Technology: Enterprise Advanced Security (EAS)
Cyber Threat Intelligence
Annual Report 2023: Threat Intelligence for 2023
Welcome to the fourth annual report from SE Labs. This edition focuses on cyber threat intelligence.
Understanding threats is crucial when trying to defend against them. Knowing your enemy’s tactics helps clarify security planning.
We use threat intelligence when testing security products, to ensure our results are useful to companies facing real threats in the real world.
We’re sharing our insights here to help you build a strategy for success in the face of the global cyber threat.
What are the Threats?
We explore the current threats and explain why so many organisations remain vulnerable. There’s good news and bad news…
Loading…
Reload document 
Open in new tab Ransomware
Learn about the very latest innovations in testing anti-ransomware security approaches.
Annual Security Awards
Our Annual Security Awards recognises security vendors that not only do well in our tests, but perform well in the real world with real customers. These awards are the only in the industry that recognise strong lab work combined with practical success.
How we work (and could work with you!)
Discover which types of tests we run and how we can work with you to improve your product or your choice of products.
Deep and direct ransomware testing
Deep and direct ransomware testing
We tested CrowdStrike Falcon against a range of ransomware attacks designed to extort victims. These attacks were realistic, using the same tactics and techniques that were used against victims in recent months.
Target systems, protected by CrowdStrike Falcon, were attacked by testers acting in the same way as we observe ransomware groups to behave.
Attacks were initiated from the start of the attack chain, using phishing email links and attachments, as just two examples. Each attack was run from the very start to its obvious conclusion, which means attempting to steal, encrypt and destroy sensitive data on the target systems.
Loading…
Product factsheet:
Enterprise Advanced Security (Ransomware): CrowdStrike Falcon
Ransomware is the most visible, most easily understood cyber threat affecting businesses today. Paralysed computer systems mean stalled business and loss of earnings. On top of that, a ransom demand provides a clear, countable value to a threat. A demand for “one million dollars!” is easier to quantify than the possible leak of intellectual property to a competitor.
We have created a comprehensive test that shows how effective security products are when faced with the whole range of threats posed by ransomware itself and the criminal groups operating in the shadows.
In this report we have taken two main approaches to assessing how well products can detect and protect against ransomware.
Enterprise Advanced Security (Ransomware) Tested
This detailed report looks at ransomware detection during a full network attack; and protection against known ransomware attacks and their unknown variants. We include details about the different types of ransomware attacks, including the tactics used by different criminal groups.
Choose the best enterprise endpoint security solution
Choose the best enterprise endpoint security solution
Welcome to the first edition of the Enterprise Advanced Security test that compares different endpoint security products directly. We look at how they handle the major threats that face all businesses, from the Global 100, down to medium enterprises. And most likely small businesses, too.
We give an overall score but also dig down into the details that your security team will care about. This report explains the different levels of coverage that these products provide.
Loading…
Product factsheets:
An Endpoint Detection and Response (EDR) product is more than anti-virus, which is why it requires advanced testing. This means testers must behave like real attackers, following every step of
an attack.
While it’s tempting to save time by taking shortcuts, a tester must go through an entire attack to truly understand the capabilities of EDR security products.
Full attack chain testing
Each step of the attack must be realistic too. You can’t just make up what you think bad guys are doing and hope you’re right. This is why SE Labs tracks cybercriminal behaviour and builds tests based on how bad guys try to compromise victims.
The cybersecurity industry is familiar with the concept of the ‘attack chain’, which is the combination of those attack steps.
Fortunately the MITRE organisation has documented each step with its ATT&CK framework. While this doesn’t give an exact blueprint for realistic attacks, it does present a general structure that testers, security vendors and customers (you!) can use to run tests and understand test results.
The Enterprise Advanced Security tests that SE Labs runs are based on real attackers’ behaviour. This means we can present how we run those attacks using a MITRE ATT&CK-style format.
Endpoint Detection Compared
You can see how ATT&CK lists out the details of each attack, and how we represent the way we tested, in Appendix A: Threat Intelligence, starting on page 15. This brings two main advantages: you can have confidence that the way we test is realistic and relevant, and you’re probably already familiar with this way of illustrating cyber attacks.
EDR is more than anti-virus
An Endpoint Detection and Response (EDR) product is more than anti-virus, which is why it requires advanced testing. This means testers must behave like real attackers, following every step of an attack.
Intelligence-led testing
While it’s tempting to save time by taking shortcuts, a tester must go through an entire attack to truly understand the capabilities of EDR security products.
