Elastic stopped all 50 attack scenarios at the first phase of compromise, with zero false positives and one of the lowest total costs of ownership among 14 vendors
Elastic announced that Elastic Security achieved the only perfect protection score in AV-Comparatives’ 2026 Endpoint Prevention and Response (EPR) Test, earning Certified Leader status, the highest distinction AV-Comparatives awards in the test. Elastic sits at the very top of this year’s Certified Leader group, with 100% Active and 100% Passive Response scores and the lowest modeled operational footprint of any product tested. This is the second consecutive year Elastic has earned Certified Leader status.
Also Read: CIO Influence Interview with John Elliott, Cybersecurity Author Fellow at Pluralsight
Elastic was the only vendor to block and report all 50 threats at the first phase of the test, before any progressed to Internal Propagation or Asset Breach. Elastic also had one of the lowest total costs of ownership (TCO) among the 14 vendors tested.
Prevention strength matters because AI-powered attacks no longer move at human speed. Adversaries now deploy automated toolchains that compress the time from initial access to lateral movement, data exfiltration, and persistence to minutes, not hours. At that velocity, detection and response alone cannot keep pace; the window to intervene after an intrusion begins is too narrow. Elastic stops more threats before they execute, matching machine-speed attacks with machine-speed prevention.
AV-Comparatives tested 14 vendors against 50 multi-phase attack scenarios built on techniques from the MITRE ATT&CK framework. Phase one covers the first three MITRE ATT&CK chain tactics: Initial Access, Execution, and Persistence. The scenarios included executables, scripts, Office add-ins, USB-propagated payloads, fileless execution techniques, AMSI bypasses, and EDR unhooking. This year’s test also incorporated AI-assisted development methods to build testing tools and scenario variations to better reflect how attacker tooling has evolved.
“Elastic Security achieved Certified Leader status in the AV-Comparatives EPR Test 2026,” said Andreas Clementi, Founder and CEO of AV-Comparatives. “The product prevented and detected every one of the tested attack scenarios already at the first stage of compromise with no operational accuracy costs and no workflow delays for the user. It is a clean, complete result that reflects real strength in enterprise threat prevention.”
“AI is compressing attack timelines, and security teams can’t afford more alerts to triage. They need to stop threats before they turn into investigations,” said Mike Nichols, general manager, Security, Elastic. “Stopping every attack at the first phase of this test shows the strength of prevention in Elastic Security. A threat stopped at the endpoint is an alert that never opens, an investigation that never starts, and an incident that never escalates.”
This result extends Elastic Security’s strong performance across recent AV-Comparatives testing. Across the last three Business Security Tests spanning 2025 and 2026, Elastic was the only vendor to achieve 100% malware protection in every cycle, including the most recent test covering March through June 2026, where Microsoft and CrowdStrike were among vendors tested.
Elastic Defend, Elastic’s native endpoint protection, is available for Windows, macOS, and Linux across cloud, on-premise, hybrid, and air-gapped environments.
Catch more CIO Insights: How Are CIOs Aligning Technology with Workforce Agility?
[To share your insights with us, please write to psen@itechseries.com ]
