Technology: Advanced Security

SE Labs tested IronNet IronDefense against a range of hacking attacks designed to compromise systems and penetrate target networks in the same way as criminals and other attackers breach systems and networks.
How we test
Full chains of attack were used, meaning that testers behaved as real attackers, probing targets using a variety of tools, techniques and vectors before attempting to gain lower-level and more powerful access. Finally, the testers/attackers attempted to complete their missions, which might include stealing information, damaging systems and connecting to other systems on the network.
Product factsheet:
APT groups include:
- FIN7 & Carbanak
- OilRig
- APT3
- APT29
01/2022 - 01/2022
Enterprise Advanced Security (EDR): BlackBerry Protect and Optics – PROTECTION

Advanced Security (EDR): BlackBerry Protect and Optics
SE Labs tested BlackBerry Protect and Optics against a range of hacking attacks. These were designed to compromise systems and penetrate target networks in the same way as criminals and other attackers breach systems and networks.
We used full chains of attack , meaning that our testers behaved as real attackers, probing targets using a variety of tools, techniques and vectors before attempting to gain lower-level and more powerful access. Finally, the testers/ attackers attempted to complete their missions, which might include stealing information, damaging systems and connecting to other systems on the network.
Product factsheet:

Advanced Security (EDR): Kaspersky
SE Labs tested Kaspersky Endpoint Detection and Response against a range of hacking attacks. These were designed to compromise systems and penetrate target networks in the same way as criminals and other attackers breach systems and networks.
We used full chains of attack, meaning that our testers behaved as real attackers, probing targets using a variety of tools, techniques and vectors before attempting to gain lower-level and more powerful access. Finally, the testers/ attackers attempted to complete their missions, which might include stealing information, damaging systems and connecting to other systems on the network.
In this report we explain the threats used and explore how the tested product interacts with them. You might notice a similarity between the way we present this information and the way that the MITRE ATT&CK framework illustrates threat chains. This is not a coincidence. Our goal is to share information in ways that are familiar and easily understandable by the security community and its customers.
Read more of our reports here.

Advanced Security (EDR): CrowdStrike
SE Labs tested CrowdStrike Falcon against a range of hacking attacks. These were designed to compromise systems and penetrate target networks in the same way as criminals and other attackers breach systems and networks.
We used full chains of attack, meaning that our testers behaved as real attackers, probing targets using a variety of tools, techniques and vectors before attempting to gain lower-level and more powerful access. Finally, the testers/ attackers attempted to complete their missions, which might include stealing information, damaging systems and connecting to other systems on the network.
In this report we explain the threats used and explore how the tested product interacts with them. You might notice a similarity between the way we present this information and the way that the MITRE ATT&CK framework illustrates threat chains. This is not a coincidence. Our goal is to share information in ways that are familiar and easily understandable by the security community and its customers.
Read more of our reports here.

SE Labs Security Awards
Find out which products won in our annual awards
In this report, we reveal the SE Labs Security Awards for 2020-2021 and provide the latest security testing updates.
The third annual report from SE Labs charts the successes and failures of security companies, their customers and the criminals who keep relentless pressure on us all. Working from home is at its highest level in human history, which emphasises the need to secure all devices, everywhere.
Our annual awards recognise great performance in tests and in the real world.
Focus on endpoint protection results – 6 years of testing
After six solid years of testing endpoint protection we’ve produced a review that examines some of the trends and data points we’ve identified. How did your favourite anti-virus behave over the last few years?
What can we test, and how do we do it?
Meet the team behind SE Labs and find out which security solutions we test, and how we do it more realistically than anyone else.
08/2021 - 08/2021
Breach Response (NDR Detection): VMware NSX Network Detection and Response 2021 Q3

SE Labs tested VMware NSX Network Detection and Response against a range of hacking attacks designed to compromise systems and penetrate target networks in the same way as criminals and other attackers breach systems and networks.
VMware NSX Breach Response Test
Full chains of attack were used, meaning that testers behaved as real attackers, probing targets using a variety of tools, techniques and vectors before attempting to gain lower-level and more powerful access. Finally, the testers/attackers attempted to complete their missions, which might include stealing information, damaging systems and connecting to other systems on the network.
Tested products from:
APT groups include:
- FIN7 & Carbanak
- OilRig
- APT3
- APT29

SE Labs tested BlackBerry Protect and Optics in this Breach Response test. We pitted it against a range of hacking attacks designed to compromise systems and penetrate target networks. These are the same techniques criminals and other attackers use to breach systems and networks in the real world.
Breach Response Test: BlackBerry Protect
Testers used full chains of attack, meaning that they behaved as real attackers. We probed targets using a variety of tools, techniques and vectors before attempting to gain lower-level and more powerful access.
Finally, the testers/ attackers attempted to complete their missions. This might include stealing information, damaging systems and connecting to other systems on the network.
Tested products from:
SE Labs tested CrowdStrike Falcon in this Breach Response test. We pitted it against a range of hacking attacks designed to compromise systems and penetrate target networks. These are the same techniques criminals and other attackers use to breach systems and networks in the real world.
Testers used full chains of attack, meaning that they behaved as real attackers. We probed targets using a variety of tools, techniques and vectors before attempting to gain lower-level and more powerful access.
Finally, the testers/ attackers attempted to complete their missions. This might include stealing information, damaging systems and connecting to other systems on the network.
SE Labs tested Crowdstrike Falcon in this Breach Response test, pitting it against a range of hacking attacks designed to compromise systems and penetrate target networks in the same way as criminals and other attackers breach systems and networks.
Full chains of attack were used, meaning that testers behaved as real attackers, probing targets using a variety of tools, techniques and vectors before attempting to gain lower-level and more powerful access.
Finally, the testers/ attackers attempted to complete their missions, which might include stealing information, damaging systems and connecting to other systems on the network.
SE Labs tested SentinelOne in this Breach Response test, pitting it against a range of hacking attacks designed to compromise systems and penetrate target networks in the same way as criminals and other attackers breach systems and networks.
Full chains of attack were used, meaning that testers behaved as real attackers, probing targets using a variety of tools, techniques and vectors before attempting to gain lower-level and more powerful access.
Finally, the testers/ attackers attempted to complete their missions, which might include stealing information, damaging systems and connecting to other systems on the network.