---
title: "Three Gartner Leaders skipped MITRE's latest test: what AI endpoint security measured"
summary: "11 vendors sat MITRE's ATT&CK Enterprise 2025 round; Microsoft, Palo Alto and SentinelOne did not. Detection, false positives, the May 2026 Gartner Leaders and published prices, as of September 2026."
url: https://www.thetechbag.com/blog/ai-endpoint-security-what-mitre-2025-measured
format: Analysis
desk: "Endpoints & devices"
published: 2026-08-25
facts_checked: 2026-09-30
author: TechBag (The TechBag Journal)
tags: ["MITRE ATT&CK","EDR","endpoint protection","CrowdStrike","SentinelOne","Gartner Magic Quadrant","CERT-In","DPDP","pricing"]
cover: https://www.thetechbag.com/blog/covers/ai-endpoint-security-what-mitre-2025-measured.png
---

# Three Gartner Leaders skipped MITRE's latest test: what AI endpoint security measured

*11 vendors sat MITRE's ATT&CK Enterprise 2025 round; Microsoft, Palo Alto and SentinelOne did not. Detection, false positives, the May 2026 Gartner Leaders and published prices, as of September 2026.*

Analysis · Endpoints & devices · By TechBag · Published 2026-08-25 · Facts checked 2026-09-30 · Canonical: https://www.thetechbag.com/blog/ai-endpoint-security-what-mitre-2025-measured

The short version

- Eleven vendors sat MITRE’s ATT&CK Enterprise 2025 evaluation, the only public test of AI-driven endpoint detection. Three of the six Gartner Leaders of May 2026, Microsoft, Palo Alto Networks and SentinelOne, withdrew from it.[1]
- Among the participants, CrowdStrike and Cynet report 100% detection and zero false positives, Sophos reports technique-level detections on 86 of 90 sub-steps, and Trend Micro reports 100% only “after configuration change”. MITRE itself ranks nobody.[2] [4] [5] [6]
- The EDR tier that makes the AI useful costs about three times the prevention tier: CrowdStrike Falcon Enterprise is US$184.99 a device a year against Falcon Go at US$59.99; SentinelOne Singularity Complete is US$179.99. In India add 18% GST and ask where the telemetry lives.[11] [12]

The question an Indian IT head asked us, when an earlier version of this piece ran, was simple: is “AI-driven” endpoint security a real improvement over the antivirus we have, and if so, whose? Now the question can be answered with measurements rather than brochure adjectives. MITRE ran its most demanding Enterprise evaluation yet and published the results in December 2025; Gartner published its endpoint quadrant in May 2026; and two of the three best-known vendors now print a per-device price on their own websites. This piece puts those three things side by side, says which figures are reported, which are TechBag counts and which are our view, and ends with what changes if you are buying in India.

## The one test that measures the AI, and who chose not to sit it

MITRE’s ATT&CK Evaluations are the closest thing the industry has to a public exam. The 2025 Enterprise round emulated two adversaries, the Scattered Spider crime group and the Chinese state-linked Mustang Panda, across 16 attack steps and 90 sub-steps, and for the first time tested attacks on cloud infrastructure, the AWS control plane.[1] [4] Eleven vendors took part: Acronis, AhnLab, CrowdStrike, Cyberani, Cybereason, Cynet, ESET, Sophos, Trend Micro, WatchGuard and WithSecure. Microsoft, Palo Alto Networks and SentinelOne withdrew, citing the resources the programme demands.[1] Bitdefender and Check Point were not among the participants either.

