AV-Comparatives has completed the 2026 round of its EDR Detection Validation Test, one of the most in-depth independent evaluations of enterprise detection capabilities. This year saw strong participation across the industry, underlining the growing importance of detection, visibility, and investigation capabilities in modern cybersecurity.

https://www.av-comparatives.org/news/edr-detection-validation-2026/

The test is designed to evaluate how effectively enterprise security solutions detect and expose advanced, multi-stage attacks. A total of nine products successfully achieved certification under AV-Comparatives’ rigorous and transparent methodology.

A Benchmark for Real-World Detection

As prevention alone is no longer sufficient, organizations increasingly depend on EDR, XDR, and MDR solutions to identify and investigate threats that have already bypassed initial defenses.

The EDR Detection Validation Test focuses on exactly this challenge. It provides a structured and practical evaluation of:

• detection coverage across attack stages
• quality and usability of telemetry
• clarity of alerts and correlation into meaningful incidents

The goal is not just to determine whether something is detected, but how usable that detection is in a real-world SOC environment.

Structured, Transparent, and Actionable

The 2026 test simulates a realistic Advanced Persistent Threat (APT) scenario consisting of 14 clearly defined stages, covering the full progression from initial compromise to domain-level impact.

Each step is evaluated individually, allowing analysts to understand:

• where visibility is provided
• whether detection is immediate (alert-based) or requires investigation (telemetry)
• how well the attack chain can be reconstructed

All products are configured in detection-only mode, ensuring that prevention mechanisms do not influence the results and that detection capabilities can be assessed consistently across vendors .

This structured approach provides clear and interpretable results, making it easier to understand strengths and limitations without requiring extensive interpretation.

Detection vs. Operational Reality

A key differentiator of this evaluation is its focus on operational usability, not just technical detection.

The test explicitly distinguishes between:

• Active Response (alerts) – immediate visibility
• Telemetry (threat hunting) – visibility requiring analyst investigation

In addition, dedicated Signal-to-Noise scenarios assess how products behave during benign administrative activity, helping to identify excessive or misleading alerting .

This reflects real-world SOC conditions, where both missing signals and excessive noise can significantly impact detection and response effectiveness.

Certified Products – EDR, XDR and MDR Solutions

The 2026 round demonstrated strong engagement from enterprise vendors, with a large number of products participating in the evaluation.

Out of these, nine solutions successfully achieved certification, demonstrating:

• consistent visibility across a majority of attack stages
• sufficient context to support investigation and threat hunting
• controlled and manageable alerting behaviour

The following products earned certification in the 2026 test round:

• Bitdefender GravityZone Business Security Enterprise
• ESET PROTECT Elite
• Fortinet FortiEDR
• G Data 365 | MXDR
• Genian Insights E
• Kaspersky EDR Expert (on-premises)
• ManageEngine Endpoint Central with EDR
• Palo Alto Networks Cortex XDR Pro
• Sangfor Athena AI-Native EPP

Only certified products are publicly listed. Non-certified vendors receive detailed feedback to support further development.

Designed for Analysts and Decision-Makers

A core objective of the EDR Detection Validation Test is to provide results that are directly usable for decision-making. Rather than focusing on abstract metrics or overly complex data sets, the test delivers:

• a clear step-by-step view of detection coverage
• insight into how detection information is presented
• an understanding of the effort required to investigate an attack

As shown in the Executive Summary (PDF reports, page 2), detection visibility is evaluated based on whether activities can be identified through alerts or through structured telemetry that enables investigation. This makes the results particularly valuable for SOC teams, analysts, and enterprise buyers who need practical, interpretable insights rather than theoretical performance indicators.

Continuous Evolution

One topic dominates them all: AI. Cybersecurity solutions are no exception. In fact, LLM and neural network capabilities have long been part of the vendors’ arsenal. What stood out in this test is how AI is increasingly being used not only to strengthen protection, but also to summarize detection results, make them more accessible and readable, and streamline analyst workflows. This evolution from boosting protection to maximizing usability is a natural progression, and one that is welcomed by administrators and forensic experts alike.

The EDR Detection Validation Test evolves in parallel. Continuously refined based on feedback from analysts, vendors, and enterprise users, the 2026 edition further strengthens:

• clarity of detection vs. telemetry distinctions
• focus on operational impact and analyst workload
• realism and diversity of attack scenarios

Future iterations will continue to reflect changing attacker techniques and enterprise requirements.

Conclusion

The 2026 results reinforce the importance of high-quality detection and visibility as a core capability of modern endpoint security solutions.

By combining realistic attack simulations with a structured and interpretable methodology, the EDR Detection Validation Test provides a robust and practical benchmark for evaluating detection capabilities in real-world environments.

Interested in Participating?

The EDR Detection Validation Test is open to EPP, EDR, XDR, and MDR vendors seeking independent validation of their detection capabilities. Certification offers vendors both industry recognition and deep technical insight into their solution’s real-world performance.

Contact us to participate in the next test cycle.