Toughest Test Yet: 11 of 14 Pass AV-Comparatives EPR Test 2026

AV-Comparatives awarded Certified Leader status to 11 of 14 enterprise endpoint-security products in its 2026 EPR Test, which evaluated 50 multi-stage attack scenarios including AI-assisted attack tooling. Bitdefender, Broadcom, Check Point, Elastic, ESET, Fortinet, G Data, Palo Alto Networks, TrendAI, VIPRE and WithSecure cleared the stricter 92% combined threshold, up from the test's original 90% bar. The results validate strong enterprise protection against AI-enabled threats, though the expanding use of AI in cyberespionage underscores a persistent threat backdrop.

Analysis

This is not a near-term revenue catalyst for any covered vendor; the broad pass rate instead makes endpoint efficacy a weaker differentiator in enterprise procurement. For PANW, CHKP, FTNT and AVGO, independent validation reduces competitive-displacement risk but does not justify multiple expansion unless it translates into platform consolidation, lower churn, or higher win rates. The more important implication is that endpoint prevention is becoming table stakes as AI-enabled attack tools lower adversary costs, shifting buyer value toward response automation, identity telemetry, cloud-security integration and managed services.

PANW is best positioned to monetize that shift because Cortex/Unit 42 can attach higher-value response and platform modules to endpoint deployments; CHKP benefits defensively through installed-base retention, but its valuation upside still depends on demonstrating cloud and SASE growth. Elastic's ESTC has a differentiated second-order opportunity: higher endpoint telemetry volumes and more frequent investigations increase SIEM/search consumption, though this only matters if customers do not consolidate those workloads into PANW, Microsoft or Splunk/Cisco. FTNT's endpoint relevance is modest relative to its firewall/SASE exposure, making any read-through to its earnings immaterial.

Over the next 1-3 months, monitor enterprise RFP language and vendor earnings commentary for AI-attack-driven budget releases versus budget reallocation. The contrarian risk is that AI-assisted attacks raise the cost of security operations faster than prevention efficacy, causing customers to favor Microsoft bundles and larger platform vendors rather than point products; this would pressure ESTC and smaller endpoint vendors despite favorable test outcomes. The thesis is falsified if PANW or CHKP report stable endpoint results but declining platform attach, weaker net retention, or increased discounting in the next two earnings cycles.

Key Decisions for Investors

• No standalone event trade: treat the result as a confirmation signal rather than an earnings estimate revision, given its limited ability to distinguish the leading vendors.
• Maintain a 6-12 month long PANW / short ESTC relative-value bias, sized modestly: PANW has greater ability to convert elevated threat complexity into bundled platform and incident-response revenue, while ESTC faces greater telemetry-budget consolidation risk. Reassess if ESTC posts accelerating security growth and net-expansion improvement, or PANW reports material Cortex pricing pressure.
• Prefer CHKP over FTNT for defensive cybersecurity exposure into the next earnings cycle: CHKP's endpoint validation supports installed-base retention, whereas FTNT's upside remains more dependent on appliance demand normalization. Exit the relative trade if FTNT billings growth reaccelerates materially above CHKP's subscription/security growth.
• Set an alert for Q3/Q4 earnings calls: actionable upside requires evidence of endpoint-driven platform attach, incident-response bookings, or security-operations spending growth—not generic references to AI threats. Absent those metrics, avoid paying a higher multiple for certification headlines.