ReportedMITRE’s own words, December 2025

“The evaluations do not rank vendors but provide objective, evidence-based results.” The 2025 framework was “enhanced to place greater emphasis on protection” and the detection side was “rebalanced to prioritize high-fidelity alerts” to reduce alert fatigue.[1]

The detection figures below are what each vendor reports from its own results page, in MITRE’s categories. The top rating a sub-step can earn is a **Technique-level** detection: the product named the ATT&CK technique, not merely that something happened. CrowdStrike reports “100% detection coverage across all ATT&CK techniques tested”; Cynet reports “100% Technique-Level Coverage in Initial Run”, with its 90 detections made “without the need for configuration changes”; Sophos reports “full Technique-level detections for 86 of the 90 adversary activities evaluated”, in the “Configuration Change” run; Trend Micro reports “100% analytic coverage across all major attack steps”, also after configuration change, and publishes no sub-step count.[2] [4] [5] [6]

**Figure: Of the MITRE 2025 participants checked here, two report technique-level detection on every sub-step and one on 86 of 90**

*Share of the 90 sub-steps with a Technique-level detection, as reported by each vendor, MITRE ATT&CK Enterprise 2025 (published December 2025)*

CrowdStrike Falcon

100% detection coverage, zero false positives

100%

Cynet

initial run, no configuration changes

100%

Sophos

86 of 90, configuration-change run

95.6%

|  | Value (%) |
| --- | --- |
| CrowdStrike Falcon | 100 |
| Cynet | 100 |
| Sophos | 95.6 |

Source: CrowdStrike, Cynet and Sophos results pages (10 December 2025); Trend Micro publishes step-level coverage only and is not charted · as of September 2026 · Microsoft, Palo Alto Networks and SentinelOne withdrew; Bitdefender and Check Point did not participate. Vendor-reported; MITRE does not rank.

Two cautions, both from people with no product to sell. MITRE’s own line is that nobody wins. And Forrester’s Allie Mellen wrote, of the previous round, that a vendor claiming 100% “is likely doing one or more of the following”: manipulating results, using unrealistic settings, or treating the evaluation as a competition.[1] The configuration-change caveat is where that bites. A result earned after the vendor re-tuned the product mid-test is a different fact from a result earned in the first run, and only Cynet’s page states plainly that its figures are first-run.[5]

## Protection and false positives are the numbers to buy on

Detection is what the 2025 round was famous for; protection and noise are what a buyer lives with. MITRE added a protection test that measures whether the attack step was blocked, and a noise test in which benign activity is run alongside the attack to see what the product wrongly flags.[1] CrowdStrike reports “100% protection” and “zero false positives”, and says that on Protection Test 6, the noise test, it reported no benign activity.[2] Cynet reports that it “blocked every one of the 5 attack steps at the Entry vector” and recorded “zero detection false positives (without configuration changes)”, correctly ignoring 17 legitimate sub-steps.[5] Trend Micro reports “100% protection across all evaluated attack opportunities” after configuration change and gives no false-positive count; Sophos’s public pages give detection figures only.[4] [6]

Why do the vendors that score full marks on detection also score zero on false positives? Because of how the machine works. The “AI” in an AI-driven endpoint product is a behavioural model sitting between a stream of telemetry and a response engine; the same threshold that decides whether a chain of events is an attack decides whether a legitimate administrator script gets quarantined. A vendor that tunes for the exam gets both numbers at once. That is the honest reason to read the two figures together and to insist on a first-run result.

**Figure: AI-driven endpoint security is one loop: telemetry in, a behavioural verdict, an automated response, a human check**

*The mechanism every EDR vendor in the MITRE round implements, and where each MITRE metric is measured*

1. 01TelemetryThe agent records process, file, registry, network and identity events continuously, on the endpoint and, since 2025, in the cloud control plane.
2. 02Behavioural modelA model trained on attack chains scores the sequence, not the file. MITRE’s detection categories measure how precisely it names the technique.
3. 03Verdict and responseAbove a threshold the agent kills, isolates or rolls back on its own. MITRE’s protection test measures the block; the noise test measures the wrong verdicts.
4. 04Analyst reviewWhat the model surfaces goes to a person or a managed service. This is the step the licence does not include and the one most Indian teams under-staff.

Source: TechBag reading of the MITRE 2025 methodology and the vendors’ result pages · as of September 2026

Our view

Our view: a first-run zero on false positives is worth more to a 200-seat Indian company than a 100% detection headline. A missed technique costs you once; a noisy agent costs you every working day, and the person who has to clear it is the one person in IT. Ask every shortlisted vendor for its MITRE 2025 page and read the configuration-change footnote before the detection number.

