Independent validation matters. Vendor claims about detection rates are everywhere, and without third-party testing an organisation has no reliable way to compare products or check that a product does what it promises.
That is why we submitted the SenseOn platform to the AV-Comparatives Enterprise Main-Test Series. In the Business Security Test March-June 2024, published on 15 July 2024, SenseOn recorded a 95.9% protection rate in the Real-World Protection Test and a 98.7% protection rate in the Malware Protection Test, with zero false alarms in both. AV-Comparatives gave the platform its Approved Business Product award.
An earlier version of this article reported a 99% protection rate. The figures on this page are the ones AV-Comparatives published, and its report is the authority on them.
This article explains what the results mean, how AV-Comparatives runs the tests, why zero false alarms matters operationally, and how SenseOn's cross-domain correlation makes that pairing possible.
What is AV-Comparatives?
AV-Comparatives is an independent testing organisation. It was founded in 1999 as a student research project at the University of Innsbruck in Austria and now runs one of the most widely cited security product test programmes. Its enterprise series runs twice a year and each run covers protection scenarios, system performance and false alarms.
Unlike vendor-sponsored benchmarks, every product in a run faces the same test cases under the same conditions, and the methodology is published before the test starts.
How the Real-World Protection Test works
The published methodology is designed to reproduce what a product faces in a working estate rather than a scan of static samples.
- Threat sourcing. The lab collects live threats. In its words: "We aim to use visible and relevant malicious websites/malware that are currently out there and present a risk to ordinary users."
- Test execution. Every product is installed on an identical system. "Our automated test procedure feeds one malicious URL to all test machines simultaneously, to help ensure the same testing conditions for each product." The outcome is recorded at each stage of the attack chain.
- False alarm testing. Products are also exposed to around one thousand popular domains and about one hundred common applications. "Blocked non-malicious domains/URLs are counted as false positives."
- Scoring. Each case is recorded as blocked, user dependent (half credit) or compromised. Protection rate is the share of cases the product stopped, and false alarms are reported alongside it so that an aggressive product cannot hide behind a high block rate.
SenseOn's results
| Test | Period | Cases | Result | False alarms |
|---|---|---|---|---|
| Real-World Protection Test | March-June 2024 | 490 | 470 blocked, 20 compromised, 95.9% protection rate | 0 |
| Malware Protection Test | March 2024 | Full set | 98.7% protection rate | 0 on common business software |
| Certification | July 2024 | Approved Business Product |
95.9% real-world protection
SenseOn stopped 470 of 490 live threats. Threats were blocked at different points in the chain: some at the network level before the payload reached the endpoint, others by behavioural analysis during execution, and others by post-execution detection and remediation. The Malware Protection Test, which exercises on-access and on-execution protection against a fixed sample set, produced 98.7%.
Zero false alarms
The false alarm figure is arguably the more important of the two. Here is why.
False positives are the hidden tax of security tooling. Every false alarm consumes analyst time, erodes trust in the tool, and can disrupt legitimate work. In a large estate, a tool with even a modest false alarm rate produces a steady stream of spurious alerts.
The operational impact is direct:
- Analyst fatigue: analysts who repeatedly investigate false alarms become desensitised, which raises the chance that a genuine threat is overlooked or deprioritised.
- Business disruption: automated blocking of legitimate software or websites interrupts staff and generates support tickets.
- Trust erosion: when a tool cries wolf, business stakeholders push back on security policy and users build workarounds that add risk.
- Resource waste: each false alarm investigation costs skilled time, and for a small team that cost compounds daily.
Zero false alarms across the real-world corpus and the business software set means the platform delivered its protection rate without imposing those costs.
How the field compared
In the same March-June 2024 run, false alarms across the tested products ranged from zero to 21. Several products reached zero; SenseOn was one of them, and it was among the products certified in that round. The report also shows the trade-off the test is built to expose: some products with high block rates carried elevated false alarm counts.
The ideal position is high protection with low false alarms. A product that relies on aggressive heuristics or broad behavioural rules can buy a high block rate at the cost of noise. A product tuned conservatively to avoid noise can miss genuine threats. SenseOn's architecture is designed to resolve that tension rather than pick a side.
Cross-domain correlation: why the pairing is possible
SenseOn's results are not the output of one detection method pushed to its limit. They come from three independent AI methods working together, which we call cross-domain correlation.
Supervised learning
Supervised models are trained on labelled malware and benign software. They excel at known threat families, variants of existing malware and patterns that match established signatures. In the test they were the first line against threats with known characteristics.
Unsupervised learning
Unsupervised models build statistical baselines of normal behaviour and flag deviation. They catch what supervised models miss: novel malware, zero-day exploits and attacks built to avoid known signatures. For false alarm performance, the important property is that they separate unusual-but-benign behaviour from genuinely malicious anomalies.
Deep learning
The deep learning layer assesses sequences of events and their relationships rather than isolated indicators. That context is what keeps false alarms down: the model asks whether a complete attack narrative is present, not whether one indicator looks suspicious.
Cross-validation
When one method flags a potential threat, the other two assess the same data independently. Genuine threats usually trigger across several methods. Activity that looks suspicious from one angle but benign when viewed whole is filtered out. That consensus requirement is what lets the platform hold a high protection rate and a zero false alarm count at the same time.
What the results mean for a security team
- Protection is measured, not promised. The figures were produced against live threats under controlled conditions and published by the lab, not self-reported.
- Operational efficiency is built in. Zero false alarms means that when the platform raises an alert, it warrants investigation, so a small team can spend its time on genuine threats.
- The architecture holds up under test. Cross-validating three methods produced the pairing the test is designed to reward.
- Consolidation does not mean compromise. Teams replacing separate EDR, NDR and SIEM tools with a unified platform can check detection quality against a public benchmark rather than a slide.
Later rounds
Independent testing is not a one-off. The platform has stayed in the series since this test. AV-Comparatives lists SenseOn as Approved in both 2024 runs on its 2024 awards page and in both 2025 runs on its 2025 awards page. In the August-November 2025 run the Real-World Protection Test result was 97.2% with zero false alarms. In the March-June 2026 run it was 94.8% with three false alarms.
We publish those figures because the point of independent testing is that readers can check them. We encourage any organisation evaluating a security platform to look past vendor marketing and read the lab reports, ours included.
Sources
- AV-Comparatives, Business Security Test March-June 2024, published 15 July 2024, accessed 20 September 2026
- AV-Comparatives, Real-World Protection Test methodology, accessed 20 September 2026
- AV-Comparatives, About us, accessed 20 September 2026
- AV-Comparatives, AV-Comparatives Awards 2024 for SenseOn, 24 February 2025, accessed 20 September 2026
- AV-Comparatives, AV-Comparatives Awards 2025 for SenseOn, 3 March 2026, accessed 20 September 2026
- AV-Comparatives, Business Security Test August-November 2025, accessed 20 September 2026
- AV-Comparatives, Business Security Test March-June 2026, accessed 20 September 2026
How SenseOn writes, checks and corrects its content: editorial standards.
