AV-Comparatives 2025 EDR/XDR/MDR Certification Results

The digital battleground grows ever more complex, a shadowy theatre where advanced cyber threats constantly evolve, probing defenses with cunning and persistence.

In this landscape, the notion of cybersecurity as a mere checklist exercise is not just naive, but dangerously irresponsible.

This stark reality underpins the latest independent assessment from AV-Comparatives, the Austrian-based testing organization, which on June 16, 2025, unveiled its critical 2025 EDR/XDR/MDR certification results, emphasizing real-world threat detection over simplistic prevention metrics.

Andreas Clementi, CEO and founder of AV-Comparatives, cut straight to the chase, articulating the core challenge facing Chief Information Security Officers (CISOs) today:

“Face à l’évolution des cyberattaques, la détection ne peut être une simple case à cocher. Notre certification 2025 EDR/XDR aide les CISO à évaluer l’efficacité de leurs outils à détecter les menaces furtives du monde réel.”

His words resonate deeply within an industry grappling with sophisticated, stealthy intrusions that often bypass initial preventative measures. It’s a sobering reminder that while keeping the door locked is important, knowing when an intruder has slipped through a window, and precisely what they are doing inside, is paramount.

This independent evaluation is no superficial scan.

Unlike traditional endpoint prevention (EPP) tests that primarily focus on blocking known threats, AV-Comparatives’ EDR (Endpoint Detection and Response) assessment plunges into the murky depths of live attack scenarios.

The objective is not to see if a product can prevent an attack, but rather how effectively it can detect and meticulously record every single step of an intrusion.

This nuanced approach offers invaluable insights into a solution’s visibility, the quality of its telemetry data, and the sheer accuracy of its threat detection capabilities.

It’s about understanding the entire kill chain, from initial compromise to data exfiltration, ensuring that even the most stealthy advanced persistent threats (APTs) leave a discernible trail.

The methodology employed by AV-Comparatives is robust and transparent.

Simulating complex APT attacks, the tests leverage well-known tactics, techniques, and procedures (TTPs) drawn from frameworks like MITRE ATT&CK.

Crucially, all participating products were tested in a “monitoring only” mode, meaning their prevention functions were deliberately disabled.

This singular focus on detection ensures that the results reflect a solution’s true ability to identify and report threats, rather than merely blocking them.

Detection validation occurs through alerts in management consoles or via manual threat hunting within the telemetry data, providing a comprehensive picture of a product’s operational intelligence.

The results, while encouraging for the certified vendors, also underscore the demanding nature of the assessment.

Out of seven solutions put through the rigorous paces, five earned the coveted certification in this cycle. These include industry stalwarts and innovators: CrowdStrike Falcon Pro, ESET PROTECT Enterprise Cloud, G DATA 365 MXDR, Kaspersky Next EDR Expert (participating in a pilot test), and Palo Alto Networks Cortex XDR Pro.

Their success in navigating these complex attack simulations provides CISOs with a clearer roadmap for selecting tools that offer genuine defensive depth.

Notably, the testing framework proved versatile enough to assess Managed Detection and Response (MDR) offerings.

G DATA, with its 365 MXDR solution, successfully participated, demonstrating that even outsourced, managed security services can be rigorously evaluated under realistic, controlled attack conditions.

This expansion of the testing scope reflects the growing trend of organizations leveraging external expertise for their detection and response needs, and it provides a vital independent benchmark for these critical services.

For CISOs wrestling with budget allocations and vendor selections, these certifications are more than just badges of honor; they are strategic intelligence.

In an era where a single undetected breach can spell catastrophic financial and reputational damage, understanding a security product’s true detection prowess is non-negotiable.

AV-Comparatives’ transparent certification model, where only products meeting a stringent detection threshold are publicly listed, empowers organizations to make truly informed decisions, moving beyond marketing claims to validated performance.

Looking ahead, AV-Comparatives is committed to refining its methodology, having already incorporated feedback from independent analysts to enhance transparency, improve scoring, and deepen telemetry data validation.

Further enhancements are planned for the 2026 certification cycle, signaling a continuous evolution in line with the ever-changing threat landscape.

The EDR Detection Validation test remains open to all EPP, EDR, XDR, and MDR providers seeking independent validation, offering both industry recognition and invaluable technical insights into their solutions’ real-world performance.

In the ongoing digital arms race, such independent assessments are not just beneficial, but essential, fostering a higher standard of cybersecurity and ultimately, a more resilient digital world.