Fortinet is pleased to announce that FortiEndpoint with EDR earned Certified Leader status in the 2026 AV-Comparatives Endpoint Prevention and Response (EPR) Test. Certified Leader is the highest distinction in the test and recognizes products that combine strong prevention and detection with operational accuracy and minimal workflow disruption.

In the independent evaluation, FortiEndpoint with EDR detected malicious activity in all 50 attack scenarios during the first phase and prevented each scenario from reaching the final asset-breach phase. AV-Comparatives reported an overall active response rate of 97.3% and a passive response rate of 100%, along with low operational accuracy costs and no workflow delay costs.

This is the second consecutive year that a Fortinet solution has earned certification in the AV-Comparatives EPR Test, providing ongoing independent validation of the EDR capabilities available through FortiEndpoint.

How AV-Comparatives Evaluated Endpoint Prevention and Response

The 2026 EPR Test evaluated 14 enterprise security solutions against 50 realistic, multistage attack scenarios. The scenarios spanned the full attack chain across three phases: compromise and foothold, internal propagation, and asset breach. They included phishing, scripts, installers, fileless malware, lateral movement, and data-exfiltration techniques mapped to the MITRE ATT&CK Matrix for Enterprise framework.

Rather than testing isolated malware samples, AV-Comparatives assessed how each product prevented, detected, and reported activity throughout an attack. Vendors were not given the exact test timing or attack details in advance. AV-Comparatives also used AI-assisted development methods to build testing tools and scenario variations, reflecting the ongoing evolution of attacker tooling.

The results for FortiEndpoint with EDR Essentials 6.2 included:

• Active response (prevention): AV-Comparatives defines active response as the automatic interruption and reporting of an attack. The report recorded an overall active response rate of 97.3%, with 92% prevention in Phase 1 and 100% prevention in all other Phase 2 scenarios.
• Passive response (detection): FortiEndpoint achieved the maximum passive response rate of 100%, detecting all 50 attack scenarios in the first phase.
• Low operational accuracy costs: These costs arise when legitimate programs or activities are incorrectly blocked or flagged. FortiEndpoint recorded low additional costs due to imperfect operational accuracy.
• No workflow delay costs: These costs occur when product analysis delays normal user activity, such as requiring a user to wait while a file is analyzed. FortiEndpoint recorded no workflow delay costs.

The report also shows a 100% cumulative active and passive response across the entire attack chain. In practical terms, FortiEndpoint detected every scenario at the first stage and ultimately contained every attack before it could reach a protected asset.

Why These Results Matter to SOC Teams

Effective endpoint security must do more than stop attacks. SOC teams also need clear, timely information to help analysts understand what happened, prioritize the right incidents, and respond without creating unnecessary friction for users.

“Fortinet FortiEndpoint with EDR achieved Certified Leader status in the AV-Comparatives EPR Test 2026,” says Andreas Clementi, founder and CEO of AV-Comparatives. “The product detected every tested attack activity already at the first stage and went on to contain every scenario before it could progress toward an asset breach. That level of visibility, paired with low operational accuracy costs, gives SOC teams confidence in what they are seeing.”

AV-Comparatives also found that FortiEndpoint remained effective against stealth and evasion techniques. The report described the management console as easy to use and intuitive, with contextual information that helps SOC analysts prioritize threats. It also noted the product’s MITRE ATT&CK mapping and its use of prioritized, aggregated alerts to reduce noise.

Unified Endpoint Security with FortiEndpoint

The EDR capabilities evaluated in the test are available through FortiEndpoint, Fortinet’s unified endpoint solution. FortiEndpoint combines endpoint protection (EPP) and EDR with secure access, data security, vulnerability and patch management, threat-hunting telemetry, and AI-assisted operations, all delivered through a unified agent, management console, and license.

Consolidating these capabilities helps organizations reduce agent sprawl, simplify endpoint operations, improve visibility, and accelerate detection and response. Native integration with the Fortinet AI-Native Security Fabric also enables endpoint telemetry and response actions to support broader security operations across the environment.

Independent Validation of Fortinet Endpoint Security

The 2026 certification demonstrates that FortiEndpoint can detect advanced attack activity early, contain threats before an asset breach, and provide analysts with the context needed to investigate and respond. For organizations evaluating endpoint security, the results offer independent evidence of both protection efficacy and operational usability.

Read the full AV-Comparatives 2026 EPR Test report to learn more about the evaluation methodology and review Fortinet’s results.

Learn more about FortiEndpoint and FortiEDR and how they can effectively support and expand your security operations.