# MITRE ATT&CK Evaluations Explained (October 2026) *MITRE ranks nobody, so before you believe a vendor's 100%, check the first run, the steps not evaluated and which product was tested.* > A plain-English guide to MITRE ATT&CK Evaluations (Enterprise): what the test does, how detection categories and configuration changes work, why vendor claims differ from MITRE's own results view, and the first-run detection counts for every participant in the 2024 and 2025 rounds. Endpoint Index research (Reference). Published 2026-10-10, updated 2026-10-10, data as of 2026-10-02. Source: https://endpointindex.com/research/mitre-attack-evaluations-explained/ ## Executive summary **MITRE ATT&CK Evaluations are public tests in which MITRE runs an emulated real-world attack against each participating security product and records, step by step, whether the product raised an alert.** MITRE does not score or rank the participants. In the latest published round, Enterprise 2025 (published 10 Dec 2025), 11 vendors took part and 2 detected all 90 substeps on the first run. The figure vendors advertise is often a different count from the one MITRE shows by default, so check the first run, the steps marked not evaluated and which product was tested. ## What do MITRE ATT&CK Evaluations test? MITRE, the US not-for-profit that maintains the ATT&CK catalogue of attacker techniques, plays the part of a named threat group inside a test network and records what each security product reports. Each attack is broken into steps and substeps, and each substep is one technique, such as stealing credentials or moving to another machine. The 2025 round used two emulations: Scattered Spider, a cybercrime group known for social engineering, and Mustang Panda, a China-based espionage group. MITRE describes the round as focused on cloud-based attacks and the abuse of legitimate tools. The 2024 round emulated ransomware groups (CL0P and LockBit) and a macOS attack attributed to North Korea (DPRK). MITRE also runs protection tests and a false-positive test. This page counts the detection results, the ones vendors quote. ## How do you read a MITRE result? Every substep gets one result for each vendor. These are MITRE's categories for the 2025 round: | Result | What MITRE means by it | |---|---| | Technique | An alert that names the specific ATT&CK technique being used. The most useful result for whoever investigates. | | Tactic | An alert that names the attacker's goal (for example, credential access) but not the technique. | | General | An alert that flags the activity as suspicious or malicious without naming the tactic or technique. | | None | The step ran and the product raised no alert. Activity it recorded but did not flag does not count. | | N/A | Not evaluated: MITRE did not run the step for that vendor, because of "technical limitations, environmental constraints, or platform exclusions". | Endpoint Index counts a substep as detected when it scored Technique, Tactic or General, and reports it as a count ("89 of 90") rather than a rank. Two more details matter: - **First run against configuration changes.** After the first run, a vendor may change its settings and run steps again. MITRE's default results view shows the first run; the results after changes are shown separately. A product that only detects after changes was not configured to detect it on the day. - **Not evaluated is not the same as missed.** A vendor with many N/A steps was tested on less of the attack. Compare detected steps with the steps evaluated as well as with the total. ## What were the 2025 MITRE results?

Participant	Substeps detected, first run	At technique level	Not evaluated	Detected after configuration changes
Cynet We track Cynet All-in-One	90 of 90 100.0%	90	0	90 of 90
Cybereason	90 of 90 100.0%	89	0	90 of 90
CrowdStrike We track CrowdStrike Falcon Go	89 of 90 98.9%	89	0	90 of 90
Sophos We track Sophos Endpoint	66 of 90 73.3%	57	0	90 of 90
AhnLab	64 of 90 71.1%	23	0	69 of 90
TrendAI We track Trend Micro Worry-Free Services Advanced	53 of 90 58.9%	51	0	87 of 90
WithSecure	35 of 90 38.9%	17	0	67 of 90
Acronis We track Acronis Cyber Protect	26 of 90 28.9%	12	36	37 of 90
WatchGuard We track WatchGuard Endpoint Security 360	24 of 90 26.7%	19	62	27 of 90
ESET We track ESET PROTECT Core	22 of 90 24.4%	16	36	36 of 90
Cyberani	22 of 90 24.4%	10	37	42 of 90

MITRE ATT&CK Evaluations Enterprise 2025 (published 10 Dec 2025), detection scenarios Scattered Spider and Mustang Panda. Counted from MITRE's published results, checked 10 Oct 2026. MITRE does not rank or score participants; the order here is substeps detected in the first run.

Cynet and Cybereason detected every substep on the first run, and CrowdStrike missed one. Further down, several vendors detected far more after configuration changes than on the first run: Sophos went from 66 of 90 to 90 of 90, and Trend (tested as TrendAI) from 53 of 90 to 87 of 90. ESET, Acronis and WatchGuard had many substeps not evaluated, so their counts describe a smaller part of the attack. Microsoft, SentinelOne, Bitdefender and ThreatDown did not take part in this round. ## What were the 2024 MITRE results?

Participant	Substeps detected, first run	At technique level	Not evaluated	Detected after configuration changes
Palo Alto Networks	80 of 80 100.0%	80	0	80 of 80
Cybereason	79 of 80 98.8%	79	1	79 of 80
Cynet We track Cynet All-in-One	77 of 80 96.2%	77	3	77 of 80
SentinelOne We track SentinelOne Singularity Complete and SentinelOne Singularity Control	72 of 80 90.0%	72	0	80 of 80
Microsoft We track Microsoft Defender for Business	67 of 80 83.8%	57	0	78 of 80
Sophos We track Sophos Endpoint	67 of 80 83.8%	57	0	79 of 80
Bitdefender We track Bitdefender GravityZone Business Security Premium and Bitdefender GravityZone Business Security	58 of 80 72.5%	49	1	73 of 80
Trellix	54 of 80 67.5%	44	7	67 of 80
TrendAI We track Trend Micro Worry-Free Services Advanced	49 of 80 61.3%	41	0	79 of 80
Check Point	46 of 59 78.0%	45	4	57 of 59
WatchGuard We track WatchGuard Endpoint Security 360	40 of 59 67.8%	26	3	47 of 59
ESET We track ESET PROTECT Core	38 of 80 47.5%	28	0	49 of 80
WithSecure	38 of 80 47.5%	23	0	59 of 80
Tehtris	37 of 80 46.2%	18	0	40 of 80
HarfangLab	30 of 80 37.5%	21	0	71 of 80
AhnLab	28 of 59 47.5%	22	0	56 of 59
Qualys	22 of 59 37.3%	9	14	54 of 59
ThreatDown We track ThreatDown Advanced and ThreatDown Elite	14 of 59 23.7%	12	0	50 of 59
Cisco	13 of 59 22.0%	7	3	17 of 59