## Six Gartner Leaders, three of whom you cannot check against MITRE

Gartner’s Magic Quadrant for Endpoint Protection Platforms, dated 26 May 2026 in Microsoft’s citation and 27 May in Trend’s, names six Leaders: CrowdStrike (seventh consecutive placement), Microsoft (seventh), Palo Alto Networks (fourth), SentinelOne (sixth), Sophos (seventeenth report) and TrendAI, the renamed Trend Micro (its twenty-first recognition).[7] [8] [9] [10] Bitdefender is a Visionary for the fourth year running, per its own pages. Gartner’s analysts for the report were Deepak Mishra, Evgeny Mirolyubov and Nikul Patel.[10]

Put the two lists together and a gap opens. Half of the Leaders, Microsoft, Palo Alto Networks and SentinelOne, have no 2025 MITRE result because they chose not to be tested, so the latest public measurement of their detection is the 2024 round. Gartner’s placement is an analyst judgement of vision and execution, not a test, and Gartner says so. For a buyer that means the Leader label tells you the vendor is a safe shortlist; it tells you nothing about how the agent behaved against Scattered Spider in a cloud account.

**Figure: Half the May 2026 Leaders have no 2025 MITRE result to show you**

*Gartner Magic Quadrant for Endpoint Protection Platforms (May 2026) against MITRE ATT&CK Enterprise 2025 participation (December 2025)*

6

Gartner Leaders, May 2026

Vendor announcements, 26 to 29 May 2026

3 of 6

Leaders who withdrew from MITRE 2025

SecurityWeek, 11 December 2025

11

Vendors who sat MITRE 2025

SecurityWeek, 11 December 2025

2

Participants checked here reporting zero false positives, first run or not

CrowdStrike and Cynet results pages

Source: Vendor announcements of the Gartner placement; SecurityWeek on the MITRE participant list · as of September 2026

TechBag countTechBag count

TechBag’s endpoint-protection guide compares 36 product rows and records an India data region for every vendor that documents one; Gartner placements and MITRE results are not fields in it, so the figures above come from the vendors’ own pages. SentinelOne’s own TechBag hub records its Gartner Leader streak and says nothing about 2025 MITRE, because there is nothing to say.[13] [14]

## What the AI costs: the EDR tier is three times the prevention tier

Two of the Leaders print a price. CrowdStrike’s bundles page lists Falcon Go at US$59.99 a device a year (maximum 100 devices), Falcon Pro at US$99.99 and Falcon Enterprise at US$184.99, all billed annually; Falcon Complete, the managed service, is on quote.[11] SentinelOne’s packages page lists Singularity Complete at US$179.99 and Singularity Commercial at US$229.99 per endpoint a year, “for 5-100 workstations”, with every purchase made “through an authorized third-party partner” whose price “shall control”; Singularity Enterprise is on quote.[12]

The shape matters more than the decimals. Falcon Go and Pro are prevention: the behavioural model blocks, and that is all you see. Falcon Enterprise adds endpoint detection and response and threat hunting, which is the part that records telemetry, shows the investigation and gives the analyst in step four something to review. SentinelOne’s lowest published tier, Complete, already includes detection and response, which is why it lands beside Falcon Enterprise rather than beside Falcon Go.[11] [12]

**Figure: The tier with detection and response costs about three times the prevention tier at the same vendor**

*Published list price per device per year, US$, from the vendors’ own pricing pages, September 2026*