Each step of the attack must be realistic too. You can’t just make up what you think bad guys are doing and hope you’re right. This is why SE Labs tracks cybercriminal behaviour and builds tests based on how bad guys try to compromise victims.
SE Labs tested IronNet IronDefense against a range of hacking attacks designed to compromise systems and penetrate target networks in the same way as criminals and other attackers breach systems and networks.
How we test
Full chains of attack were used, meaning that testers behaved as real attackers, probing targets using a variety of tools, techniques and vectors before attempting to gain lower-level and more powerful access. Finally, the testers/attackers attempted to complete their missions, which might include stealing information, damaging systems and connecting to other systems on the network.
Loading…
Product factsheet:
APT groups include:
- FIN7 & Carbanak
- OilRig
- APT3
- APT29
All reports
01/2022 - 01/2022
Enterprise Advanced Security (EDR): BlackBerry Protect and Optics – PROTECTION
Advanced Security (EDR): BlackBerry Protect and Optics
SE Labs tested BlackBerry Protect and Optics against a range of hacking attacks. These were designed to compromise systems and penetrate target networks in the same way as criminals and other attackers breach systems and networks.
We used full chains of attack , meaning that our testers behaved as real attackers, probing targets using a variety of tools, techniques and vectors before attempting to gain lower-level and more powerful access. Finally, the testers/ attackers attempted to complete their missions, which might include stealing information, damaging systems and connecting to other systems on the network.
Loading…
Product factsheet:
Advanced Security (EDR): Kaspersky
SE Labs tested Kaspersky Endpoint Detection and Response against a range of hacking attacks. These were designed to compromise systems and penetrate target networks in the same way as criminals and other attackers breach systems and networks.
We used full chains of attack, meaning that our testers behaved as real attackers, probing targets using a variety of tools, techniques and vectors before attempting to gain lower-level and more powerful access. Finally, the testers/ attackers attempted to complete their missions, which might include stealing information, damaging systems and connecting to other systems on the network.
Loading…
In this report we explain the threats used and explore how the tested product interacts with them. You might notice a similarity between the way we present this information and the way that the MITRE ATT&CK framework illustrates threat chains. This is not a coincidence. Our goal is to share information in ways that are familiar and easily understandable by the security community and its customers.
Read more of our reports here.
Advanced Security (EDR): CrowdStrike
SE Labs tested CrowdStrike Falcon against a range of hacking attacks. These were designed to compromise systems and penetrate target networks in the same way as criminals and other attackers breach systems and networks.
We used full chains of attack, meaning that our testers behaved as real attackers, probing targets using a variety of tools, techniques and vectors before attempting to gain lower-level and more powerful access. Finally, the testers/ attackers attempted to complete their missions, which might include stealing information, damaging systems and connecting to other systems on the network.
Loading…
In this report we explain the threats used and explore how the tested product interacts with them. You might notice a similarity between the way we present this information and the way that the MITRE ATT&CK framework illustrates threat chains. This is not a coincidence. Our goal is to share information in ways that are familiar and easily understandable by the security community and its customers.
Read more of our reports here.
All reports
08/2021 - 08/2021
Breach Response (NDR Detection): VMware NSX Network Detection and Response 2021 Q3
SE Labs tested VMware NSX Network Detection and Response against a range of hacking attacks designed to compromise systems and penetrate target networks in the same way as criminals and other attackers breach systems and networks.
VMware NSX Breach Response Test
Full chains of attack were used, meaning that testers behaved as real attackers, probing targets using a variety of tools, techniques and vectors before attempting to gain lower-level and more powerful access. Finally, the testers/attackers attempted to complete their missions, which might include stealing information, damaging systems and connecting to other systems on the network.
Loading…
Tested products from:
APT groups include:
- FIN7 & Carbanak
- OilRig
- APT3
- APT29
SE Labs tested BlackBerry Protect and Optics in this Breach Response test. We pitted it against a range of hacking attacks designed to compromise systems and penetrate target networks. These are the same techniques criminals and other attackers use to breach systems and networks in the real world.
Breach Response Test: BlackBerry Protect
Testers used full chains of attack, meaning that they behaved as real attackers. We probed targets using a variety of tools, techniques and vectors before attempting to gain lower-level and more powerful access.
Finally, the testers/ attackers attempted to complete their missions. This might include stealing information, damaging systems and connecting to other systems on the network.
Loading…
Tested products from:
