MITRE ATT&CK Evaluations Explained (October 2026)

Executive summary

MITRE ATT&CK Evaluations are public tests in which MITRE runs an emulated real-world attack against each participating security product and records, step by step, whether the product raised an alert. MITRE does not score or rank the participants. In the latest published round, Enterprise 2025 (published 10 Dec 2025), 11 vendors took part and 2 detected all 90 substeps on the first run. The figure vendors advertise is often a different count from the one MITRE shows by default, so check the first run, the steps marked not evaluated and which product was tested.

What do MITRE ATT&CK Evaluations test?

MITRE, the US not-for-profit that maintains the ATT&CK catalogue of attacker techniques, plays the part of a named threat group inside a test network and records what each security product reports. Each attack is broken into steps and substeps, and each substep is one technique, such as stealing credentials or moving to another machine.

The 2025 round used two emulations: Scattered Spider, a cybercrime group known for social engineering, and Mustang Panda, a China-based espionage group. MITRE describes the round as focused on cloud-based attacks and the abuse of legitimate tools. The 2024 round emulated ransomware groups (CL0P and LockBit) and a macOS attack attributed to North Korea (DPRK).

MITRE also runs protection tests and a false-positive test. This page counts the detection results, the ones vendors quote.

How do you read a MITRE result?

Every substep gets one result for each vendor. These are MITRE's categories for the 2025 round:

Endpoint Index counts a substep as detected when it scored Technique, Tactic or General, and reports it as a count ("89 of 90") rather than a rank. Two more details matter:

• First run against configuration changes. After the first run, a vendor may change its settings and run steps again. MITRE's default results view shows the first run; the results after changes are shown separately. A product that only detects after changes was not configured to detect it on the day.
• Not evaluated is not the same as missed. A vendor with many N/A steps was tested on less of the attack. Compare detected steps with the steps evaluated as well as with the total.

What were the 2025 MITRE results?

Participant	Substeps detected, first run	At technique level	Not evaluated	Detected after configuration changes
Cynet We track Cynet All-in-One	90 of 90 100.0%	90	0	90 of 90
CCybereason	90 of 90 100.0%	89	0	90 of 90
CrowdStrike We track CrowdStrike Falcon Go	89 of 90 98.9%	89	0	90 of 90
Sophos We track Sophos Endpoint	66 of 90 73.3%	57	0	90 of 90
AAhnLab	64 of 90 71.1%	23	0	69 of 90
TrendAI We track Trend Micro Worry-Free Services Advanced	53 of 90 58.9%	51	0	87 of 90
WWithSecure	35 of 90 38.9%	17	0	67 of 90
Acronis We track Acronis Cyber Protect	26 of 90 28.9%	12	36	37 of 90
WatchGuard We track WatchGuard Endpoint Security 360	24 of 90 26.7%	19	62	27 of 90
ESET We track ESET PROTECT Core	22 of 90 24.4%	16	36	36 of 90
CCyberani	22 of 90 24.4%	10	37	42 of 90

Cynet and Cybereason detected every substep on the first run, and CrowdStrike missed one. Further down, several vendors detected far more after configuration changes than on the first run: Sophos went from 66 of 90 to 90 of 90, and Trend (tested as TrendAI) from 53 of 90 to 87 of 90. ESET, Acronis and WatchGuard had many substeps not evaluated, so their counts describe a smaller part of the attack. Microsoft, SentinelOne, Bitdefender and ThreatDown did not take part in this round.

What were the 2024 MITRE results?

