With cyberattacks becoming more sophisticated and endpoints still the main target for cybercriminals, the importance of reliable endpoint protection cannot be overestimated. However, judging the effectiveness of these solutions is not an easy task, and many factors, such as the ability to detect, relevancy, and accuracy are at play when assessing how well the product will help during a real attack.

To evaluate Kaspersky EDR capabilities, SE Labs’ engineers tested the product under a range of complex attacks similar or identical to those used by Dragonfly and Dragonfly 2.0, FIN7 and Carbanak, Oilrig, and APT29 threat groups. The solution’s performance was tracked at all major attack stages, from delivery to escalation and lateral action. Testers behaved as real adversaries, probing targets using a variety of tools, techniques, and vectors before attempting to gain access to the infrastructure. After that, they tried to complete the attack goal, including stealing information, damaging systems and connecting to other systems on the network. The test also considered the EDR’s ability to correctly identify legitimate applications and behavior, and measured any false positive detections or other sub-optimum interactions.

According to the independent laboratory, Kaspersky EDR detected every targeted attack and tracked each of the hostile activities that occurred during the test. Even better, it also detected in-depth insights, capturing details as each threat proceeded down the attack chain from the initial introduction to the system through its execution and subsequent behavior by the attacker. With 100% of attacks detected, the solution also showed outstanding results in classifying legitimate applications and URLs with a 100% legitimate accuracy rating. 

Based on the total sum of the evaluated criteria, Kaspersky Endpoint Detection and Response finished with 98% in the total accuracy rating and was awarded the highest level of estimation – the AAA Award.

Kaspersky Endpoint Detection and Response (EDR) provides visibility across all endpoints on a company’s corporate network and delivers superior defenses, enabling automation of routine tasks to discover, prioritize, investigate and neutralize complex threats and APT-grade attacks.

The full report, detailing the performance of Kaspersky EDR during the SE Labs’ test, is available via this link.

For more information about Kaspersky Endpoint Detection and Response, download the datasheet in PDF format.

SE Labs Ltd is a private, independently-owned and run testing company that assesses security products and services. The main laboratory is located in Wimbledon, South London. SE Labs has developed next-generation testing to prove the abilities of 'next-generation' security products using a comprehensive, full-stack approach to security assessment powered by true and detailed threat intelligence. SE Labs is a member of the Microsoft Virus Information Alliance (VIA); the Anti-Malware Testing Standards Organization (AMTSO); and the Messaging, Malware and Mobile Anti-Abuse Working Group (M3AAWG).