Modern EDR-XDR-SIEM platforms should provide full visibility into attacks, effective threat detection, and support for incident response processes across endpoint, cloud, and network environments. In practice, however, detection alone is not sufficient to fully understand the course of a cyberattack. It is crucial that the solution provides detailed telemetry and event correlation mechanisms that enable the reconstruction of the full attack chain—from the point of entry, through the execution of subsequent actions, to their impact on systems and data.
In AVLab tests, we focus on verifying precisely these capabilities. We simulate realistic, multi-stage attack scenarios and verify whether the solution provides full telemetry visibility, effective event correlation, and the context necessary for SOC teams to reconstruct an incident from Initial Access to Exfiltration.
The tests are conducted in accordance with recognized industry standards, ensuring the comparability of results, transparency of methodology, and the possibility of independent verification.
We conduct an independent technical assessment of EDR-XDR-SIEM solutions based on realistic, multi-stage attack scenarios. The goal of the assessment is to verify whether the solution provides sufficient visibility, telemetry, and event correlation to enable a full understanding and reconstruction of an incident. Additionally, we verify the extent to which behavioral analysis and artificial intelligence mechanisms support threat detection, event correlation, analysis of attacker activities, and response and remediation processes.
The test covers the following areas:
Independent verification of the solution's feasibility and identification of the product's strengths and weaknesses.
Assessment of the solution's usability during incident detection, analysis, and response.
A comparison of solutions based on a consistent methodology and realistic attack scenarios.
MITRE ATT&CK
T1204.002 - User Execution
T1071.001 - Web Protocols
T1021.002 - SMB Admin Shares
T1047 - WMI
T1041 - C2 Exfiltration
verification of new product versions and updates
e.g., ransomware, lateral movement, fileless attacks
verification of configuration and policy changes
iterative enhancement of detection and response capabilities
validation against emerging attack techniques and threats
evaluation of telemetry quality, visibility, and event correlation
validation before customer rollout
testing of specific MITRE ATT&CK techniques and procedures
verification of SOC, threat hunting, and customer-specific detection scenarios
validation against previous versions and competitors
Join the developers certificated by the independent organization.
Use the certificate for marketing purposes, e.g. place it on your website, promote your company in a magazine, allow potential customers to see that you own a reputable solution.
Safely test out your solution in a controlled environment.
Receive feedback and improve the effectiveness of your security product.
Definition of the test scope, attack scenarios, and technical objectives.
Provision of licenses, configuration details, and deployment guidelines (policies, operating modes, integrations).
Preparation of the test environment according to the solution requirements.
Execution of attack scenarios, followed by telemetry collection and analysis.
Delivery of a detailed technical report and discussion of the findings.
Our experience includes multi-stage, fileless, and living-off-the-land attack scenarios, as well as collaboration with security technology vendors.
We are a participant in the Microsoft Virus Initiative (MVI), which enables us to collaborate with the Microsoft security ecosystem and provides access to information relevant to the testing of security solutions.
We operate in accordance with AMTSO standards, which define transparency, repeatability, and objectivity in security testing. Participation in AMTSO entails the use of recognized testing practices, such as configuration transparency, verifiable results, and collaboration with vendors during the preparation and execution of tests.
We welcome cybersecurity vendors and technology developers interested in independent testing, certification, and technical assessments.
Vendors can participate directly in the Advanced In-The-Wild Malware Test or obtain a Certification-Only Package for a product independently tested by AVLab. Paid participation provides access to extended technical services, test data, and custom configuration options, while result review and verification remain available to all tested vendors.
Commercial use of AVLab certificates, certification badges, and award materials by independently tested vendors requires either Paid Assessment Participation or a Certification-Only Package. Independently tested vendors without either option may be listed in AVLab results and certification records but are not granted the right to use AVLab certification materials in their own marketing or communications.