MITRE ATT&CK Evaluations Enterprise 2024 (published 11 Dec 2024), detection scenarios DPRK, CL0P and LockBit. Counted from MITRE's published results, checked 10 Oct 2026. MITRE does not rank or score participants; the order here is substeps detected in the first run.

The 2024 round had three detection scenarios. The DPRK scenario ran on macOS, and vendors that did not enter it were evaluated on the other two only, which is why some rows have fewer substeps. Microsoft, SentinelOne and Bitdefender all took part here and not in 2025, so for them this is the most recent MITRE result. It is now older than 18 months, which is why it no longer counts in the [SMB Fit Score](/methodology/). ## Why do vendor claims differ from MITRE's results? When a vendor announces "100% detection" and MITRE's table shows less, the vendor is counting something narrower or later than the default view. The common differences: 1. **Results after configuration changes.** CrowdStrike detected 89 of 90 substeps on the first run of the 2025 round and 90 of 90 including changes. Both are true; only the first is what the product did as configured. 2. **One scenario rather than the whole round.** A vendor can be perfect in one emulation and not the other. 3. **Protection results quoted as detection.** Blocking an attack and alerting on each step are scored separately. 4. **Counting coverage of evaluated steps only.** Leaving out N/A steps raises the percentage. None of these is dishonest in itself. They answer different questions. Ask which count a claim uses before comparing it with another vendor's. ## Does a MITRE result apply to a small-business product? Only partly. MITRE tests a vendor's detection and response platform, and a small-business plan can share the engine without the detection and response features. CrowdStrike Falcon Go and ESET PROTECT Core, for example, do not include EDR, so a MITRE result tells you about the vendor's platform rather than about those plans. WatchGuard took part with a higher tier than the WatchGuard product we track. For a small office, a MITRE result is most useful when you are choosing between EDR or managed detection and response products and the vendor took part recently. The [lab results scorecard](/research/endpoint-security-lab-test-results/) shows MITRE next to AV-Test and AV-Comparatives for every product we track, and the [EDR comparison](/research/edr-comparison-small-business-2026/) puts the same results next to prices. ## What is changing in the 2026 round? MITRE's next round, Enterprise 2026, is open for vendors to sign up and has no results yet. MITRE says it will introduce a "Total Evaluation Score (TES) framework alongside enhanced transparency, standardization, and scenario design", with two evaluation scenarios. If that score is published per vendor, it would be the first single number MITRE itself attaches to each participant. We will add the round when the results are out. ## Frequently asked questions ### Does MITRE rank security vendors? No. MITRE publishes each vendor's result for every substep and leaves comparison to readers. Any "winner" or ranking of a MITRE round comes from a vendor or a third party, not from MITRE. ### What is a good MITRE ATT&CK result? A high count of substeps detected on the first run, most of them at Technique level, with few steps not evaluated. In the 2025 round 2 of 11 participants detected all 90 on the first run. ### Did CrowdStrike get 100% in the 2025 MITRE evaluation? Not on MITRE's default view. CrowdStrike detected 89 of 90 substeps on the first run, all at Technique level, and 90 of 90 including the results after configuration changes. ### Which vendors took part in the 2025 MITRE evaluation? Acronis, AhnLab, CrowdStrike, Cyberani, Cybereason, Cynet, ESET, Sophos, Trend (as TrendAI), WatchGuard and WithSecure. Microsoft, SentinelOne and Bitdefender, which took part in 2024, did not. ### What does N/A mean in MITRE results? That the step was not evaluated for that vendor. MITRE gives the reason as technical limitations, environmental constraints or platform exclusions. It is not counted as a detection or a miss. ### Should a small business choose a product because of its MITRE result? Not on that alone. Use it to compare EDR products from vendors that took part recently, and weigh it with false positives, price and whether someone will respond to the alerts. A product that alerts on every step still needs a person, or a managed service, to act on those alerts. ## Methodology and caveats Counts come from the data behind MITRE's Enterprise results pages, saved on 30 September 2026 and checked again, unchanged, on 10 Oct 2026. For each vendor and substep we take the best result from the first run (MITRE's default view) and, separately, the best result including configuration changes. Detected means Technique, Tactic or General; MITRE's N/A is reported as not evaluated. MITRE's own pages remain the authority; where our count and MITRE's display differ, MITRE's is right and we will correct ours. ## Sources - MITRE ATT&CK Evaluations, [Enterprise 2025 results](https://evals.mitre.org/results/enterprise?view=cohort&evaluation=er7&result_type=DETECTION&scenarios=1,2) and [Enterprise 2024 results](https://evals.mitre.org/results/enterprise?view=cohort&evaluation=er6&result_type=DETECTION&scenarios=1,2,3). - MITRE ATT&CK Evaluations, [methodology overview](https://evals.mitre.org/methodology-overview/). - MITRE, [ATT&CK knowledge base](https://attack.mitre.org/).