WithSecure named Certified Leader in AV-Comparatives‘ Endpoint Prevention and Response test

Certified Leader status, the highest bar AV-Comparatives sets

Certified Leader isn’t a participation award. It’s the top tier of AV-Comparatives‘ CyberRisk Quadrant, and only vendors that clear a strict combined Active/Passive Response threshold reach it. In 2026, AV-Comparatives raised that threshold from 90% to 92% and introduced more advanced, AI-assisted attack scenarios to reflect how attacker tooling is evolving. Fourteen enterprise security vendors were tested. Eleven cleared the bar.

MITRE ATT&CK® Enterprise evaluations have long been the go-to independent benchmark for EDR capabilities. But they test detection in isolation when prevention capabilities must be turned off. For organizations that want to understand how their Endpoint Protection (EPP) and EDR work together — and what that combination actually costs to own and operate — AV-Comparatives‘ EPR evaluation offers a compelling alternative. It’s the more complete picture for anyone making a real-world procurement decision.

What AV-Comparatives actually tested

The EPR Test doesn’t check for known malware signatures. It runs full attack chains the way a real adversary would, built on techniques from the MITRE ATT&CK Enterprise framework: phishing entry, privilege escalation, lateral movement, and data theft. This year’s evaluation covered 50 of these scenarios across 14 enterprise products.

Each scenario tracks whether a product stops the attacker at entry, disrupts them during lateral movement, or fails to prevent the breach entirely. The CyberRisk Quadrant that AV-Comparatives derives from the test includes only products that clear the Certified Leader threshold — so every product that appears there, WithSecure included, is a genuine top-tier result.

The EPR evaluation put security vendor solutions through 50 simulated targeted attack scenarios, covering techniques used in real advanced persistent threat (APT) campaigns. Each scenario was structured across three attack phases:

1. Compromise and foothold phase: The initial intrusion attempt. Can the product stop the attacker before they establish a presence?
2. Internal propagation phase: If the attacker gets in, can the product detect and disrupt lateral movement before the threat spreads?
3. Asset breach phase: If propagation isn’t stopped, can the product prevent the attacker from reaching their target?

At each phase, AV-Comparatives logged whether the product blocked the attack automatically, detected it and flagged it for manual response, or missed it entirely. Critically, the test also factored in cost — purchase price, operational overhead, and the calculated breach savings — to produce a realistic total cost of ownership (TCO) over five years. This is what makes the EPR evaluation different from most independent tests: it measures value, not just capability.

WithSecure Elements XDR stopped every attack chain

WithSecure Elements XDR prevented 100% of the 50 scenarios, containing every attack before it reached the asset-breach phase. No breach occurred in any test run.

Just as important, that result came without added operational cost. Zero extra burden from false positives or workflow delays — a common trade-off when products push prevention rates higher by generating more noise for security teams to sort through. The test also measured how quickly WithSecure responded during the initial phase (Phase 1) of each attack: 96.0% early active response and 98.7% early passive response.

In Internal Propagation (Phase 2) WithSecure achieved an Active Response rate of 100% and a Passive Response, rate of 100% across the progressed scenarios. With all remaining threats mitigated in this phase, none advanced to Phase 3.

The report specifically commended WithSecure Elements XDR for:

• WithSecure Elements XDR did well at handling threats targeted towards enterprise users, before the threats could
  progress inside and infiltrate the organisation’s network.
• The product demonstrated several safeguards that helped in
  protecting the enterprise systems and network against the scenarios we tested.
• The product’s management console was easy to use, intuitive, and provided contextual data useful to SOC analysts in
  determining which threats to prioritize.
• The product had different response options for mitigated threats, and
  information for the SOC analyst to further investigate/inspect.
• The product had good mapping to MITRE’s TTPs, thus providing low-level SOC analysts with the data needed to
  investigate further and escalate when necessary.
• Alerts were prioritized and aggregated, to minimize noise from all
  the alerts generated. The product can be easily configured and deployed in a domain or workgroup environment.

A five-year track record behind the result

This is the first Certified Leader result under the WithSecure name, but not the company’s first time earning recognition in this test. As F-Secure Business, the same enterprise line was certified in AV-Comparatives‘ 2021 EPR Test, back when this distinction was called „Strategic Leader“ rather than „Certified Leader,“ putting five years of track record behind this result.

Over the years, WithSecure has also picked up other AV-Comparatives certifications, including Advanced+ Performance and Advanced Real-World Protection for Windows, Approved Mac Security for macOS, and Approved Mobile Security for Android.

Why the result holds up: Broad Context Detection and European delivery

WithSecure attributes the outcome to Broad Context Detection™, which pulls signals from endpoints, identities, and cloud into a single incident view, mapped to MITRE ATT&CK and correlated by WithSecure Luminen™, the company’s AI layer. Rather than treating each signal in isolation, Broad Context Detection connects them into one picture of an attack as it unfolds — which is what let Elements XDR contain every scenario before it progressed.

WithSecure’s European base matters here too. Elements XDR is developed, delivered, and supported from Europe, a factor increasingly relevant to public-sector organizations and any business navigating data-residency-sensitive regulation such as NIS2 and DORA.

Read the full report

Full details of the 2026 EPR Test are available at av-comparatives.org. WithSecure’s product-specific report is available directly from AV-Comparatives. If you want to understand what this result means for your own environment, get in touch and we’ll walk you through it.

About AV-Comparatives

AV-Comparatives is the leading independent cybersecurity testing organization, evaluating security solutions that have evolved far beyond traditional antivirus software. Our systematic testing assesses modern endpoint protection, threat detection capabilities, and mobile security solutions for PC, Mac, and Android devices. Using one of the world’s most relevant and sophisticated threat collections, we create real-world testing environments for comprehensive security software evaluation.