Participant	Substeps detected, first run	At technique level	Not evaluated	Detected after configuration changes
PPalo Alto Networks	80 of 80 100.0%	80	0	80 of 80
CCybereason	79 of 80 98.8%	79	1	79 of 80
Cynet We track Cynet All-in-One	77 of 80 96.2%	77	3	77 of 80
SentinelOne We track SentinelOne Singularity Complete and SentinelOne Singularity Control	72 of 80 90.0%	72	0	80 of 80
Microsoft We track Microsoft Defender for Business	67 of 80 83.8%	57	0	78 of 80
Sophos We track Sophos Endpoint	67 of 80 83.8%	57	0	79 of 80
Bitdefender We track Bitdefender GravityZone Business Security Premium and Bitdefender GravityZone Business Security	58 of 80 72.5%	49	1	73 of 80
TTrellix	54 of 80 67.5%	44	7	67 of 80
TrendAI We track Trend Micro Worry-Free Services Advanced	49 of 80 61.3%	41	0	79 of 80
CCheck Point	46 of 59 78.0%	45	4	57 of 59
WatchGuard We track WatchGuard Endpoint Security 360	40 of 59 67.8%	26	3	47 of 59
ESET We track ESET PROTECT Core	38 of 80 47.5%	28	0	49 of 80
WWithSecure	38 of 80 47.5%	23	0	59 of 80
TTehtris	37 of 80 46.2%	18	0	40 of 80
HHarfangLab	30 of 80 37.5%	21	0	71 of 80
AAhnLab	28 of 59 47.5%	22	0	56 of 59
QQualys	22 of 59 37.3%	9	14	54 of 59
ThreatDown We track ThreatDown Advanced and ThreatDown Elite	14 of 59 23.7%	12	0	50 of 59
CCisco	13 of 59 22.0%	7	3	17 of 59

The 2024 round had three detection scenarios. The DPRK scenario ran on macOS, and vendors that did not enter it were evaluated on the other two only, which is why some rows have fewer substeps. Microsoft, SentinelOne and Bitdefender all took part here and not in 2025, so for them this is the most recent MITRE result. It is now older than 18 months, which is why it no longer counts in the SMB Fit Score.

Why do vendor claims differ from MITRE's results?

When a vendor announces "100% detection" and MITRE's table shows less, the vendor is counting something narrower or later than the default view. The common differences:

1. Results after configuration changes. CrowdStrike detected 89 of 90 substeps on the first run of the 2025 round and 90 of 90 including changes. Both are true; only the first is what the product did as configured.
2. One scenario rather than the whole round. A vendor can be perfect in one emulation and not the other.
3. Protection results quoted as detection. Blocking an attack and alerting on each step are scored separately.
4. Counting coverage of evaluated steps only. Leaving out N/A steps raises the percentage.

None of these is dishonest in itself. They answer different questions. Ask which count a claim uses before comparing it with another vendor's.

Does a MITRE result apply to a small-business product?

Only partly. MITRE tests a vendor's detection and response platform, and a small-business plan can share the engine without the detection and response features. CrowdStrike Falcon Go and ESET PROTECT Core, for example, do not include EDR, so a MITRE result tells you about the vendor's platform rather than about those plans. WatchGuard took part with a higher tier than the WatchGuard product we track.

For a small office, a MITRE result is most useful when you are choosing between EDR or managed detection and response products and the vendor took part recently. The lab results scorecard shows MITRE next to AV-Test and AV-Comparatives for every product we track, and the EDR comparison puts the same results next to prices.

What is changing in the 2026 round?

MITRE's next round, Enterprise 2026, is open for vendors to sign up and has no results yet. MITRE says it will introduce a "Total Evaluation Score (TES) framework alongside enhanced transparency, standardization, and scenario design", with two evaluation scenarios. If that score is published per vendor, it would be the first single number MITRE itself attaches to each participant. We will add the round when the results are out.

Frequently asked questions

Methodology and caveats

Counts come from the data behind MITRE's Enterprise results pages, saved on 30 September 2026 and checked again, unchanged, on 10 Oct 2026. For each vendor and substep we take the best result from the first run (MITRE's default view) and, separately, the best result including configuration changes. Detected means Technique, Tactic or General; MITRE's N/A is reported as not evaluated. MITRE's own pages remain the authority; where our count and MITRE's display differ, MITRE's is right and we will correct ours.

Sources

• MITRE ATT&CK Evaluations, Enterprise 2025 results and Enterprise 2024 results.
• MITRE ATT&CK Evaluations, methodology overview.
• MITRE, ATT&CK knowledge base.