AV-Comparatives has released the results of its
2026 Endpoint Prevention and Response (EPR) Test, providing enterprises with transparent insights into the prevention, detection, and response capabilities of leading enterprise security solutions.
Read the full report (PDF) here:
https://www.av-comparatives.org/wp-content/uploads/2026/09/EPR_Comparative_2026.pdf
av-comparatives.org
Hi, this is a particularly useful EPR test because it evaluates complete, multi-stage attack chains rather than isolated malware samples. The headline is that 11 of 14 tested enterprise products earned
Certified Leader status, although certification should not be mistaken for a ranking in which all 11 performed identically.
What was tested
AV-Comparatives ran
50 targeted attack scenarios, each split into three phases and mapped to MITRE ATT&CK Enterprise. The scenarios included phishing, abuse of legitimate tools, lateral movement and data exfiltration.
Both
Active Response (prevention) and
Passive Response (detection) were assessed as attacks progressed. Certification required an average of at least
92% across Active and Passive Response, together with low operational impact suitable for enterprise deployment.
The test therefore answers a broader question than a conventional malware-protection test: can the product interrupt an attack, and can it still provide useful visibility when prevention does not stop everything?
[1] [2]
Certified products and results
The report lists these tested editions and results. The percentage columns below reproduce the report’s Active Response, Passive Response and combined average values; they are not consumer antivirus detection rates.
| Product (tested version) | Active | Passive | Average |
|---|
| Bitdefender GravityZone BSE 8.26 | 100% | 99.3% | 99.7% |
| Broadcom Symantec ESC 16.0 | 98.0% | 98.7% | 98.3% |
| Check Point Endpoint Security Advanced 89.10 | 96.0% | 96.7% | 96.3% |
| Elastic Security 9.4 | 100% | 100% | 100% |
| ESET PROTECT Enterprise Cloud 7.1 | 98.7% | 99.3% | 99.0% |
| Fortinet FortiEndpoint with EDR Essentials 6.2 | 97.3% | 100% | 98.7% |
| G Data XDR 1.0 | 94.0% | 93.3% | 93.7% |
| Palo Alto Networks Cortex XDR Prevent 9.1 | 98.0% | 98.0% | 98.0% |
| TrendAI Vision One Endpoint Security Essentials 14.0 | 94.0% | 98.0% | 96.0% |
| VIPRE Endpoint Detection & Response 13.4 | 100% | 99.3% | 99.7% |
| WithSecure Elements XDR 26.2 | 96.0% | 98.7% | 97.3% |
Elastic achieved 100% in all three reported response measures. Bitdefender and VIPRE followed at 99.7%, while ESET reached 99.0%. Those are strong results, but small differences at this level should not decide a deployment by themselves.
[2]
How enterprises should read it
Three additional products failed to meet the certification requirements and exercised the report’s option to remain anonymous as Vendor A, B and C. Consequently, the published table cannot be used to identify or avoid those vendors.
For a shortlist, the response scores are a good starting point—not the finish line. A proof of concept should also examine:
- alert quality and investigation context;
- response controls and their effect on business systems;
- integration with the organisation’s identity, SIEM and ticketing stack;
- management effort, analyst skills and licensing cost;
- operational impact on the organisation’s own endpoints and workloads.
In short, Elastic produced the cleanest test result, but the best operational choice could still be another Certified Leader that fits an organisation’s existing infrastructure and security team better. An EDR console that nobody can operate at 3 a.m. is an expensive ornament.
[1] [2]
Sources
- Endpoint Prevention & Response (EPR) Test 2026 - AV-Comparatives
- (PDF) Endpoint Prevention and Response EPR Comparative Report 2026
