We have three endpoint enhancements, all contributing to better endpoint prevention:

1. To be even more proactive about Bring Your Own Vulnerable Driver (BYOVD) attacks, we’re continuously monitoring public vulnerable driver disclosures and automatically generating endpoint protections
2. To improve your endpoint management efficiency, Automatic Troubleshooting is now available as a skill via Elastic Agent Builder
3. To expand our coverage surface, Elastic Defend is now available for Windows on ARM

Let’s dig into each one.

What is a BYOVD attack and how does it bypass endpoint protection?

BYOVD is a technique attackers use to gain kernel-level access on Windows machines by abusing legitimately signed drivers, letting them bypass defenses meant to block unauthorized code. Windows requires low-level software drivers that run in the kernel to be digitally signed, so rather than trying to sneak in something unsigned, attackers bring a driver that's already signed and trusted, but that has a known security flaw. That flaw is enough to disable security software or tamper with memory, and once an attacker has that level of access, security tools can no longer reliably protect the host.

This combination is why BYOVD has become so appealing to ransomware operators. The technique started as tradecraft mostly reserved for advanced state actors and red teams. Elastic Security Labs has tracked its shift into a routine step ransomware crews now use to tamper with or shut down endpoint security software before deploying their payload, as detailed in Stopping Vulnerable Driver Attacks.

Now, why does timing matter here? BYOVD attacks have depended on one thing for years: the delay between a vulnerable driver's public disclosure and a vendor shipping coverage for it. The moment a vulnerable driver becomes public knowledge, attackers already know about it. When it takes a vendor an entire product release to ship a protection, that gap is exactly what the technique depends on.

To close this gap, Elastic Security Labs Threat Command, Elastic's security research team now continuously monitors public vulnerable driver disclosure sources, including VirusTotal, the LOLDrivers catalog, and Microsoft's Vulnerable Driver Block List, and automatically generates and instantly deploys detection rules. Because we know any delay could be the difference between an exposed endpoint and a secured one, we’ve decoupled this coverage from any release cycle and publish the protections in the open.

How Elastic automatically generates vulnerable driver YARA rules

Elastic Security Labs has published detection coverage for vulnerable drivers for years. That coverage now runs through an always-on process that adds new drivers to the protections library as they're disclosed. An always- on process means coverage ships continuously, not whenever the next major release happens to land, and it doesn’t require an update or setting change. A driver flagged today becomes a driver Elastic Defend recognizes.

Elastic Security Labs Threat Command monitors three public sources for newly disclosed vulnerable and malicious drivers:

• VirusTotal
• The community-run LOLDrivers catalog
• Microsoft's Vulnerable Driver Block List

No single source catches everything, so the system checks all three, filters out drivers Elastic already covers, and builds new detection rules from the driver's digital signature and file characteristics.

One example: Avast's signed anti-rootkit driver (aswArPot.sys), which was abused to terminate protected processes from the kernel and has been leveraged in Cuba ransomware intrusions as well as GHOSTENGINE campaigns. Elastic generates detection coverage for weaponized drivers like these automatically as soon as they surface in the wild.

Every rule this process generates is public. Coverage lands in Elastic's open protections-artifacts repository alongside the rest of Elastic's detection content, so a security team can verify it directly before applying it to their systems. The sources are named and the rules themselves are published in the open, unlike a vendor's private threat feed. You can see which driver triggered a rule, which source flagged it, and inspect the detection logic itself.

This process has taken coverage from an initial 65 rules in 2023 to more than 800 known vulnerable drivers today, and the number keeps growing. These protections ship through Elastic Security's malware protection, so make sure it's enabled and set to Prevent to get the full benefit.

Signature coverage is also just one layer though. This automated coverage sits alongside protections Elastic Defend has carried for years: validating drivers against a blocklist before they're allowed to load and flagging drivers the moment they're seen for the first time in an environment. A newly disclosed driver doesn't have to wait on a signature alone to be caught doing something suspicious, and a driver built to slip past one layer still has to get past the others built to detect it.

