ESET PROTECT Enterprise Cloud has secured a Certified Leader position in AV-Comparatives’ Endpoint Prevention and Response for the seventh year in a row. It’s one of four vendors out of 14 tested in the top right-hand corner of AV-C’s graph, and one of only 11 certified vendors in the test; three unnamed vendors did not pass AV-Comparatives’ certification and requested anonymity.
What does this all mean? Testing labs exist to provide an unbiased, third-party transparent view of how well and (more critically) whether cybersecurity products work. Enterprise buyers use these tests as proof of value, and industry analysts also benefit from the information provided by labs, using it to inform better, higher-resolution insight for their clients, too.
By buying one of the 11 certified leader products in this category, organizations can be sure that they have picked a product that works effectively and delivers value for money. ESET PROTECT Enterprise Cloud is in the top four of these products, and has been certified by AV-Comparatives for the seventh year running. It’s also improved its detection scores over last year’s evaluation.
“ESET PROTECT Enterprise Cloud achieved Certified Leader status [in the 2026 EPR Test]. The product prevented the large majority of attack scenarios already at the earliest stage and closed out every remaining scenario before it could reach deeper into the network, all without any additional operational accuracy costs,” said Andreas Clementi, Founder & CEO of AV-Comparatives. “That balance of thorough protection and a clean user experience is exactly what we look for in a certified product."
MITRE ATT&CK as a measuring stick
AV-Comparatives tested using attack scenarios based on the MITRE ATT&CK Enterprise Framework, and then tested again by replicating a complete attack chain. This year’s evaluation involved 50 targeted attack scenarios, each one divided into three distinct phases.
Why the MITRE ATT&CK Enterprise Framework? MITRE is used for testing like this (AV-Comparatives is not the only test lab to use the same framework, and MITRE itself uses it for its own evaluations each year) because, quite simply, it works. The MITRE ATT&CK Enterprise Framework is the best tool for understanding and communicating how cyber attacks take place so far, and it’s also, consequently, one of the best ways to show how cybersecurity products do their work as measured against a common, open framework. Even better, the framework is heavily used by cybersecurity professionals to understand the potential weaknesses of the estates they protect, and furthermore, the AV-Comparatives evaluations show how different vendors’ solutions might map to potential weak spots your security team has identified when measuring organizational security using the framework.
First: Prevent
The first phase of the AV-Comparatives Endpoint Prevention and Response test looks at Endpoint compromise and foothold, the first point at which an attacker can be detected or stopped. There are two more phases after this: Internal Propagation (Phase 2), and Asset Breach (Phase 3). Each solution is scored on two factors across the three phases: Detection and Prevention, referred to as Passive Response and Active Response, respectively. Each phase is attempted 50 times in different scenarios.
In the first phase, ESET PROTECT maintained its Detection score in 2025 to the 2026 edition, detecting 98% of attempts. On the active side of things, ESET PROTECT then prevented 96% of attacks at this stage in the 2026 test (up from 90% in 2025), validating ESET’s prevention-first approach.
Bear in mind Phase 1 is the earliest stage, wherein the attacker makes the initial compromise of a victim’s system and establishes a foothold from which to expand their attack. In Phase 2, just as in the 2025 test, ESET PROTECT both detected and prevented internal propagation entirely across all 50 scenarios – a 100% success rate.
Accuracy and affordability
Overall, it’s worth noting that there were no operational accuracy costs in this or the following stages. In plain English: No false positives or over-blocking penalties, and a five-year Operational Impact score of $569 per agent. Operational Impact makes up the X-axis of the chart AV-Comparatives uses to give a high-level view of how each solution compares to its peers. (For completeness’ sake, the Y-axis is a measure of prevention and response capability). AV-Comparatives overhauled and updated the way it calculated the Operational Impact metric last year to improve accuracy.
Combined capabilities
When looking at the combination of Active and Passive Response, the upgrade from version 6.3 of PROTECT Enterprise Edition in 2025 to version 7.1 in 2026, the Combined Capability score rose from 98% to 99%.
What’s next, and why is ESET set up for tomorrow?
Third-party testing is hugely valuable for buyers and vendors alike: It ensures products do what they claim to do, identifies shortfalls and weaknesses that need rectification, and helps demystify a lot of the hype and hoo-ha around cybersecurity with actual, measurable comparisons.
One thing it doesn’t do, however, is show future direction or capability. That’s not exactly a solvable problem: No one can predict the future with certainty, and certainly no one can test products that don’t yet exist against threats that haven’t emerged. With this set of results, organizations have a snapshot of how well products work now; what they won’t get is a view of how well they’ll adapt to future changes or evolve over time.
Some things seem as predictable as death and taxes: The cybersecurity talent shortage continues to rumble on with 63% of respondents to a survey by ISC2 in 2025 reporting a staff shortage. Cloud and identity management continue to present a task for both security and general IT teams, especially with the increase in nonhuman entities deployed or in planned deployment by organizations. Add to this the fact that it seems that every vendor and many buyers are pursuing unified security architectures, increasing the homogeneity of security environments and reducing the complexity and cost involved with multi-vendor solutions.
Cybersecurity is becoming a priority for boardrooms and governments, and buying decisions are now based on resilience, trust, and sovereignty as well as innovation and features. On top of this, AI is now also changing how we measure and account for both risk and opportunity across the board.
These overlapping and interconnected challenges require more than just excellent endpoint protection, but it can’t cost the moon. Looking to the future, ESET sees the solution in a combination of AI for defenders and affordable, accessible MDR to help address more complex future threats; Gartner predicts that “by 2028, 90% of endpoint protection vendors will offer AI discovery and usage control features.” It’s also important to provide sovereign choice, so providing endpoint protection on-premises, via the cloud or in an air-gapped environment, and delivering Managed Detection and Response (MDR) from a choice of regulatory environments is critical.
The solutions that AV-Comparatives tests – including ESET PROTECT – are often keystone capabilities for organizations’ security departments, but they’re not the entire answer. Ancillary capabilities are one thing, but regulatory requirements under rules such as NIS2, HIPAA, PCI, SOX, GDPR, and CCPA are all intended to nudge or push organizations toward training, MDR and insurance.
MDR is becoming more accessible to smaller organizations, and adding this capability increases organizational resilience and provides expertise around the clock that most organizations cannot accomplish themselves.
A further element focuses on the most common route of compromise: employees. Cybersecurity awareness training on a regular basis for all employees is a critical step toward preventing incidents, and it is increasingly both an insurer and regulatory requirement.
Finally, cyber insurance is becoming increasingly important for organizations and, along with MDR, a requirement in many regulated sectors.
Conclusion
The 2026 AV-Comparatives Endpoint Prevention and Response evaluation shows a thriving, competitive market for endpoint security, with multiple vendors offering excellent service. The challenge for organizations is to understand which provider best fits their needs over the long term; these purchases are far from trivial or short-term. With that in mind, understanding future developments, needs, and threats is also something that must be taken into account.
