Endpoint Index
Research / Data report

Endpoint Security Lab Test Results by Product (October 2026)

Few small-business products face all three independent labs, and some of the best-known face none of them.

Updated · data as of · 6 min read

Contents
  1. Executive summary
  2. What does each lab say about each product?
  3. Which products have no current lab results?
  4. Why do protection scores barely separate the products?
  5. Which products raise the most false alarms?
  6. What does the MITRE result add?
  7. Is the tested product the one you would buy?
  8. How should a small business use these results?
  9. Frequently asked questions
  10. Methodology and caveats
  11. Sources

Executive summary

Only 2 of the 14 security engines behind the products Endpoint Index tracks hold a current result in all three independent labs: ESET PROTECT Core and Sophos Endpoint. At the other end, 4 engines have no current result in any of them: Huntress Managed EDR, SentinelOne Singularity Complete, ThreatDown Advanced and Webroot Business Endpoint Protection. Where products are tested, the protection scores sit close together, so the false-positive count and MITRE's first-run detection figure tell them apart better than the headline protection score does. Results were checked against each lab's own published results between 2 Oct 2026 and 10 Oct 2026.

What does each lab say about each product?

ProductAV-Test protectionAV-Comparatives protectionAV-Comparatives false positivesMITRE substeps detectedLabs with a current result
ESET PROTECT Core6.0 of 6 2025-1298.8% 2026-H1222 of 90 2025
36 not evaluated		3 of 3
Sophos Endpoint6.0 of 6 2026-0898.3% 2026-H1266 of 90 20253 of 3
Bitdefender GravityZone Business Security Premium
Also Bitdefender GravityZone Business Security		6.0 of 6 2025-1299.8% 2026-H1458 of 80 2024 Dated
1 not evaluated		2 of 3
Avast Ultimate Business Security6.0 of 6 2026-0899.0% 2026-H14Not tested2 of 3
Microsoft Defender for Business6.0 of 6 2026-0898.8% 2026-H1067 of 80 2024 Dated2 of 3
CrowdStrike Falcon GoNot tested98.5% 2026-H1889 of 90 20252 of 3
Acronis Cyber Protect6.0 of 6 2026-06Not testedNot tested26 of 90 2025
36 not evaluated		2 of 3
Cynet All-in-OneNot testedNot testedNot tested90 of 90 20251 of 3
Trend Micro Worry-Free Services AdvancedNot testedNot testedNot tested53 of 90 20251 of 3
WatchGuard Endpoint Security 360Not testedNot testedNot tested24 of 90 2025
62 not evaluated		1 of 3
SentinelOne Singularity Complete
Also SentinelOne Singularity Control		Not testedNot testedNot tested72 of 80 2024 Dated0 of 3
ThreatDown Advanced
Also ThreatDown Elite		Not testedNot testedNot tested14 of 59 2024 Dated0 of 3
Huntress Managed EDRNot testedNot testedNot testedNot tested0 of 3
Webroot Business Endpoint ProtectionNot testedNot testedNot testedNot tested0 of 3
One row per security engine: products that share an engine share its lab results. "Not tested" means no result in that lab's business tests for this engine. "Dated" means the round is more than 18 months old and no longer counts in the SMB Fit Score. MITRE counts are from its default view, the first run before any configuration change. Follow a product link for each lab's results page.

A result is current while its round is under 18 months old, the same window the SMB Fit Score uses. Older rounds stay in the table, marked "Dated", because they are still the most recent evidence for that engine. What each figure measures is explained in reading lab results.

Which products have no current lab results?

Huntress Managed EDR, SentinelOne Singularity Complete, ThreatDown Advanced and Webroot Business Endpoint Protection have no result inside the 18-month window. They fall into two groups:

  • Tested, but not recently. SentinelOne and ThreatDown took part in MITRE's 2024 round, which is now dated. SentinelOne last entered AV-Test and AV-Comparatives business testing in 2017; ThreatDown last entered AV-Comparatives in 2022.
  • Never in these tests. Huntress and Webroot do not appear in any of the three labs' business results.

A missing result doesn't mean weak protection. It means nobody outside the vendor has published a comparable measurement, so you are left with the vendor's own claims. A buyer choosing one of these products should ask the vendor for third-party test reports and read them with the same care as the tables above.

Why do protection scores barely separate the products?

Most tested products score at or near the top. Of the 6 engines with a current AV-Test result, 6 scored 6 out of 6 for protection, the highest score. In AV-Comparatives' business test, protection rates for the current results run from 98.3% to 99.8%, with Bitdefender GravityZone Business Security Premium highest.

A gap of a percentage point or two is real but small. For a small office, the more useful question is what else the result says about living with the product.

Which products raise the most false alarms?