SentinelOne Singularity Commercial

adds identity, 90-day retention

US$229.99

CrowdStrike Falcon Enterprise

adds EDR and threat hunting

US$184.99

SentinelOne Singularity Complete

EDR in the base tier

US$179.99

CrowdStrike Falcon Pro

prevention + firewall management

US$99.99

CrowdStrike Falcon Go

prevention; max 100 devices

US$59.99

Bitdefender GravityZone Business Security

first-year price, TechBag count

US$57

ESET PROTECT Entry

prevention, TechBag count

US$42.2

|  | Value (US$) |
| --- | --- |
| SentinelOne Singularity Commercial | 229.99 |
| CrowdStrike Falcon Enterprise | 184.99 |
| SentinelOne Singularity Complete | 179.99 |
| CrowdStrike Falcon Pro | 99.99 |
| CrowdStrike Falcon Go | 59.99 |
| Bitdefender GravityZone Business Security | 57 |
| ESET PROTECT Entry | 42.2 |

Source: CrowdStrike bundles page; SentinelOne platform packages page; ESET and Bitdefender entry prices as recorded in TechBag’s endpoint-protection guide · as of September 2026 · Sophos publishes no list price; Bitdefender’s is a first-year promotional price. SentinelOne’s is for 5 to 100 workstations through a partner.

TechBag countTechBag count

Of the 36 rows in the guide, 22 carry a vendor-published price and 13 are quote-only; one is an open-source tier. Sophos Intercept X is quote-only, with reported street prices of about US$30 to US$50 a user a year. Bitdefender’s US$57 renews at a standard rate that users report at two to three times the first-year figure. The ESET and Bitdefender prices in the chart are TechBag’s reading of those vendors’ pages, not figures we re-fetched for this piece.[13]

## What you are actually replacing

An earlier version of this piece contrasted SentinelOne’s autonomy with ESET’s light footprint. The more useful contrast is between the two generations of product, because that is the decision an Indian company with a renewal date is making. Signature antivirus matches files against a list the vendor ships; it is cheap, light and blind to anything it has not seen. Behavioural EDR records what every process does and scores the sequence; it catches the fileless and living-off-the-land attacks that the 2025 round emulated, and it produces work for a person every day.

**Figure: The upgrade is not a better antivirus: it is a recorder, a model and a job for someone to do**

*Signature antivirus against behavioural EDR, on the dimensions the MITRE round and the price lists make visible*

Signature antivirus

- Matches a file hash or pattern against a list the vendor ships
- Blind to a technique it has not seen; no cloud control-plane visibility
- No telemetry retained; an incident leaves no timeline to investigate
- Low noise because it rarely fires; cheap because it does little
- Nobody has to watch it, which is why small teams keep it

Behavioural EDR

- Scores the sequence of events a process performs; tested technique by technique at MITRE
- Catches fileless, identity and cloud attacks: the Scattered Spider scenario
- Records telemetry (14 or 90 days at SentinelOne, by tier) so a response is possible
- Noise is a tuning decision; MITRE measures it, and a first-run zero is rare
- Someone has to review the verdicts: a person, or a managed service on quote

Source: TechBag reading of the MITRE 2025 methodology and the CrowdStrike and SentinelOne tier descriptions · as of September 2026

Which is why our answer to that question is now specific. If you have no one to read alerts, buy the prevention tier of a vendor with a first-run MITRE result and spend the difference on the managed service; CrowdStrike and SentinelOne both sell one, on quote. If you have an analyst, buy the EDR tier and make the vendor show you its MITRE 2025 page, including the footnote. If the vendor did not sit the 2025 round, ask why, and ask for its 2024 result instead. The [SentinelOne hub](https://www.thetechbag.com/sentinelone) and the [CrowdStrike hub](https://www.thetechbag.com/crowdstrike) on TechBag hold the dated claims for both.[12] [14]

If you are buying this in India

Three things change at the border. First, the price: at the ₹83 to the dollar our guide converts at, Falcon Enterprise is about ₹15,354 a device a year and Singularity Complete about ₹14,939; with 18% GST, ₹18,118 and ₹17,628. For 500 devices that is roughly ₹90.6 lakh and ₹88.1 lakh a year including GST, before the managed service, which is usually the larger line.[11] [12] [13] Second, the regulation. CERT-In’s Directions of 28 April 2022 require you to report listed incidents “within 6 hours of noticing” them and to “enable logs of all their ICT systems and maintain them securely for a rolling period of 180 days”, logs that “shall be maintained within the Indian jurisdiction”.[15] An EDR tier that keeps 14 days of telemetry does not meet that on its own; the 180 days sit in your SIEM or the vendor’s retention add-on, and both cost money. The DPDP Rules, notified on 13 November 2025, bring the security-safeguard, breach-intimation and retention duties into force on 13 May 2027; the Act’s schedule sets penalties of up to ₹250 crore for failing to keep reasonable security safeguards.[16] [17]

