SEATTLE – December 10, 2025 – WatchGuard® Technologies, a global leader in unified cybersecurity, today announced that its endpoint security solution delivered outstanding performance in the latest MITRE ATT&CK® Enterprise Round 7 (ER7) Evaluation. The results highlight WatchGuard’s ability to combine strong threat prevention with low-noise detection, giving Managed Service Providers (MSPs) a reliable and efficient way to deliver high-quality security services at scale.
In the Windows “Hermes” scenario, WatchGuard achieved comprehensive detection and flawless prevention across the evaluated adversary techniques while maintaining exceptionally low alert volume, no blocked legitimate processes, and minimal operational friction. These independently validated results reinforce WatchGuard’s commitment to predictable security outcomes that strengthen partner service delivery and drive real-world value.
“Security teams and MSPs need protection that works without slowing down their business,” said Andrew Young, chief product officer and senior vice president product management at WatchGuard Technologies. “These results prove that full protection doesn’t require more workload. With WatchGuard, you get fewer alerts, fewer manual interventions, and faster response times, which is exactly what our partners count on to deliver reliable and scalable security services.”
The MITRE ATT&CK evaluation showed that WatchGuard detected and blocked every malicious step tested, surfacing only the most actionable insights. Across two full attack paths, WatchGuard generated just three high-fidelity alerts, helping MSPs reduce noise, streamline investigations, and strengthen service delivery.
Key results from the evaluation include:
- 100% Attack Visibility
- 100% step detection across the entire evaluation1
- 96% sub-step detection2 (27/28 covered)
- 100% Threat Prevention
- 100% prevention of all malicious actions3
- Zero Operational Friction
- Zero legitimate activity blocked
-
Only three high-fidelity alerts
These outcomes demonstrate that WatchGuard delivers full attack-path visibility and dependable protection without generating alert storms, blocked false positives, or customer-impacting disruptions common with many security tools. This combination of proven security efficacy and low operational burden strongly differentiates WatchGuard in the endpoint security market.
For MSPs, the real-world benefits include stronger customer outcomes, fewer unnecessary escalations, faster response cycles, and more efficient use of analyst resources.
"We’ve relied on WatchGuard’s endpoint security for years," said Neil Holme, founder and CEO of Impact Business Technology, a WatchGuard MSP. "MITRE ER7 simply confirms what we already knew: WatchGuard turns EDR from reactive to proactive. Anything unknown is untrusted. Every alert comes with the confidence that the response has already been initiated. No guesswork. Just better protection.”
Empowered with WatchGuard’s Unified Security Platform® architecture, the MITRE ER7 performance underscores how WatchGuard enables partners to scale services while reducing complexity and increasing profitability.
For more information on WatchGuard’s performance in the MITRE ATT&CK® ER7 Evaluation, visit WatchGuard’s MITRE ER7 results page.
1 Result from MITRE Detections Evaluation for both the initial and configuration change runs in the Windows scenario
2 Result from MITRE Detections Evaluation for the run with configuration changes in the Windows scenario
3 Result from the MITRE Protection Evaluation