AVLab.pl Detailed EDR-XDR Solutions Overview 2025, 3rd Edition

[Adrian Ścibor]

Hi Community!

We have just published our latest comparison of nine EDR and XDR solutions, and I think it's worth taking a look.

• Bitdefender GravityZone XDR
• Check Point Harmony Endpoint Advanced + EDR
• Cisco AMP + XDR
• Elastic Security XDR
• Metras (part of Site)
• ThreatDown + EDR (by Malwarebytes)
• Sophos Intercept X Advanced + XDR
• WithSecure Elements EDR
• Xcitium XDR

1. The document contains detailed information about the configuration used (usually default + hardened). In our test, we do not disable AV protection to reflect the use of the solution in a production environment.

2. We analyze attack response and information logging to the console.

3. This year, we have used two certification thresholds: GOLD and CERTIFIED.

EDR-XDR Solutions Overview-2025, 3rd Edition

EDR-XDR 2025 overview: key features, detection results, and vendor comparison in one clear report.

avlab.pl

 

[rashmi]

Why does Xcitium show 11/12 "Attacks Passed" with no "No Evid" results?

 

[Adrian Ścibor]

Why does Xcitium show 11/12 "Attacks Passed" with no "No Evid" results?

Thanks, it is an editor mistake. The Xcitium blocked all attacks. I'll fix that immediately.

 

[simmerskool]

@Adrian Ścibor maybe I missed it between the lines (or skimmed too fast) why eg Harmony "certified" while eg ThreatDown is "gold" - please a short reply how they differed?

 

[Adrian Ścibor]

@Adrian Ścibor maybe I missed it between the lines (or skimmed too fast) why eg Harmony "certified" while eg ThreatDown is "gold" - please a short reply how they differed?

Of course!

I marked it in the attached file for the “Silent ISO - Hidden Payload” attack. In this attack, according to Check Point, not all stages of the attack were detected, which is why it received “partial visibility of the attack in telemetry.”

The attack was noticed, but not in its entirety, unlike ThreatDown.

 

[Adrian Ścibor]

If anyone has any doubts about the methodology used or the legend, perhaps it is not clear or understandable enough, please let us know!

We will consider whether to change anything in the next edition

 

[simmerskool]

Of course!

I marked it in the attached file for the “Silent ISO - Hidden Payload” attack. In this attack, according to Check Point, not all stages of the attack were detected, which is why it received “partial visibility of the attack in telemetry.”

The attack was noticed, but not in its entirety, unlike ThreatDown.

Thanks@ Very helpful focus (for me).