Real-World Protection Test Enterprise August-September 2025 – Testresult

Introduction

This fact sheet gives a brief overview of the results of the Business Real-World Protection Test run in August and September 2024. The overall business product reports (each covering four months) will be released in July and December. For more information about this Real-World Protection Test, please read the details available at https://www.av-comparatives.org. The results are based on a test set consisting of 243 test cases (such as malicious URLs), tested from the beginning of August till the end of September.

Tested Products

• Avast Ultimate Business Security
  25.6 | 25.8
• Bitdefender GravityZone Business Security Premium
  7.9 | 7.9
• Cisco Secure Endpoint Essentials
  8.4 | 8.4
• CrowdStrike Falcon Pro
  7.28 | 7.28
• Elastic Security
  9.1 | 9.1
• ESET PROTECT Entry with ESET PROTECT Cloud
  12.0 | 12.0
• G Data Endpoint Protection Business
  15.8 | 15.8
• K7 On-Premises Enterprise Security Advanced
  14.2 | 14.2
• Kaspersky Endpoint Security for Business (Select, with KSC)
  12.10 | 12.10
• ManageEngine Endpoint Central with Malware Protection
  11.4 | 11.4
• Microsoft Defender Antivirus with Microsoft Endpoint Manager
  4.18 | 4.18
• NetSecurity ThreatResponder
  3.6 | 3.6
• Rapid7 InsightIDR
  4.0 | 4.0
• SenseOn Platform with EPP
  6.11 | 6.11
• Sophos Intercept X Advanced
  2025.1 | 2025.1
• Trellix Endpoint Security (ENS)
  10.7 | 10.7
• VIPRE Endpoint Detection & Response
  13.2 | 13.2

Information about additional third-party engines/signatures used by some of the products: CISCO, G Data, Rapid7, SenseOn and VIPRE use the Bitdefender engine (in addition to their own protection features). VMware uses the Avira engine (in addition to their own protection features).

The “ENS” version of Trellix in this test uses the erstwhile McAfee engine (now owned by Trellix), opposed to the “HX” version which uses the FireEye engine (McAfee Enterprise and FireEye were merged into Trellix in 2022).

Test Results

	Blocked	User dependent	Compromised	PROTECTION RATE [Blocked % + (User dependent %)/2]*	False Alarms
Bitdefender	243	–	–	100%	1
Sophos	242	1	–	99.8%	3
Cisco	242	–	1	99.6%	1
ESET	242	–	1	99.6%	2
Trellix	242	–	1	99.6%	9
Kaspersky	241	–	2	99.2%	0
VIPRE	241	–	2	99.2%	2
G Data	241	–	2	99.2%	10
Avast	241	–	2	99.2%	15
CrowdStrike	241	–	2	99.2%	30
Microsoft	240	–	3	98.8%	1
VMware	240	–	3	98.8%	3
K7	239	–	4	98.4%	15
Elastic	239	–	4	98.4%	17
NetSecurity	236	–	7	97.1%	13
SenseOn	235	–	8	96.7%	1
Rapid7	232	–	11	95.5%	1

* User-dependent cases are given half credit. For example, if a program blocks 80% by itself, and another 20% of cases are user-dependent, we give half credit for the 20%, i.e. 10%, so it gets 90% altogether.

Copyright and Disclaimer

This publication is Copyright © 2025 by AV-Comparatives ®. Any use of the results, etc. in whole or in part, is ONLY permitted after the explicit written agreement of the management board of AV-Comparatives prior to any publication. AV-Comparatives and its testers cannot be held liable for any damage or loss, which might occur as result of, or in connection with, the use of the information provided in this paper. We take every possible care to ensure the correctness of the basic data, but a liability for the correctness of the test results cannot be taken by any representative of AV-Comparatives. We do not give any guarantee of the correctness, completeness, or suitability for a specific purpose of any of the information/content provided at any given time. No one else involved in creating, producing or delivering test results shall be liable for any indirect, special or consequential damage, or loss of profits, arising out of, or related to, the use or inability to use, the services provided by the website, test documents or any related data.

For more information about AV-Comparatives and the testing methodologies, please visit our website.

AV-Comparatives
(October 2025)