CrowdStrike Earns AAA Award, 100% Total Accuracy Score in SE Labs Q3 Enterprise Advanced Security Test

  • The CrowdStrike Falcon® platform earns the AAA award in SE Labs Q3 2024 Enterprise Advanced Security Test
  • The Falcon platform outperformed all other vendors in accurately detecting the real-world cross-domain tradecraft of three infamous adversaries: APT29 (COZY BEAR), SCATTERED SPIDER and the DPRK Ransomware Group. 
  • CrowdStrike’s perfect performance — 100% Detection Accuracy, 100% Legitimate Accuracy, 100% Total Accuracy and zero false positives — reflects the Falcon platform’s best-in-class, adversary-driven protection needed to stop breaches.

The CrowdStrike Falcon platform started 2024 being recognized as SE Labs’ Best Endpoint Detection and Response 2024 award for the third consecutive year. Adversaries never stop and neither do we — CrowdStrike Falcon is the only platform that provides a unified view of stealthy threats across multiple domains exploited in attack paths. The advantages of our unified AI-native platform, from AI-powered indicators of attack to sophisticated memory scanning, together with our award-winning threat intelligence, continue to deliver an industry-leading ability to stop breaches. 

In this latest achievement, CrowdStrike Falcon earned the AAA award with a perfect performance in the SE Labs Q3 Enterprise Advanced Security (EAS) Test. 

The Falcon platform was the only endpoint detection and response (EDR) product in this test to achieve a perfect score in all categories: 100% Detection Accuracy, 100% Legitimate Accuracy, 100% Total Accuracy and zero false positives.

SE Labs EDR Testing Replicates Sophisticated Attacks

In the SE Labs Q3 EAS test, EDR solutions faced attacks modeled after three real-world threats: COZY BEAR (a nation-state group focused on intelligence gathering), SCATTERED SPIDER and the DPRK Ransomware Group, both financially driven eCrime actors. These groups aren’t just interested in breaching systems — they aim to establish control. COZY BEAR seeks long-term access to sensitive networks, while eCrime actors move quickly to exploit resources for financial gain.

Adversaries often focus on gaining a foothold within the target environment to escalate privileges so they can move laterally and achieve their objectives, whether that involves exfiltrating sensitive data or deploying ransomware. This makes detecting the full attack chain absolutely critical. A gap at any stage could give attackers the access they need to expand their reach and evade containment.

This SE Labs test didn’t just assess the ability to spot malware — it also evaluated how EDR solutions detect and disrupt adversary activity across every phase of the attack chain. SE Labs tested the EDR solutions using the tools and tactics employed by the three adversaries. It attempted to gain low-level access to target systems, escalate privileges and expand through lateral movement. Ultimately, the goal was to gain sufficient access to critical systems to complete a mission of stealing information or causing damage. The EAS test demonstrated how robust detection identifies adversary activity early, enabling timely responses to stop attackers before they can compromise critical assets.

The test also measured precision to ensure defenses can detect real threats without flagging benign activities as malicious. This balance is key to reducing noise for SOC teams and maintaining business continuity, demonstrating that effective, real-world protection doesn’t have to come at the cost of operational efficiency.

Figure 1. Detailed CrowdStrike Falcon response results from SE Labs EAS test (copyright: SE Labs) Figure 1. Detailed CrowdStrike Falcon response results from SE Labs EAS test (copyright: SE Labs)
Figure 2. Summary of SE Labs EAS test results (copyright: SE Labs) Figure 2. Summary of SE Labs EAS test results (copyright: SE Labs)

“CrowdStrike Falcon achieved perfect results in this test, detecting every element of each threat, and making no mistakes with legitimate applications.”

As a result of its performance, the Falcon platform was awarded SE Labs’ AAA award in Enterprise Advanced Security for the quarter. 

A Unified Adversary-Focused Platform Makes All the Difference

CrowdStrike’s perfect performance in SE Labs’ test underscores a key reality: Organizations don’t face a malware problem — they face an adversary problem. Malware is just a tool, but adversaries like COZY BEAR, SCATTERED SPIDER and the DPRK Ransomware Group are the true threats. These groups operate with clear objectives, whether they’re stealing intelligence or generating profit, and they adapt their tools and techniques to bypass traditional defenses.

That’s why the Falcon platform takes an adversary-focused approach. By unifying threat intelligence, comprehensive detection and AI-driven behavioral analysis, the Falcon platform detects and disrupts the tactics, techniques and procedures (TTPs) behind every attack regardless of the tools used. This unified view across domains ensures organizations can stay ahead of evolving threats and stop adversaries before they achieve their goals.

In today’s landscape, where attackers exploit every possible vulnerability, only a unified adversary-focused platform can provide the protection needed to outpace and outsmart them. The results from SE Labs’ test demonstrate that with CrowdStrike Falcon, organizations can harden their infrastructure against even the most sophisticated threats with confidence.

Read more about the SE Labs Q3 2024 Enterprise Advanced Security Test here.

Additional Resources

  • CrowdStrike was named a Leader in the 2024 Gartner® Magic Quadrant™ for Endpoint Protection Platforms. Read the report.
  • Learn more about hunting adversaries like COZY BEAR and SCATTERED SPIDER in this blog.
  • Test drive the Falcon platform for yourself with a free trial.
Breaches Stop Here