It's extremely hard because you're essentially trying to use absence of proof as proof of absence. ("There is no malware, therefore the anti malware worked") E

It's extremely hard because you're essentially trying to use absence of proof as proof of absence. ("There is no malware, therefore the anti malware worked") Even 'known' detections and preventions won't do it because you'd have to extrapolate if it wasn't detected, if prevention of anything was actually needed. Take a detection of a Excel v4 Macro loader, that's great to detect and prevent with ATP, but doesn't do anything on a Mac, and doesn't do anything on most PC's either. This is similar to comparing Sophos vs. Trend Micro for example. The products do similar things, have similar goals and similar methods. Ultimately the true protection doesn't lie in what AV you have or what EDR vendor you select, but how you deal with inevitable infections and loss of service. If you can treat the loss of a laptop (be it theft, fire or ransomware) the same way, regardless of the reason of loss, you're good. That also means encryption at rest and DLP at runtime. Neither are going to be in the AV vendor's product. The same applies to malware ingress. If you have good controls on mail (even if just for attachment and BEC scams), that already saves you a ton of issues. And if you don't use filesystem shares like it's the 90's, that helps a ton as well, because now there is no OS-native spreading method using existing mounts. The list goes on and on, and ultimately the whole AV vendor thing is just a tiny speck in the grand scheme. The biggest gap would be your audit capabilities, and having any controls vs. having no controls at all. Something as simple as bare minimum hardening (FDE, MFA, autolock), OSQuery or Kolide for health/security posture checks, non-SMB/NFS file access, and proofpoint or mimecast in your mail flow will have a bigger impact on most corporate setups than any anti malware vendor can do. Depending on the skill and education level of your users, you might even consider self-selection controls. Personally I use the Objective-see tools, XProtect and on-demand Sophos. The type of work I do doesn't fare well with traditional AV, but because I don't mind binary allowlisting, persistence lockout popups etc. and periodically confirming that I didn't miss anything using Sophos, I can get my work done and be secure enough at the same time. When I work at a regulated company I'll just use their supplied workstations and bill them extra by the hour.