Automatic endpoint troubleshooting in Elastic Agent Builder, now available as a skill

The automatic troubleshooting skill in Elastic Agent Builder flags policy and performance issues, bringing automation and natural language chat to endpoint diagnosis. Just like the existing Automatic Troubleshooting feature scans for and surfaces known endpoint issues, this skill also lets you ask questions, get a diagnosis, and receive specific remediation guidance. It handles the failures that consume the most investigation time: third-party antivirus conflicts, policy application failures, and the errors that typically send analysts into logs for hours.

The skill runs continuously to identify issues’ root causes, tell you what to fix, what commands to run, and what data to collect, all available the second you’re aware of an issue. The existing automatic troubleshooting feature remains available; this skill sits alongside it as a faster path to resolution, specifically tailored for teams that want to work through issues conversationally.

Windows on ARM: Elastic Defend coverage for Snapdragon and Copilot+ PCs

With the increased popularity of ARM processors, Snapdragon laptops, Copilot+ PCs, ARM workstations are more commonly showing up in enterprises’ fleets. If your endpoint protection doesn't cover them, they're unmonitored, and an unmonitored endpoint is a gap an attacker can use. That’s why Elastic Defend has now expanded to cover Windows on ARM. ARM workstations, Snapdragon laptops, and Copilot+ PCs can enroll under your existing policy with the same detection rules and telemetry as x64 endpoints. As you add ARM devices to your fleet, they can enroll automatically to your existing policies.

Get started with Elastic Security today

Elastic Security has significant enhancements to endpoint protections, efficiencies for diagnosing and resolving performance issues, and expanding coverage to new systems, all aimed at shifting defenses earlier, to prevention at the endpoint.

Elastic Security Labs Threat Command now continuously monitors public vulnerable driver disclosure sources and automatically generates and instantly deploys protection rules, decoupled from any release cycle and published in the open. That speed matters when AI-driven attacks can move from one machine to the next in under a minute, faster than any response workflow can react.

Browse the rules directly in the elastic/protections-artifacts repo, alongside the rest of Elastic's open detection content and test out the automatic troubleshooting skill through Elastic Agent Builder.

What is the EPR Test?

AV-Comparatives’ EPR Test is one of the most rigorous evaluations in the industry. It simulates complex, realistic attack scenarios that traverse the full kill chain, including:

• Endpoint compromise and foothold (e.g.,initial access, execution, and persistence)
• Internal propagation (e.g., privilege escalation, lateral movement, and credential theft)
• Asset breach (e.g., exfiltration, command and control, and impact)

The EPR Test replicates APT-like multistage attacks rather than relying on synthetic malware samples. It evaluates endpoint prevention and response solutions against the MITRE ATT\&CK® framework, covering:

Phase 1: Endpoint Compromise and Foothold

• Initial Access, Execution, and Persistence
• Replication through removable media
• Malicious documents/scripts
• Registry modifications

Phase 2: Internal Propagation

• Privilege Escalation, Lateral Movement, and Credential Access
• Scheduled tasks/launch daemons
• Unsecure credentials
• Exploitation of remote services

Phase 3: Asset Breach

• Collection, Command and Control, and Exfiltration
• Data encoding
• Input and screen capture
• Application layer protocol

All participants are scored on two vectors:

• Active Response: The product blocks the attack automatically.
• Passive Response: The product detects and alerts on the activity, providing actionable data for analysts.

Additionally, the test quantifies:

• Operational Accuracy Costs (false positives, admin overhead)
• Workflow Delay Costs (productivity impact)
• Total Cost of Ownership (TCO) for a 5,000-endpoint/5-year deployment

**

AV-Comparatives’ Certified EPR Product Award

In order to get a meaningful comparison between all participants, AV-Comparatives developed the Enterprise CyberRisk Quadrant, which takes into consideration all aspects described above. Elastic Security achieved Certified status, meaning a high level of performance in all key areas, confirming the product meets stringent evaluation standards as stated by Andreas Clementi, CEO and founder of AV-Comparatives:
Elastic achieved strong results in AV-Comparatives’ 2025 Endpoint Prevention and Response Test. The product demonstrated consistent performance across both Active and Passive Response methods, highlighting its ability to provide reliable protection against a broad range of attack vectors.