Third, where the telemetry goes. Endpoint telemetry is personal data about your staff. As of September 2026 TechBag’s pages record a documented India region for SentinelOne (Mumbai, since July 2023) and Sophos Central (Mumbai); CrowdStrike announced an in-country India cloud on 20 January 2026 as planned, with no go-live date, so an Indian Falcon tenant’s data is stored and processed in a US or EU region; for Microsoft Defender for Endpoint, Bitdefender, Palo Alto, Trend Micro and Check Point no India region is documented either way.[13] [14] [18] Of the 36 rows in our guide, 10 document an India region, 2 (both CrowdStrike) are “announced”, 1 says no and 23 are unverified. Get the region and the processing location in writing before the purchase order, and put the transfer in your DPDP notice. TechBag quotes every tier here in INR with GST and records the region on the quote.

How we did this

Figures as of September 2026

MITRE figures are taken from each vendor’s own results page for the Enterprise 2025 round, quoted in the vendor’s words and MITRE’s categories; MITRE’s results site renders only in a browser and was not scraped, so we did not independently recompute any sub-step count. The participant and withdrawal list is SecurityWeek’s report of MITRE’s publication. ESET, Acronis, WatchGuard, Cybereason and WithSecure also participated; we did not fetch their pages and state no figure for them. Gartner placements are from each vendor’s announcement, not the report. Prices are the vendors’ US pricing pages as they stood in September 2026, converted at the ₹83 our guide uses; ESET and Bitdefender prices are the guide’s record, not re-fetched. The 36-row, India-region and published-price counts are TechBag counts of the guide’s comparison data. The CERT-In wording is from the Directions PDF. Nothing here is a benchmark TechBag ran.

Spotted an error? Write to us; corrections are published at the foot of the piece.

