Enterprise Advanced Security (EDR): Enterprise 2022 Q2 – DETECTION

Sector: Enterprise
Testing: April to June 2022


Endpoint Detection Compared

We compare endpoint security products directly using real, major threats

Our reports help you choose the best enterprise endpoint security products that can protect you from ransomware and other types of attack

Choose the best enterprise endpoint security solution

Welcome to the first edition of the Enterprise Advanced Security test that compares different endpoint security products directly. We look at how they handle the major threats that face all businesses, from the Global 100, down to medium enterprises. And most likely small businesses, too.

We give an overall score but also dig down into the details that your security team will care about. This report explains the different levels of coverage that these products provide.

An Endpoint Detection and Response (EDR) product is more than anti-virus, which is why it requires advanced testing. This means testers must behave like real attackers, following every step of
an attack.

While it’s tempting to save time by taking shortcuts, a tester must go through an entire attack to truly understand the capabilities of EDR security products.

Full attack chain testing

Each step of the attack must be realistic too. You can’t just make up what you think bad guys are doing and hope you’re right. This is why SE Labs tracks cybercriminal behaviour and builds tests based on how bad guys try to compromise victims.

The cybersecurity industry is familiar with the concept of the ‘attack chain’, which is the combination of those attack steps.

Fortunately the MITRE organisation has documented each step with its ATT&CK framework. While this doesn’t give an exact blueprint for realistic attacks, it does present a general structure that testers, security vendors and customers (you!) can use to run tests and understand test results.

The Enterprise Advanced Security tests that SE Labs runs are based on real attackers’ behaviour. This means we can present how we run those attacks using a MITRE ATT&CK-style format.

Endpoint Detection Compared

You can see how ATT&CK lists out the details of each attack, and how we represent the way we tested, in Appendix A: Threat Intelligence, starting on page 15. This brings two main advantages: you can have confidence that the way we test is realistic and relevant; and you’re probably already familiar with this way of illustrating cyber attacks.

Read this SE Labs assessment of world-leading endpoint security products and discover how they handle well-known threats and targeted attacks. Endpoint detection compared!

Sign up to our monthly business and personal security newsletters.

Find out more

Our latest reports, for enterprise, small business and home users are now available for free. Please download them and follow us on LinkedIn to receive news, comment, updates and future reports.

Visit our blog for more security testing news, analysis and the Cyber Security DE:CODED podcast.