2026 AV-Comparatives EPR Test Results Released

av-comparatives.org

2026 AV-Comparatives EPR Test Results Released

First seen 15 Sep 2026, 07:51 UTC • •42.8

Article Content

1 / 7

Browse articles

ThreatCluster •September 16, 2026 at 07:22 UTC

•11 out of 14 products passed the 2026 EPR Test, achieving Certified Leader status.
•The test included 50 realistic multi-stage attack scenarios, reflecting current threat tactics.
•AI-assisted techniques were used to develop testing tools and scenarios, enhancing realism.

AV-Comparatives published the results of its 2026 Endpoint Prevention and Response (EPR) Test, evaluating 14 enterprise security products against 50 multi-stage attack scenarios. The test, which ran from May to August 2026, incorporated AI-assisted techniques and followed the MITRE ATT&CK framework. Eleven products achieved Certified Leader status, demonstrating strong performance in preventing, detecting, and responding to complex cyberattacks. The scenarios simulated real-world attack chains including phishing, lateral movement, and data exfiltration. The certification bar was raised from 90% to 92%, reflecting the evolving threat landscape. The tested products included solutions from vendors like Bitdefender, Check Point, and Palo Alto Networks. The results indicate that effective EPR solutions are available to combat modern threats. The report emphasizes the importance of adapting to emerging attacker capabilities.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 50d ago How this analysis works

Timeline

2026-05-01

EPR Test evaluation begins

AV-Comparatives started testing 14 enterprise security products against various attack scenarios.

AV-Comparatives

2026-08-31

EPR Test evaluation ends

The testing phase concluded, with results compiled for publication.

AV-Comparatives

2026-09-15

EPR Test results published

The results of the 2026 EPR Test were officially released, highlighting the performance of tested products.

AV-Comparatives

More articles in this cluster (6)

Threat Graph

16 entities, 57 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Threat Actor (8)

APT28
APT29
FIN7
Kimsuky
Lazarus
WannaCry
Black Basta
Lockbit

Technique (6)

Phishing
Ransomware
Zero-day Exploit
T1021 - Remote Services
T1068 - Exploitation for Privilege Escalation
T1566 - Phishing

Organization (1)

Stryker

Tool (1)

Claude Code

Relationships

APT28 uses Claude Code
APT29 uses Claude Code
FIN7 uses Claude Code
Kimsuky uses Claude Code
Lazarus uses Claude Code
WannaCry uses Claude Code
Black Basta uses Claude Code
Lockbit uses Claude Code
APT28 uses Phishing
APT28 uses Ransomware
APT28 uses Zero-day Exploit
APT28 uses T1021 - Remote Services
APT28 uses T1068 - Exploitation for Privilege Escalation
APT29 uses Phishing
APT29 uses Ransomware
APT29 uses Zero-day Exploit
APT29 uses T1021 - Remote Services
APT29 uses T1068 - Exploitation for Privilege Escalation
FIN7 uses Phishing
FIN7 uses Ransomware
FIN7 uses Zero-day Exploit
FIN7 uses T1021 - Remote Services
FIN7 uses T1068 - Exploitation for Privilege Escalation
Kimsuky uses Phishing
Kimsuky uses Ransomware
Kimsuky uses Zero-day Exploit
Kimsuky uses T1021 - Remote Services
Kimsuky uses T1068 - Exploitation for Privilege Escalation
Lazarus uses Phishing
Lazarus uses Ransomware
Lazarus uses Zero-day Exploit
Lazarus uses T1021 - Remote Services
Lazarus uses T1068 - Exploitation for Privilege Escalation
WannaCry uses Phishing
WannaCry uses Ransomware
WannaCry uses Zero-day Exploit
WannaCry uses T1021 - Remote Services
WannaCry uses T1068 - Exploitation for Privilege Escalation
Black Basta uses Phishing
Black Basta uses Ransomware
Black Basta uses Zero-day Exploit
Black Basta uses T1021 - Remote Services
Black Basta uses T1068 - Exploitation for Privilege Escalation
Lockbit uses Phishing
Lockbit uses Ransomware
Lockbit uses Zero-day Exploit
Lockbit uses T1021 - Remote Services
Lockbit uses T1068 - Exploitation for Privilege Escalation
APT28 targets Stryker
APT29 targets Stryker
FIN7 targets Stryker
Kimsuky targets Stryker
Lazarus targets Stryker
WannaCry targets Stryker
Black Basta targets Stryker
Lockbit targets Stryker
APT28 related to T1566 - Phishing

Following this threat?

Track WannaCry, APT28 and Stryker in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

North Korean Hackers Steal $6.3 Billion from Binance in Record Cyber Heist On October 29, 2026, Binance, the world's largest cryptocurrency exchange, suffered a massive cyberattack attributed to North Korean hackers known as TraderTraitor, resulting in the theft of approximately $6.3 billion in digital assets. The attackers exploited vulnerabilities in Binance's hot wallet system, allowing…

Binance Hack: $6.3 Billion Stolen by North Korean Group On October 30, 2026, hackers stole $6.3 billion in tokens from Binance, the world's largest crypto exchange. The attack is attributed to a North Korean hacking group known as TraderTraitor. The hackers executed the theft by quickly moving tokens, with the entire amount withdrawn within half an hour. Binance has…