Elastic Security was the only vendor to successfully block 100% of attack scenarios with zero false alerts in the AV-Comparatives Endpoint Prevention and Response (EPR) Test.
Elastic sits at the very top of this year’s AV-Comparatives' CyberRisk Quadrant within the 2026 Endpoint Prevention and Response (EPR) test with the only protection scores at 100%, combined with both the lowest modelled operational footprint of any tested product and zero false alerts.
What the AV-Comparatives EPR test measures
- Active Response (Prevention) measures whether the product stopped the attack automatically and normally reports it. Elastic caught all 50 scenarios at this stage.
- Passive Response (Detection) measures whether the product detected and reported suspicious activity that it did not block.
- Operational Accuracy Costs measures how often legitimate programs or actions were incorrectly blocked or detected.
- Workflow Delay Costs measure whether the product slowed users down (e.g., when the product stops the execution of an unknown file and sends it to a sandbox for analysis).
Even with achieving 100% active and passive response rates, Elastic still returned zero operational and workflow delays with one of the lowest total costs of ownership amongst the 14 vendors. This means the strong prevention and detection rates don’t come at the cost of high false positives.
|