Working in consulting with a lot of these products, I don’t really see ML claims as indicative of anything one way or another. I know some pretty good products

Working in consulting with a lot of these products, I don’t really see ML claims as indicative of anything one way or another. I know some pretty good products claim to have advanced ML and some better ones that don’t talk about ML at all, and some really bad ones on all parts of the spectrum. Rather than focusing on ways to get a gotcha on some poor sales team that probably doesn’t control the language used in their marketing, if you want to evaluate whether an EDR product is able to detect things the best way is probably to skip to steps 7 and 8 and ask them about testing - has the product undergone a MITRE evaluation? What’s their strategy for discovering new tactics and validating that they are detected? If you’re evaluating the product on a live demo, your red team should ideally be giving a decent battery of tests, not just firing a macro-laden Word doc and Metasploit...even traditional antivirus ought to be catching that stuff in $currentYear, though of course many don’t.