Modern EDR-XDR-SIEM platforms should provide full visibility into attacks, effective threat detection, and support for incident response processes across endpoint, cloud, and network environments. In practice, however, detection alone is not sufficient to fully understand the course of a cyberattack. It is crucial that the solution provides detailed telemetry and event correlation mechanisms that enable the reconstruction of the full attack chain—from the point of entry, through the execution of subsequent actions, to their impact on systems and data.
In AVLab tests, we focus on verifying precisely these capabilities. We simulate realistic, multi-stage attack scenarios and verify whether the solution provides full telemetry visibility, effective event correlation, and the context necessary for SOC teams to reconstruct an incident from Initial Access to Exfiltration.
The tests are conducted in accordance with recognized industry standards, ensuring the comparability of results, transparency of methodology, and the possibility of independent verification.
We conduct an independent technical assessment of EDR-XDR-SIEM solutions based on realistic, multi-stage attack scenarios. The goal of the assessment is to verify whether the solution provides sufficient visibility, telemetry, and event correlation to enable a full understanding and reconstruction of an incident. Additionally, we verify the extent to which behavioral analysis and artificial intelligence mechanisms support threat detection, event correlation, analysis of attacker activities, and response and remediation processes.
The test covers the following areas:
Independent verification of the solution's feasibility and identification of the product's strengths and weaknesses.
Assessment of the solution's usability during incident detection, analysis, and response.
A comparison of solutions based on a consistent methodology and realistic attack scenarios.
MITRE ATT&CK
T1204.002 - User Execution
T1071.001 - Web Protocols
T1021.002 - SMB Admin Shares
T1047 - WMI
T1041 - C2 Exfiltration
verification of new product versions and updates
e.g., ransomware, lateral movement, fileless attacks
verification of configuration and policy changes
iterative enhancement of detection and response capabilities
validation against emerging attack techniques and threats
evaluation of telemetry quality, visibility, and event correlation
validation before customer rollout
testing of specific MITRE ATT&CK techniques and procedures
verification of SOC, threat hunting, and customer-specific detection scenarios
validation against previous versions and competitors
Join the developers certificated by the independent organization.
Use the certificate for marketing purposes, e.g. place it on your website, promote your company in a magazine, allow potential customers to see that you own a reputable solution.
Safely test out your solution in a controlled environment.
Receive feedback and improve the effectiveness of your security product.
Our experience includes multi-stage, fileless, and living-off-the-land attack scenarios, as well as collaboration with security technology vendors.
We are a participant in the Microsoft Virus Initiative (MVI), which enables us to collaborate with the Microsoft security ecosystem and provides access to information relevant to the testing of security solutions.
We operate in accordance with AMTSO standards, which define transparency, repeatability, and objectivity in security testing. Participation in AMTSO entails the use of recognized testing practices, such as configuration transparency, verifiable results, and collaboration with vendors during the preparation and execution of tests.
