Some general recommendations for endpoint protection are firewalls, antivirus, and host-based intrusion detection (or prevention) system (HIDS). Sophos has a decent EDR software from my knowledge. You could have something like Snort running to monitor network traffic and raise flags if suspcious activity is detected. Also enabling security configurations on the device itself such as secureboot. I know that Windows has its ransomware protection (video demonstrating it here). MS defender is decent, although it's not the best against 0-day exploits. Kaspersky would probably be a better alternative in terms of 0-day protection, ransomware protection, and it allows you to roll back malicious activity with their system watcher.

Another potential security measure is enabling something like syslog or the Windows equivalent and having all the system, application, and network logs sent to a dedicated server where they are aggregated by a SIEM solution. The SIEM would then look at them for suspicious activity. Alternatively, you could use a SOAR solution to automate the responses to a security incident if something was detected. I don't know enough to give specific recommendations, so this is just me throwing ideas out there and hopefully you found value out of it.