Sources

1. [SecurityWeek, MITRE Posts Results of 2025 ATT&CK Enterprise Evaluations (participants, withdrawals, MITRE and Forrester quotes)](https://www.securityweek.com/mitre-posts-results-of-2025-attck-enterprise-evaluations/) — 11 December 2025
2. [CrowdStrike, CrowdStrike Achieves 100% Detection, 100% Protection and Zero False Positives in the 2025 MITRE ATT&CK Enterprise Evaluation](https://www.crowdstrike.com/en-us/blog/crowdstrike-achieves-100-percent-2025-mitre-attack-enterprise-evaluation/) — 10 December 2025
3. [MITRE, ATT&CK Evaluations Enterprise 2025 (ER7) results](https://evals.mitre.org/enterprise/er7) — December 2025 Browser-rendered; figures above are from the vendors' pages.
4. [Sophos, Sophos achieves 100% detection in the MITRE ATT&CK Enterprise 2025 Evaluation (86 of 90 technique-level; Configuration Change run)](https://www.sophos.com/en-us/content/why-sophos/mitre) — December 2025
5. [Cynet, MITRE ATT&CK 2025: Cynet results (100% detection visibility, 5 of 5 steps blocked, zero detection false positives, initial run)](https://www.cynet.com/blog/mitre-attack-2025-cynet-results/) — 10 December 2025
6. [Trend Micro, Cloud, automation and the 2025 MITRE ATT&CK Evaluations (Round 7)](https://www.trendmicro.com/en_us/research/25/l/cloud-automation-2025-mitre-attack-round-7.html) — 10 December 2025
7. [Microsoft Security blog, Microsoft is named a Leader in the 2026 Gartner Magic Quadrant for Endpoint Protection (seventh consecutive; report dated 26 May 2026)](https://www.microsoft.com/en-us/security/blog/2026/05/29/microsoft-is-named-a-leader-in-the-2026-gartner-magic-quadrant-for-endpoint-protection) — 29 May 2026
8. [Sophos, Sophos Named a Leader in the 2026 Gartner Magic Quadrant for Endpoint Protection Platforms (17th consecutive report)](https://www.sophos.com/en-us/press/press-releases/2026/05/sophos-named-a-leader-in-the-2026-gartner-magic-quadrant-for-endpoint-protection-platforms) — May 2026
9. [Palo Alto Networks, A 4X Gartner Magic Quadrant for EPP Leader; TechIntelPro on SentinelOne's sixth consecutive Leader placement](https://www.paloaltonetworks.com/blog/2026/05/a-4x-gartner-magic-quadrant-for-epp-leader-built-for-the-agentic-era/) — 29 May 2026 and 28 May 2026 SentinelOne: techintelpro.com, 28 May 2026.
10. [Digital Terminal, TrendAI recognised as a Leader in the Gartner Magic Quadrant for Endpoint Protection (Gartner report by Mishra, Mirolyubov and Patel, 27 May 2026)](https://digitalterminal.in/tech-companies/trendai-recognized-as-a-leader-in-gartner-magic-quadrant-for-endpoint-protection) — 13 June 2026
11. [CrowdStrike, Falcon bundles and pricing (Go US$59.99, Pro US$99.99, Enterprise US$184.99 per device per year)](https://www.crowdstrike.com/en-us/products/bundles/) — undated page
12. [SentinelOne, Singularity platform packages (Complete US$179.99, Commercial US$229.99 per endpoint per year, 5 to 100 workstations)](https://www.sentinelone.com/platform-packages/) — undated page
13. [TechBag, Endpoint Protection decision guide (36 product rows; prices, India regions and published-list flags)](https://www.thetechbag.com/browse/security/endpoint-protection) — TechBag count, September 2026
14. [TechBag, CrowdStrike Falcon Prevent page; CrowdStrike and SentinelOne hubs (Gartner Leader placements)](https://www.thetechbag.com/crowdstrike/crowdstrike-falcon-prevent) — TechBag record, September 2026
15. [CERT-In, Directions under section 70B(6) of the IT Act, 2000 (six-hour reporting; 180-day logs within Indian jurisdiction)](https://www.cert-in.org.in/PDF/CERT-In_Directions_70B_28.04.2022.pdf) — 28 April 2022
16. [DPDP Rules 2025, commencement timeline (notified 13 November 2025; Rules 3, 5 to 16, 22 and 23 from 13 May 2027)](https://legismith.com/dpdp-rules-2025-timeline/) — 13 November 2025
17. [Digital Personal Data Protection Act, 2023, Schedule (penalties)](https://www.meity.gov.in/data-protection-framework) — 11 August 2023
18. [CrowdStrike, CrowdStrike Announces New Regional Clouds to Expand Secure Data Sovereignty (Saudi Arabia, India, UAE; planned)](https://ir.crowdstrike.com/news-releases/news-release-details/crowdstrike-announces-new-regional-clouds-expand-secure-data) — 20 January 2026

Related on TechBag: the [endpoint protection guide](https://www.thetechbag.com/browse/security/endpoint-protection) holds every row counted here, with the chips that fade a product out of your shortlist on India region or operating model; the [managed detection and response guide](https://www.thetechbag.com/browse/security/managed-detection-response) prices the analyst you will otherwise have to hire.

**Disclosure.** TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view.

Go deeper on TechBag

- [Endpoint protection guide](https://www.thetechbag.com/browse/security/endpoint-protection) — the 36 rows, India regions and published prices counted here
- [CrowdStrike intel hub](https://www.thetechbag.com/crowdstrike) — the Falcon modules and the Gartner Leader placements, dated
- [SentinelOne intel hub](https://www.thetechbag.com/sentinelone) — Singularity tiers and the Gartner Leader streak