AV-Comparatives has released the results of its 2026 Endpoint Prevention and Response (EPR) Test, providing enterprises with transparent insights into the prevention, detection, and response capabilities of leading enterprise security solutions.

Read the full report (PDF) here: https://www.av-comparatives.org/wp-content/uploads/2026/09/EPR_Comparative_2026.pdf

AV-Comparatives Announces Endpoint Prevention and Response (EPR) Test 2026 Results

AV-Comparatives is pleased to announce the publication of the 2026 Endpoint Prevention and Response (EPR) Test. This annual assessment is a demanding evaluation of enterprise security solutions, designed to measure how effectively products prevent, detect, and respond to complex, multi-stage cyberattacks.

The 2026 evaluation consisted of 50 targeted attack scenarios, each divided into three distinct phases. The scenarios reflected realistic attack chains and incorporated techniques including phishing, lateral movement, data exfiltration, and the abuse of legitimate system tools. The attacks were mapped to the MITRE ATT&CK® Enterprise framework. 

The 2026 test introduced more challenging attack scenarios and techniques. As part of the development process, AV-Comparatives also used AI-assisted techniques in the creation of testing tools and scenario variations, helping to reflect emerging attacker capabilities and evolving attack patterns.

AV-Comparatives’ Certified EPR Leaders in 2026

Of the 14 products evaluated, 11 achieved EPR certification and Certified Leader status, demonstrating strong performance across Active and Passive Response while maintaining a low overall operational impact. 

The following vendors achieved Certified Leader status in the 2026 EPR Test:

• Bitdefender
• Broadcom
• Check Point
• Elastic
• ESET
• Fortinet
• G Data
• Palo Alto Networks
• TrendAI
• VIPRE
• WithSecure

Three additional tested products did not meet the certification requirements and chose to remain anonymous.

To achieve certification, products were required to reach an average score of at least 92% across Active and Passive Response, while also maintaining a low operational impact suitable for enterprise-scale deployments. Products meeting these requirements are recognised as Certified Leaders within the Enterprise CyberRisk Quadrant.

“Enterprise attacks continue to evolve, and security products need to demonstrate that they can handle complex, multi-stage threats under realistic conditions,” says Andreas Clementi, CEO and founder of AV-Comparatives. “The 2026 EPR Test introduced more challenging attack scenarios and techniques, while AI-assisted methods were also used in developing testing tools and scenario variations. Eleven products achieved certification, demonstrating the strong level of enterprise protection available today.”

Why EPR Matters

Modern cyberattacks rarely consist of a single malicious file or isolated action. Attackers may combine phishing, legitimate system tools, privilege escalation, lateral movement, and data exfiltration as part of a multi-stage attack chain.

Endpoint Prevention and Response solutions therefore need to do more than identify known threats. Effective EPR products should prevent attacks where possible, while providing security teams with the detection and response capabilities needed to investigate and contain threats when prevention alone is not sufficient.

Realistic and Transparent Testing

The AV-Comparatives EPR Test evaluates products against complete attack scenarios rather than isolated malware samples. Each of the 50 scenarios is divided into multiple phases, allowing AV-Comparatives to assess both Active Response (Prevention) and Passive Response (Detection) throughout the progression of an attack.

The scenarios are based on techniques and tactics from the MITRE ATT&CK® Enterprise framework and are designed to reflect the complex attack chains faced by modern organisations.

In addition to technical effectiveness, the 2026 evaluation considers the operational impact associated with deploying an EPR solution. The Enterprise CyberRisk Quadrant combines prevention and response effectiveness with factors including operational accuracy, workflow delays, estimated breach impact, and standardised product pricing inputs.

Product pricing represents only one standardised modelling input. The operational impact model is designed to enable consistent comparison between products and should not be interpreted as representing actual enterprise contract pricing or individual deployment costs.

The Enterprise CyberRisk Quadrant

The Enterprise CyberRisk Quadrant provides an overview of how the tested products combine prevention and response effectiveness with their modelled operational impact.

Rather than serving as a precise ranking, the Quadrant helps enterprises understand the relative positioning of the tested solutions across these dimensions. Small differences in the position of Certified Leaders should not be overinterpreted, as all certified products have already demonstrated a high level of prevention, detection, and response effectiveness.

Supporting Enterprise Security Decisions

The EPR Test is designed to help organisations make informed decisions when evaluating enterprise security solutions. Certification identifies products that have demonstrated strong prevention and response capabilities while maintaining an operational impact appropriate for enterprise environments.

The 11 Certified Leaders in the 2026 EPR Test have successfully met AV-Comparatives’ certification requirements across demanding, realistic attack scenarios, providing enterprises with a strong selection of independently evaluated security solutions.

For full details, methodology, the Enterprise CyberRisk Quadrant, and individual product results, read the complete AV-Comparatives EPR Comparative Report 2026.