December 18, 2023
By Christoph Alme - Software Engineering Manager, Skyhigh Security
At Skyhigh Security, we believe that security is a data protection problem. This puts Threat Protection at the very core of our company DNA, strengthening the Skyhigh Security Service Edge (SSE) portfolio with decades of malware detection experience and our industry-leading anti-malware engine.
What makes up a good threat protection solution? Detection efficacy, obviously. We need to stop as much malware as early as possible. It needs to cover all types of malware in all possible formats – ranging from Ransomware and Data-Stealers to Exploits, from Windows platform to MacOS and Android.
At the same time, accuracy needs to be high for production use: false positives need to be avoided not to overwhelm the user or SOC analyst. Last but not least, any implemented solution should provide a seamless experience for the end user while being high-performing for the administrators.
In order to independently monitor and confirm our efficacy, we have given our Skyhigh SSE portfolio to AV-TEST who reviewed it against the latest live and in-the-wild threats.
About AV-TEST
AV-TEST is the independent research institute for IT security from Germany. For more than 15 years, the experts from Magdeburg have guaranteed quality-assuring comparison and individual tests of virtually all internationally relevant IT security products.
Every second, AV-TEST discovers three to four new malware variants. This sums up to around 9 million new malware every month, or more than 1.35 billion malware objects in total, which are included in AV-TEST’s database, according to our evaluation.
One of the largest collections of digital malware samples in the world, the Institute’s own research department, as well as intensive collaboration with other institutions, guarantees tests on an internationally recognized level and at the current state of the art. AV-TEST utilizes analysis systems developed in-house for its tests, thus guaranteeing test results are uninfluenced by third parties and comprehensible at all times for all standard operating systems and platforms, as reported by AV Test Institute.
- All the malware that targets the Windows platform (including .NET). This includes threat types like ransomware, backdoors, password stealers (or Spyware), Coin miners, trojans, worms and viruses. This category is generally referred to as “PE” for “Windows Portable Executable format” in AV-TEST’s reports.
- All the other malware targeting browsers, Microsoft 365 products, MacOS, Linux and Android platforms. Referred to as “Non-PE” in AV-TEST’s reports. Threat types include Trojans, Droppers and Downloaders, Exploits, Coin mining, Password-phishing / Credential stealing, Adware, Drive-by compromise, and Drive-by-downloads.
- “Phishing,” which is all sort of Web content that masquerades as a legitimate site, trying to mislead users to enter their credentials like passwords, usernames, PINs, E-Mail addresses, and more.
Both the PE and Non-PE categories were tested against live threats and against prevalent in-the-wild samples. The tests covered a total of more than 26,000 live and prevalent threats, including the most prevalent and notorious threat families, such as “LockBit.” This alone made up for 30% of victims, as reported by Ransomware group leak sites in Q1.
Sectors Most Impacted by Ransomware Groups in Q1 2023
Skyhigh SSE Rises Above the Average in All Test Categories
Skyhigh SSE scored 99.6% on threats targeting the Windows platform, downloaded from live URLs. Likewise, the efficacy was at 99.6% for all prevalent Windows threat files.
For threats targeting all other platforms – from Browser, Microsoft 365, to MacOS and Android, Skyhigh SSE detected 97.7% of the threats when downloaded from live URLs. Tested against the larger set of prevalent threats for these platforms, 99.5% of the samples were blocked. False positives were very low at 0.6% and based on usual corporate policy rules (policy violations such as hosting user-supplied content that can contain stolen goods like software licenses, books, or music). In this test run, we used a policy where new sites that had no rating or categorization yet were allowed.
Compared against the industry median of all SWG products tested by AV-TEST in June 2022 and October 2023, Skyhigh beats the average in all test categories, including Windows, non-Windows, and Phishing.
According to AV-TEST in the evaluation:
“Considering all the results of the products tested by AV-TEST, Skyhigh is among the top performers in that product category and offers strong protection against the used test cases.”
More details on test methodology, configuration and results can be found in the AV-TEST report.
Results Confirm the Efficacy of Skyhigh SSE
The results confirm the high threat protection efficacy of Skyhigh’s SSE portfolio as a critical building block of a Defense-in-Depth strategy for your company network and cloud. Combining different protection technologies at different stages or entry points is a key strategy.
Next to the malware detection components reviewed in this test run, Skyhigh offers its preventive Remote Browser Isolation (RBI) and private access (ZTNA) solutions to strengthen your overall security posture. Make sure to complete it with a strong endpoint protection platform.
And remember – the first line of defense is YOU. We’ve got your back, and you’ve got the brain. Stay cautious and don’t click here.pdf.exe.
To learn more, read the full AV-TEST evaluation for Skyhigh SSE. We encourage you to reach out to Skyhigh Security for a demo and to learn how Skyhigh SSE can work for you.
Back to Blogs