Endpoint IndexMethodology
Endpoint Index is a structured database of endpoint security products for small and mid-size businesses.
Contents
Every data point is sourced, dated and verifiable. This page sets out how we collect data, how the SMB Fit Score is calculated, and how sponsorship is kept away from both.
How we collect data
We source facts from five tiers. Only the first three contribute to the Fit Score.
| Source tier | Description | Used in Fit Score? |
|---|---|---|
| The vendor's own product page | Published feature lists, specifications, and documentation on the vendor's domain | Yes |
| The vendor's pricing calculator | Price captured from the vendor's online pricing tool, with a dated record kept of every capture | Yes |
| Independent test labs | AV-Test, AV-Comparatives and MITRE ATT&CK Evaluations, all independent third-party testing organisations | Yes |
| Vendor press releases | Announcements or blog posts published by the vendor. Shown on the page, not scored | No |
| Third-party sites | Review aggregators, analyst reports or other non-vendor sources. Shown on the page, not scored | No |
Every sourced value carries a link to the source page, the tier it came from, and the date we last verified it. If we cannot verify a value from one of the three scored tiers, it contributes zero to the Fit Score and the product page shows a label saying why.
Verification cadence
- Every verification date must be within 90 days. A value older than 90 days flags the product as stale, and a stale product cannot receive a comparison verdict until it is re-verified.
- An automated check runs every week. It fetches each source page, detects changes and flags them for human review. Prices are never updated automatically.
SMB Fit Score
The SMB Fit Score measures how well a product fits a small-business buyer, using publicly verifiable evidence: independent lab testing, published pricing, operational requirements and capability coverage. It is not a measure of absolute product quality or security effectiveness. A product with strong protection but no independent test results, or no published price, will score lower on those components.
The score is a number from 0 to 100, produced by a published formula. There is no hidden editorial weighting. Every input, its value, its points and the total are shown on every product page.
| Component | Weight | How it is scored |
|---|---|---|
| Efficacy | 35 | AV-Test protection score (0 to 6, scaled to 0 to 15 points). AV-Comparatives protection rate: 99.5% and above = 10 points; 99.0% and above = 7 points; below 99.0% = 3 points. MITRE participation with 90% or higher analytic coverage = 10, participated without coverage data = 5, none = 0. No public results = 0 with a label. |
| Price transparency and level | 25 | Published price = 10 points; quote-only = 0. Then cost per unit per year: $36 or less = 15; above $36 to $72 = 10; above $72 to $120 = 6; above $120 = 2. |
| SMB operability | 25 | Self-serve purchase = 8; no in-house security staff needed = 7; minimum seats 5 or fewer = 5; setup 4 hours or less = 5. |
| Coverage breadth | 15 | 1 point per included capability (max 15); capabilities available as a paid add-on = 0.5. 13 capabilities tracked. |
Total: 0 to 100. Displayed as an integer with a one-line explanation. The score version (fit-v1) is shown next to the score; changing the formula bumps the version and appears in the changelog.
Why these weights
The weights follow from what the score is for: helping a small business choose a product it can buy, run and afford, using evidence anyone can check. It is not a ranking of absolute protection.
- Efficacy (35) carries the most weight because blocking threats is the reason to buy endpoint security at all. It is capped at 35 because it can only measure products that enter independent tests, and a strong product with no public results scores zero here.
- Price (25) covers two things a small buyer meets before anything else: whether the price is published at all, and what it costs per endpoint. A quote-only product cannot be compared on cost before a sales call.
- Operability (25) has the same weight as price because a product a small business cannot buy without a sales process, cannot run without security staff, or cannot start below a large seat minimum is a poor fit whatever it scores in a lab.
- Coverage (15) is the smallest component. It counts included capabilities, and a longer feature list matters less to a small buyer than whether the core protection works and the product can be run in-house.
These are judgements, not findings. They are published so anyone can disagree with them, and the product page shows every component's points so a reader can reweight the score for their own situation. Any change to the weights bumps the score version and is logged in the changelog.
Lab result freshness
A lab result only earns Fit Score points if its test round is within 18 months of today. Older results still appear on the product page for reference, with a "dated" label, and contribute zero to the score. The score should reflect how the product performs in current independent testing, not in a round run against an older version of it.
AV-Comparatives scoring boundaries
The AV-Comparatives protection rate maps to points using these exact boundaries:
- 99.5% and above: 10 points
- 99.0% and above: 7 points
- below 99.0%: 3 points
A product with 98.8% protection rate scores 3 points (falls in the "below 99.0%" bracket).
Capability states
Every capability uses one of four states, never free-form text:
- Included: part of the base licence at the listed price
- Add-on: available for an additional fee
- Not offered: not available at this product tier
- Unknown: not yet verified (a product cannot be published with this state in any scored field)
How sponsorship works
Paid placement cannot change a product's score, ranking, inclusion, comparison verdict or editorial text. Sponsors buy a labelled placement outside the ranking.
Commercial data (Claimed, Featured and Category Sponsor status) is stored separately from product data. The scoring and ranking system only reads product and lab data; it never sees commercial fields. Every build checks this automatically and fails if the scoring code references commercial data.
Sponsorship
- No affiliate links: links to vendors go straight to the vendor's site, and we earn no commission on purchases.
- Featured and Category Sponsor: labelled placements on category pages, above and outside the ranked table; a Category Sponsor also appears in the labelled sponsored slot on the homepage and research articles. Never counted in the ranking and never on product reports. See the rate card.
- Claimed listings: a paid verified-vendor badge and a vendor profile labelled "From the vendor". Product data still needs a public source, and claiming never affects data, scores or rankings.
- What sponsors cannot buy: changes to data, scores, rankings or editorial judgements. The methodology, every source link and the Fit Score formula are public. Full rules: editorial policy.
Category rules
- Antivirus (EPP): the product does not include endpoint detection and response
- EDR: the product includes endpoint detection and response
- EDR with managed response: the product includes both EDR and managed detection and response
A product tier that changes any capability from its parent tier is listed as a separate product.