Validation Result2023.11SMT Corporate R&D Center

SafeBreach Attack Simulation Validation — Blocking Results for 281 Penetration Tests

Using SafeBreach, we reproduced 281 attacks that combine the Cyber Kill Chain with MITRE ATT&CK and compared the blocking results of an antivirus product from Korean vendor A, Windows Defender and DocStory.

Ransomware
Attack simulation
MITRE ATT&CK

Overview

Using a product from SafeBreach, an Israeli company and a global leader in breach and attack simulation, we ran an attack simulation that combines the Cyber Kill Chain with MITRE ATT&CK (November 2023).

Test Environment

Test PC: Windows 10 Professional 64-bit, 4-core CPU, 16 GB RAM, 500 GB SSD
Total penetration tests: 281
Products compared: antivirus from Korean vendor A, Windows Defender, DocStory

Results

Test environment	Total penetration tests	Blocked	Not blocked	Block rate
Korean vendor A antivirus	281	158	123	56.23%
Windows Defender	281	165	116	58.72%
DocStory	281	272	9	96.80%

Blocking Approach

DocStory blocks outright any attempt by an unauthorized process that is not registered on the whitelist to access data. Because it does not rely on signature updates, the same rule applies to unknown attacks as well.