How Elastic Security performed on the test

| Metric | Elastic Security results | Interpretation | | :---- | :---- | :---- | | Active Response (Prevention) | 99.3% | Automated blocking effective across most stages of attack chains | | Passive Response (Detection) | 99.3% | Alerts enriched with MITRE ATT\&CK mappings, aiding triage and forensic workflows | | Operational Accuracy Cost | Low | Minimal impact due to detection tuning | | Workflow Delay Cost | None | No user workflow disruption |

Why these results matter

1. Prevention is front and center:
A 99.3% active response rate means Elastic Security was able to stop threats before they could run wild in almost all test cases. This includes interrupting attacks in early phases like execution, persistence, or initial foothold — highly valuable since earlier detection often means lower damage.

2. Low noise, minimal disruption:
False positives (mistakenly flagged benign behavior) and workflow delays are often silent risks; they may not make headlines, but they erode confidence, reduce productivity, and increase costs. Elastic Security’s low operational accuracy cost and zero workflow delay in this test show that strong security doesn’t need to come at the expense of usability.

3. Balanced total cost of ownership (TCO):
The test factors in not just purchase and licensing costs, but also the cost of responding to incidents, staffing, false positives, and potential breach fallout over time. Elastic Security’s strong showing suggests that its solution offers good value in the long term.

4. Holistic protection:
Because the test spans multiple stages of an attack, it rewards vendors who do more than just detect malware signatures. Elastic Security’s performance across initial compromise, propagation, and asset breach phases indicates depth — protection at different layers, good detection capabilities, and the ability to give admins useful data for remediation.

Conclusions

Elastic Security’s results in the AV-Comparatives EPR Test 2025 reaffirm its role as a leading endpoint prevention, detection, and response solution. With near-perfect prevention rates, minimal false positives, no workflow delays, and favorable total cost projections, it demonstrates that enterprise security need not force a trade-off between robust protection and operational efficiency.

One more resource before you go

Elastic Security isn’t just getting noticed in the analyst community. Cybersecurity practitioners like John Hammond, who recently took a hands-on look at Elastic Security are taking notice, too. If you’re interested in just the key highlights from the interview, we summarize them all in From raw data to real-time defense: A conversation with John Hammond.

Get started with Elastic Security

Join the growing number of businesses that trust Elastic Security to protect their organization against attacks. Experience the peace of mind that comes with knowing that your endpoints and organization as a whole are secure against the latest threats. Start your Elastic Security free trial, and discover the difference that our protection can make. Visit elastic.co/security to learn more.
The release and timing of any features or functionality described in this post remain at Elastic's sole discretion. Any features or functionality not currently available may not be delivered on time or at all.

Why the AV-Comparatives Business Security Test matters

AV-Comparatives is a highly respected organization that conducts rigorous, independent testing specifically for business endpoint security solutions. Unlike consumer antivirus tests, AV-Comparatives evaluations go beyond basic malware detection. The Real-World Protection Test simulates real-world attack scenarios, including malicious websites, in a multipronged approach that evaluates a product’s ability to safeguard businesses from contemporary threats. Earning top honors in AV-Comparatives' Business Security Test signifies a solution's effectiveness in protecting organizations.

The test simulates 220 distinct and complex attack scenarios that replicate the tactics and techniques of contemporary threat actors. The Malware Protection Test assesses a security product’s ability to protect a system against infection by malicious files before, during, or after execution. The evaluation utilized a substantial dataset of 1,018 unique and recently identified malware samples, representing the current threat landscape.

Elastic Security earned perfect scores in both critical categories, demonstrating its robust capabilities to accurately identify and prevent a wide spectrum of sophisticated threats, including both targeted attacks and prevalent malware.

Highlights from Elastic Security’s performance

Ranked first of the tested products: The following business products were tested under Microsoft Windows 11 64-bit:

Real-World Protection Test: Elastic Security excelled in the Real-World Protection Test, achieving 100% coverage and demonstrating exceptional defense against current cyber attacks. This demonstrates how Elastic gives your business the necessary protection to effectively combat the newest threats, reducing the likelihood of data breaches and operational interruptions.

