Skip to main content

The Forrester Wave™: XDR Platforms, Q2 2026

Access report
About usPartnersSupport|Log in
Elastic logo
Start free trialContact sales

The only perfect Endpoint Prevention and Response (EPR) score in 2026 belongs to Elastic

By
Mia LaVada

Elastic sits at the very top of this year’s AV-Comparatives' CyberRisk Quadrant within the 2026 Endpoint Prevention and Response (EPR) test with the only protection scores at 100%, combined with both the lowest modelled operational footprint of any tested product and zero false alerts.

Elastic Security achieved these scores by stopping every threat at phase one of the test, starting with Compromise and Foothold, which covers the first three MITRE ATT&CK chain tactics: Initial Access, Execution, and Persistence. Because every attack was contained at phase one, neither phase two (Internal Propagation) nor phase three (Asset Breach) were ever reached. 

We’re here to solve a stark reality, though, where test scores are only one component; SOC analysts are drowning in alerts. Prevention at the endpoint is how we propose solving alert fatigue. Every threat stopped before it executes is one fewer alert to triage or even one fewer investigation to open. 

To understand how prevention at the endpoint is a key part of the solution, it helps to see what the test focuses on.

What the AV-Comparatives EPR test measures

The EPR test runs 50 complete attack scenarios; each one structured as a multi-phase kill chain built on techniques from the MITRE ATT&CK framework. The scenarios span across several attack vectors, executables, scripts, installers, Office add-ins, and USB-propagated payloads, many with obfuscation, AMSI bypasses, EDR unhooking, and fileless execution techniques layered on top. 

This year’s test incorporated AI-assisted development methods to build the testing tools and scenario variations to better reflect how attacker tooling has evolved.

All 14 vendors are tested against the same 50 scenarios with the scoring broken into 4 components:

  • Active Response (Prevention) measures whether the product stopped the attack automatically and normally reports it. Elastic caught all 50 scenarios at this stage.

  • Passive Response (Detection) measures whether the product detected and reported suspicious activity that it did not block. 

  • Operational Accuracy Costs measures how often legitimate programs or actions were incorrectly blocked or detected.

  • Workflow Delay Costs measure whether the product slowed users down (e.g., when the product stops the execution of an unknown file and sends it to a sandbox for analysis).

Even with achieving 100% active and passive response rates, Elastic still returned zero operational and workflow delays with one of the lowest total costs of ownership amongst the 14 vendors. This means the strong prevention and detection rates don’t come at the cost of high false positives.

Elastic Security achieved Certified Leader status in the AV-Comparatives EPR Test 2026. The product prevented and detected every one of the tested attack scenarios already at the first stage of compromise with no operational accuracy costs and no workflow delays for the user. It is a clean, complete result that reflects real strength in enterprise threat prevention.

Andreas Clementi, Founder and CEO of AV-Comparatives

Endpoint prevention is the starting point to your defense strategy

The most expensive part of an incident is the time between compromise and containment. More time can mean more lateral movement and more endpoints to reimage. Credential access can mean password resets and access reviews. Data exfiltration, depending on what was taken, could mean breach disclosure. 

Early prevention reduces those costs to close to nothing. There’s nothing to remediate because the adversary never moved. There’s no breach to disclose because data was never reached.

Suspicious activity blocked and reported at the endpoint generates one event reviewed by one analyst and is easily resolved. When that same suspicious activity makes it a bit farther, you now have alerts across multiple endpoints, identity events, and network telemetry to correlate. If lateral movement extends even farther than that, it’s an active incident with a dedicated response team.

This is why prevention is the whole point.

Elastic Defend delivers endpoint prevention and response

Elastic Defend protects against malware, ransomware, in-memory threats with out-of-the-box endpoint protections across Windows, macOS, and Linux for cloud, on-premise, hybrid, and air-gapped environments. 

These protections are built and regularly maintained by Elastic Security Labs Threat Command, Elastic’s threat research team. They’re published in an open Github repo. You can read what each rule protects, understand why it would fire, and even modify it if you’d like. 

For teams mid-contract with another endpoint vendor or for those managing a mix of endpoint tools, Elastic ingests third-party endpoint telemetry and provides the same detection and response capabilities as the native Elastic agent. This means an investigation of a suspicious login has all of the alerts, timelines, and response actions in one platform rather than spread across multiple.  

Prevention is the goal, but sometimes things get through. When that happens, the information surfaced with the detection is what determines how fast the team can move. Elastic’s Attack Discovery uses your choice of large language model (LLM) to analyze alerts, identify potential attacks, and present a summarized attack narrative so that we’re piecing together what happened for you.

From there, incident responders can then isolate a host from the network all while keeping it connected to Elastic. Forensic analysts can use the Osquery Manager integration to write their own queries against live host data across the entire fleet. 

We're standing on business with a 100% protection rate streak

These 100% scores aren’t the first from Elastic. Across the last three AV-Comparatives Business Security Tests spanning all of 2025 and into 2026, Elastic Security has been the only vendor to achieve a perfect 100% malware protection score in every single cycle. 

In the most recent test, covering March through June 2026, Elastic was again the only vendor out of 16 tested to hit 100% malware protection while vendors including Microsoft, CrowdStrike, and others posted lower scores. Both of the 2025 Business Security Tests found the same thing: Elastic was the only vendor with 100% rates in both the Real-World Protection Test and the Malware Protection Tests across all of 2025.

This EPR result now adds another instance to the streak. The methodologies, the sample sets, and the frameworks all change across these tests. Elastic's scores remain at the top. This is now the second consecutive year Elastic has earned EPR Certified Leader status, having been certified in both 2025 and 2026. 

Try the endpoint solution with a perfect score

Elastic Security provides excellent endpoint protection, detection, and response across Windows, macOS, and Linux for both native Elastic endpoint and third-party telemetry. When the team needs to respond to an incident or analyze forensic artifacts, all of the capabilities are in the same platform.

The AV-Comparatives Endpoint Prevention and Response test transparently validates the strength of the product: 50 realistic attack scenarios with a published methodology and taking cost into consideration. Elastic’s 2026 result is a perfect score across prevention, detection, operational accuracy, and workflow impact.

Read the full AV-Comparatives EPR 2026 report. Try Elastic Security.

The release and timing of any features or functionality described in this post remain at Elastic's sole discretion. Any features or functionality not currently available may not be delivered on time or at all.

Sign up for Elastic Cloud free trial

Spin up a fully loaded deployment on the cloud provider you choose. As the company behind Elasticsearch, we bring our features and support to your Elastic clusters in the cloud.

Start free trial