AV-Comparatives has published the findings of an Advanced Endpoint Protection Test, consisting of the following component tests:

• PowerShell-based file-less attacks and file-based exploits test, including false alarm test
• Proactive Protection Test, including false alarm test
• Real-World Protection Test, including false alarm test
• Ransomware test

The tests were performed between November 2017 and January 2018. The primary goal was to compare the automatic prevention and detection capabilities of different endpoint protection solutions. The test was commissioned by Bitdefender. Products by the following vendors were tested (please note that the results apply only to the specific program versions and settings that are described in the report): Bitdefender, Carbon Black, CrowdStrike, Cylance, Kaspersky Lab, McAfee, SentinelOne, Sophos and Symantec. The full report can be downloaded from here (PDF).

The WannaCry ransomware has been a major news story over the last few days. It has infected hundreds of thousands of computers worldwide (mostly in Russia), including some well-known companies and institutions. All the programs in our public Main Test Series now detect the WannaCry malware samples by means of signatures, but we decided to find out which of these programs would have blocked the malware sample (not the exploit) proactively, i.e. before the the outbreak started and the malware samples became known.

Continue reading…

We released the heuristic/behavioural protection test report. It can be found here.