Elastic leads the latest AV-Comparatives Malware Protection Test with a perfect score

The Malware Protection Test simulates the scenario every business eventually faces: malware that's already on the disk or arrives over the LAN or on a removable drive, rather than straight off a website. AV-Comparatives ran 1,000 recent malware samples against every product, scanning on access and then executing anything that slipped through, so behavioral defenses had a chance to react. Elastic came out on top, being the only vendor with a perfect score as stated by AV-Comparatives:

The Real-World Protection Test is the harder one, simulating what a business user actually runs into while browsing like malicious URLs, drive-by exploits, and socially engineered downloads. It also lets every layer of the product step in at any stage: URL blocking, download inspection, behavioral analysis, and memory protection. The test was run continuously from March through June 2026 across 400 test cases and is the closest test simulating the real-world scenarios inside a lab.

Elastic Security achieved the highest score and blocked 399 of 400 threats — a 99.8% protection rate alongside two other vendors.

Alert fatigue is real, and protection scores only mean something when they're paired with accuracy. AV-Comparatives is rigorous about testing both. Elastic recorded zero false alarms on common business software in both tests, which is the metric that matters most for day-to-day operations and a hard requirement for certification. On less common and non-business files, Elastic landed in the "High" false-positive band and was flagged alongside other vendors for above-average false positives in the Real-World Protection Test.

That aggressive prevention is exactly why our protection numbers are so high. While it might flag the occasional uncommon or non-business file, we review those cases quickly and adjust our rules. For teams that regularly run unusual internal tooling, it's a known dimension worth tuning. And Elastic's centralized policy management, trusted applications lists, and endpoint exceptions are the tools to help and support through the process.

The Performance Test measures how much a product slows down everyday work like copying files, launching apps, browsing, and installing software on deliberately low-end hardware (a Core i3 with 8 GB of RAM). Elastic Security posted a total impact score of 24.2, sitting comfortably under the 40-point threshold required for certification with a Procyon office-productivity score of 90.8 against a clean-system baseline of 100. That is a solid result for a comprehensive security solution running on a modest machine, proving that the best protection doesn’t need to sacrifice performance.

This round of testing from AV-Comparatives says something specific and verifiable: Elastic Defend delivers best-in-field prevention — the only 100% malware protection rate in the test and a top-tier real-world score — while staying within the accuracy and performance limits that keep security teams productive rather than buried in noise.

Elastic Defend is the endpoint layer of Elastic Security, which unifies endpoint protection, SIEM, investigation, response, and automation and can ingest telemetry from the third-party tools you already run. It deploys in connected, restricted-network and fully air-gapped environments with security content distributed over internal infrastructure when there's no direct internet access.

Join the growing number of businesses that trust Elastic Security to protect their organization against attacks. Experience the peace of mind that comes with knowing that your endpoints and organization as a whole are secure against the latest threats. Start your Elastic Security free trial, and discover the difference that our protection can make. Visit elastic.co/security to learn more.