False positives separate the tested products more than protection does. In AV-Comparatives' current business test, Microsoft Defender for Business wrongly flagged 0 clean files or sites, the fewest, and CrowdStrike Falcon Go flagged 8, the most.

A false positive in a small office means a blocked installer or a quarantined tool that someone has to release, usually without an IT department to ask. And each exclusion you add to stop it happening again leaves a hole that real malware can use too. Read the false-positive column alongside protection.

AV-Comparatives also scores performance impact. In the March to June 2026 round it listed Sophos as not approved despite 98.3% protection, because its performance impact score was 49.1 against a limit of 40.

What does the MITRE result add?

MITRE ATT&CK Evaluations run a full emulated attack rather than a set of malware files, and record which steps the product saw. Two details change how the numbers read:

  1. First run against configuration changes. MITRE's default view counts the first run. Vendors may then change settings and repeat steps, and their announcements often quote that higher figure. In the scorecard above, Sophos shows 66 of 90 for the 2025 round; with its changes it reached 90 of 90.
  2. Steps not evaluated. MITRE marks some steps N/A when they were not run for a vendor. In the 2025 round ESET had 36 and WatchGuard 62 of 90 substeps not evaluated, so their detection counts cover a smaller share of the attack.

The MITRE ATT&CK Evaluations explainer shows every participant's counts for the last two rounds.

Is the tested product the one you would buy?

Often not. The labs test a vendor's engine under an enterprise or higher tier name, and the small-business product shares that engine without being identical:

Product we track What the lab tested
CrowdStrike Falcon Go AV-Comparatives tested Falcon Enterprise; MITRE tested the Falcon platform
ESET PROTECT Core AV-Test tested PROTECT Advanced; AV-Comparatives tested PROTECT Entry; MITRE tested ESET's detection and response platform, which Core does not include
WatchGuard Endpoint Security 360 MITRE tested Advanced EPDR, now Endpoint Security Elite, a higher tier
Trend Micro Worry-Free MITRE tested Trend's platform under the name TrendAI

Protection from the shared engine carries over. Detection and response results do not carry over to a tier that has no detection and response features, which is why a MITRE result says little about ESET PROTECT Core or CrowdStrike Falcon Go, neither of which includes EDR.

How should a small business use these results?

  1. Check that a result exists and is current. A product with no result in any lab asks you to trust the vendor.
  2. Read false positives next to protection. Small differences in protection matter less than a product that keeps blocking your own software.
  3. Use MITRE only for products that include EDR, and read the first-run figure.
  4. Check the tier. Make sure the tested product has the features you are paying for.
  5. Then compare price and fit. Lab results are one part of the SMB Fit Score, worth 35% of it; the price index and the rankings cover the rest.

Frequently asked questions

Which endpoint security product has the best lab results?

ESET PROTECT Core and Sophos Endpoint are the only engines with a current result in all three labs. On AV-Comparatives protection alone, Bitdefender GravityZone Business Security Premium scored highest at 99.8%, and in MITRE's 2025 round Cynet detected 90 of 90 substeps on the first run.

Does SentinelOne take part in independent lab tests?

Not in AV-Test or AV-Comparatives business testing since 2017. SentinelOne took part in MITRE's 2024 round, detecting 72 of 80 substeps on the first run, but did not enter the 2025 round, so that result is now dated.

Is a 6 out of 6 AV-Test score good?

It is the top protection score, and most tested business products reach it. It tells you the product blocked the test's malware, not how it compares with rivals that also scored 6, so look at false positives and the other labs.

What is a good false positive count in AV-Comparatives?

Fewer is better, and the products in the current business test range from 0 to 8. A count near the top of that range means more legitimate files or sites blocked in a typical office.

Why are some well-known products missing from the labs?

These are not mandatory certifications: a vendor can decline to enter, and each lab tests a limited number of products per round. Huntress and Webroot have no results in these business tests; SentinelOne and ThreatDown have only dated ones.

Can I use this data?

Yes. The lab columns are in the Endpoint Index dataset as CSV and JSON under CC BY 4.0, with one row per product, the round of each result and the MITRE counts.

Methodology and caveats

Each result is the most recent business-product round that names the vendor's engine, taken from the lab's own results page and checked by hand. AV-Test results are from its Windows business tests, AV-Comparatives results from its Business Security Test, and MITRE results from its Enterprise evaluations, counted from the data behind MITRE's results pages in its default view (first run, before configuration changes). Products that share an engine share one row. A result is current for 18 months after its round. The labs test under their own conditions and sample sets; a result describes the product as tested on those dates, not every configuration a small business might run.

Sources

Related research

All research ›
REFERENCEMITRE ATT&CK Evaluations Explained (October 2026)DATA REPORTThe best EDR for a small business, judged on price, lab and contract data

Methodology · Report an error · Vendor not listed? Get listed