100% protection in Malware Protection Test: Elastic Security was the sole participant among 17 vendors to achieve a perfect 100% score in both the Real-World Protection Test and the Malware Protection Test. Our advanced threat detection engine is exceptionally effective at identifying and mitigating malware, proactively combating the increasingly sophisticated malware environment. This perfect score across both critical evaluation criteria highlights not only the efficacy of Elastic Security’s solutions in practical, real-world scenarios but also its comprehensive capabilities in identifying and neutralizing a broad spectrum of malicious software.

Our consistently excellent results demonstrate our ongoing commitment to delivering dependable protection for businesses of all scales. Elastic Security is a proven solution for safeguarding your organization's data against threats.

Performance is key to security

Elastic Security recognizes that effective cybersecurity requires more than just identifying and stopping malicious activity. Advanced cybersecurity demands seamless integration with daily operations for sophisticated security and business efficiency. Comprehensive security capabilities, such as advanced threat detection, proactive ransomware defense, and sophisticated malware analysis, form the bedrock of a strong security posture. However, their true value is diminished if they lead to system performance degradation. Slow, resource-intensive security solutions can frustrate users, impede productivity, and ultimately undermine the very security they aim to provide.

At Elastic Security, performance is not a secondary consideration but a fundamental pillar of our security philosophy and product design. We are committed to delivering world-class security without the performance overhead that can disrupt workflows. Our engineering efforts focus on optimizing every aspect of our platform to minimize CPU and memory consumption.

EDR stops at the endpoint, XDR doesn’t

Todayʼs threat landscape is complex and dynamic, with attacks originating from various sources and targeting diverse environments. By correlating information from endpoints, networks, cloud workloads, and more, extended detection and response (XDR) offers a holistic view of the security posture, protecting against increasingly complex threats. The shift from endpoint detection and response (EDR) to XDR is a critical evolution in security operations, offering more robust, efficient, and effective defense mechanisms.

XDR security from Elastic is designed to protect data across the entire organization — regardless of where it resides. Elastic Security helps organizations improve detection rates, reduce response times, and mitigate overall risk by unifying data types and providing limitless ingestion, analysis, and protection.

• Extended visibility: Elastic provides a unified view of your security landscape, encompassing endpoints, networks, and cloud environments. This comprehensive perspective empowers analysts to see the big picture and connect the dots between potential threats. With hundreds of integrations and the AI-driven Automatic Import feature at the ready, your team can seamlessly onboard all types of data from various sources, expanding your visibility across the organization.
• XDR detection capabilities: Elastic Securityʼs AI-driven security analytics correlates data across all sources to uncover sophisticated threats that often evade detection by individual security solutions. Our vast library, with hundreds of prebuilt rules mapped to the MITRE ATT\&CK® matrix, combined with proprietary research and detection content from Elastic Security Labs, helps you separate the signal from the noise so you can focus on actual threats. Elastic Security also provides more than 75 machine learning detection rules to automatically detect anomalies across numerous security domains like suspicious user or host activity.
• Native and third-party responses: Analysts often face an overwhelming volume of alerts, making it challenging to focus on legitimate threats. To address this, Elastic security offers both native and third-party response actions to stop attackers in their tracks.

We believe XDR should be accessible to every organization, regardless of budget constraints. Thatʼs why our XDR solution is included without any hidden costs or “optional extras.” Our comprehensive visibility goes beyond endpoint telemetry, eliminating the need for additional licenses to unlock full XDR capabilities — all included in the Elastic Security solution. With no per-host or per-agent charges, you have the flexibility to provide coverage where and when you need it.

Read more: You thought Elastic only did SIEM? Think again!

Get started with Elastic Security

Join the growing number of businesses that trust Elastic Security to protect their organization against attacks. Experience the peace of mind that comes with knowing your endpoints — and organization as a whole — are secure against the latest threats. Start your Elastic Security free trial and discover the difference that our protection can make. Visit elastic.co/security to learn more and get started.

For more detailed results and to see the full report, visit the AV-Comparatives Business Security Test 2025 website.

The release and timing of any features or functionality described in this post remain at Elastic's sole discretion. Any features or functionality not currently available may not be delivered on time or at all.