstanding past a set deadline
- an EDR or antivirus agent that is installed, running and current
- full-disk encryption turned on
- the host firewall enabled and a screen lock configured
- a device that is managed by the organization and not jailbroken or rooted
- no prohibited software, such as unapproved remote-access tools
- for some VPN and zero trust platforms, a valid device certificate
How the assessment is performed
The information comes from one of three places, which the network access control page compares in detail. A persistent agent installed on managed devices can inspect the system deeply and report changes continuously. A dissolvable agent is downloaded at connection, runs once and removes itself, which suits contractors. An agentless assessment gathers what it can from MDM and EDR consoles, the directory, remote queries and network fingerprints, which covers printers and IoT devices that cannot run software. Whichever source is used, the policy server compares the result with policy and tells the switch, wireless controller or VPN gateway where to place the device.
Example: from quarantine to production
An engineer's laptop connects through 802.1X at 8:05 a.m. Authentication with its device certificate succeeds, but the agent reports that BitLocker was suspended for a firmware update and never resumed, and that last month's cumulative update is missing. The policy server tells the switch to place the laptop in a remediation VLAN whose ACL reaches only the update servers, the EDR console and a help page, and the user sees a notice listing what failed. Twenty minutes later the update is installed and BitLocker is back on. The agent reports a compliant state, and the policy server uses RADIUS Change of Authorization to move the session to the engineering VLAN without the user unplugging anything.
Posture at admission vs. continuous posture
Classic NAC assesses posture when a device connects, then rechecks periodically or when the agent reports a change. Zero Trust designs and Security Service Edge platforms use the same device signals on every access request, so a laptop whose EDR agent stops in mid-afternoon can lose access to sensitive applications at once, wherever it is. Conditional access in identity platforms works similarly by requiring a device that MDM reports as compliant before issuing a sign-in token.
Posture assessment vs. authentication and vulnerability scanning
- Authentication proves identity; a posture assessment judges device health. NAC normally needs both.
- A vulnerability scan hunts for known flaws in depth, on a schedule. A posture assessment is a fast pass or fail check against a short policy at the moment of access.
- A posture check trusts what the device reports. An agent on a compromised or rooted device can be made to lie, so many platforms add hardware attestation or cross-check MDM and EDR data.
Posture assessment on the CompTIA Security+ exam
SY0-801 objective 4.1 names endpoint posture checks as part of network access control, alongside 802.1X and captive portals. A scenario where a device authenticates successfully but is missing patches, has encryption off or has a stopped security agent points to a posture assessment, and the right outcome is usually a quarantine or remediation network, not full access and not a permanent block. Check device health before granting access also appears in Zero Trust scenarios. Distractors include 802.1X on its own, which authenticates without judging health; a captive portal, which handles guest sign-in or acceptance of terms; MAC filtering; and a vulnerability scan, which finds flaws but does not control admission.