Everyone tells you that you need it, but which one?
Classic cybersecurity advice always includes a plea to, “install anti-virus” or “use endpoint protection software”. Journalists, bloggers and even governments hand this information out, as if it helps. Most platforms, including Microsoft Windows and Apple macOS, include anti-virus so the question then becomes, “which anti-virus?”
We compare endpoint security products directly using real, major threats.
Welcome to the first edition of the Enterprise Advanced Security test that compares different endpoint security products directly. We look at how they handle the major threats that face all businesses, from the Global 100, down to medium enterprises. And most likely small businesses, too.
Choose the best enterprise endpoint security solution
We give an overall score but also dig down into the details that your security team will care about. This report explains the different levels of coverage that these products provide.
At SE Labs we are often asked, “which is the best anti-virus for the Mac?” And, “do you need anti-malware for MacBooks?” For reasons we’ll explain, we’ve not published an endpoint security report for Mac-based products (yet).
But we do have an insight into how Mac threats work and how Apple tries to protect users. In this article we cover everything you need to know.
Understand cybersecurity testing with visible threat intelligence.
An Endpoint Detection and Response (EDR) product is more than anti-virus, which is why it requires advanced testing. This means testers must behave like real attackers, following every step of an attack.
Intelligence-led testing
While it’s tempting to save time by taking shortcuts, a tester must go through an entire attack to truly understand the capabilities of EDR security products.
Each step of the attack must be realistic too. You can’t just make up what you think bad guys are doing and hope you’re right. This is why SE Labs tracks cybercriminal behaviour and builds tests based on how bad guys try to compromise victims.
Cyber criminals often use email as a way to start an attack. According to many sources email is by far the most common way that attackers try to gain access to your business and personal systems.
The reports below contain security testing results. You can compare the performance of a variety of products that claim to protect you against online threats. This, in theory, will help individuals and businesses choose the best security product.
Rules of engagement
But these are free reports. How can you trust that the high-scoring vendors didn’t just pay for their ranking? Do you suspect that some low-scoring vendors dropped out of the report? Or asked to be retested until they scored better?
What are the rules behind the scenes in security testing?
SE Labs tested IronNet IronDefense against a range of hacking attacks.
The SE Labs Enterprise Advanced Security test is compatible with a wide range of security products and services. This includes NDR. Our latest network detection report is now available!
IronNet IronDefense vs. APTs
Our targeted attack testing is compatible with the MITRE ATT&CK framework, which means we based our work on the industry standard way to illustrate attacks.
Endpoint protection against different types of attacker tested.
Our reports are based on ‘testing security from zero to Neo’. Their wide scope helps you choose the best anti-malware product, that can protect you from ransomware and other types of attack.
Targeted attacks come in all levels of sophistication
There seems to be no limit to the powers of cyber criminals. In 2021 the public became aware of the advanced capabilities of the NSO group, now infamous for helping governments spy on dissidents and others.
Ransomware is causing all the rage right now. That’s why we’ve tested products that offer protection from ransomware.
It’s the type of threat that gets attention because a successful attack is extremely visible (the attacker needs you to know it’s worked, or you won’t pay!) Also, there is a direct and substantial cost attached to it. In addition to paying security specialists to help, there’s a fat ransom demand sitting on your screen.
Ransomware isn’t subtle
While much hacking is subtle, stealing information silently, ransomware is in your face. It stops businesses in their tracks. It gets the attention of the finance directors. It provides powerful ammunition to security teams arguing for more resources. And, of course, it makes headlines.
SE Labs launches first public Network Detection and Response test
SE Labs tested VMware NSX Network Detection and Response against a range of hacking attacks designed to compromise systems and penetrate target networks in the same way as criminals and other attackers breach systems and networks.
Full attack chain test in the datacentre
By running the most realistic set of attacks possible we put NDR products to a significant challenge. Can they detect real attacks in real-time, often using unique scripts and malware? If you want to know more about advanced persistent threats on the network please read past the initial graphs in this report and dig into the detail.
Archive of security product and service test results
Cyber Security DE:CODED Podcast
All of our podcast episodes and related content
About
SE Labs Ltd is a private, independently-owned and run testing company that assesses security products and services. The main laboratory is located in Wimbledon, South London. It has excellent local and international travel connections. The lab is open for prearranged client visits.