AV-TEST Advanced Endpoint Protection: Fileless Threats

[aliali]

https://www.av-test.org/fileadmin/pdf/reports/AV-TEST_Kaspersky_Fileless_Malware_Test_Report_2019-09_EN.pdf

 

[upnorth]

The products of Carbon Black, CrowdStrike, Palo Alto and SentinelOne are listed as “Vendor A” to “Vendor D” (in random order) due to restrictions of their results publication.

 

[shmu26]

Sophos, after all their claims to advanced exploit protection, scored very low. 50% protection rate.

 

[Thales]

Kaspersky is still good.

 

[shmu26]

Kaspersky is still good.

It's not good, it's the best.

 

[[correlate]]

But who is Vendor D !

 

[Andy Ful]

From the report:
"The products of Carbon Black, CrowdStrike, Palo Alto and SentinelOne are listed as “Vendor A” to “Vendor D” (in random order) due to restrictions of their results publication. The products were tested in default configuration."

The report hid the concrete results for some vendors, and the test was performed for AVs on default settings. Many AVs do not apply the protection for the fileless threats by default.

 

[Andy Ful]

The results are similar (except Sophos) to The Forrester Wave™: Endpoint Security Suites, Q3 2019.