Major Cyber Threat Detection Vendors Shift from MITRE to UK Testing Program

UK-based security testing and advisory provider SE Labs is launching a new testing program to help buyers evaluate cybersecurity vendors – and has attracted some prestigious names.

The six-month testing program, called PIVOT, was unveiled by SE Labs on September 15.

It will evaluate how effectively cybersecurity vendors can defend against the world’s most dangerous hacking groups and attack techniques.

Several vendors have already confirmed their participation, including Broadcom – parent company of both Symantec and Carbon Black – CrowdStrike, Fortinet, Palo Alto Networks and Sophos.

Results of Independent Security Testing Expected for January 2027

SE Labs has assigned a team of trained ethical hackers to PIVOT, based in its cybersecurity testing laboratory in the London neighborhood of Wimbledon.

From July, these “white hat” hackers have been stress testing vendor solutions on their ability to detect threats from known attack groups and protect against them.

In practice, the PIVOT team impersonates nation-state cyber groups and other cyber threat actors, including “hacking circles responsible for the most disruptive cyber breaches in recent years,” to replicate attack types across ransomware, malware, phishing and more.

PIVOT follows complete attack chains to determine where protection succeeded, where it failed and what happened next.

“This enables buyers to distinguish between a product that identified malicious activity, one that interrupted an attack before significant harm was possible, and one that detected activity but still allowed an attacker to escalate privileges or move further through an environment,” SE Labs said.

The test phase is scheduled to end in October and evaluation results are expected to be released in January 2027.

Simon Edwards, CEO of SE Labs, said in a PIVOT launch statement: “The requirements for cybersecurity have completely changed. There are autonomous AI agent attacks, such as those that affected Hugging Face, while the sheer economic scale of the JLR incident influenced the UK economy. Businesses need to know which solutions actually protect them against nation-state attacks, major ransomware campaigns and machine-speed threats, and that demands rigorous testing of defenses.”

Read more: Why JLR’s CISO Enforced In-Person Password Resets Following Cyber-Attack

As part of PIVOT, the SE Labs testing will be verified by independent analysts from Gartner and Forrester ahead of publication.

“We don’t ask CISOs to choose between believing SE Labs and believing the vendors. We make the underlying evidence available to Gartner and Forrester, so their analysts can examine it and add their own independent interpretation,” Edwards said.

“PIVOT is designed to give security leaders meaningful comparisons without asking them to take our conclusions on trust.”

The pre-result disclosure is also designed to “help vendors identify gaps in their security solutions and support product development against ongoing threat groups and attack types,” SE Labs added in a public statement.

MITRE ATT&CK Testing Under Pressure

The launch of the PIVOT program comes at a time of significant change in independent enterprise security testing.

For a long time, the MITRE Engenuity ATT&CK Evaluations test was considered as the gold standard of independent cybersecurity testing.

However, the Enterprise version of this US Department of Defense-backed benchmark has faced challenges over the past few years.

From 30 participants in 2023, ATT&CK Evaluations: Enterprise attracted only 19 vendors in 2024 and 11 in 2025.

Notably, Microsoft, SentinelOne and Palo Alto Networks publicly announced they were pulling out of the 2025 test.

Speaking to Infosecurity in September 2025, Charles Clancy, MITRE CTO and SVP of MITRE Labs, said that the team behind the test strives to make it harder every year and conceded they may have pushed it too far this year.

“Each year, we want to design a test that’s harder than the year before in order to drive the whole industry forward, since the test can offer an opportunity for vendors to upgrade their products in preparation for the test and once they get the results. And sometimes, we don’t get the balance quite right,” he explained.

Read more: Major Cyber Threat Detection Vendors Pull Out of MITRE Evaluations Test

In February 2026, MITRE established an advisory council to support the long-term sustainability of the MITRE ATT&CK program, which encompasses the ATT&CK Evaluations tests as well as the well-known ATT&CK framework mapping adversary techniques.

Today, all vendors that have publicly joined the PIVOT program have participated in of the MITRE version.

Meanwhile, MITRE’s Clancy told Infosecurity his team “welcome all security vendors’ continued investment in independent security testing” and argued that programs such as SE Labs’ PIVOT and MITRE ATT&CK Evaluations provide “different kinds of evidence to help vendors strengthen their products and help defenders make more informed decisions.”

“We are currently executing the 2026 Enterprise ATT&CK Evaluation, which examines financially motivated and People’s Republic of China (PRC) espionage tradecraft in a Windows endpoint enterprise scenario, and will publish results in December,” he added.

The US nonprofit did not communicate on the participants of the 2026 Enterprise test at the time of publication.

“Landmark Moment for British Cybersecurity”

While SE Labs said the MITRE test had become “one of the industry’s most prominent common sources of technical evaluation data,” the UK firm said it takes a different approach.

“Rather than stopping at evidence of what a product detected, it is designed to show what happened during an attack, how far an attacker was able to progress, what defenders could see and understand and how those outcomes compare across competing products”, the firm added.

For instance, the PIVOT evaluation also examines what the security team would actually see when using the cybersecurity solution, including whether products provide enough context to understand what is happening and to investigate the attempted breach afterwards.

Speaking to Infosecurity, SE Labs’ Edwards said he believes while MITRE’s test has become stronger, vendors felt it was “more a test of MITRE’s own abilities to use the products, and buyers struggled to understand the unstructured data, as provided on the website.”

“Marketing departments took advantage of this unclear set of data and claimed to ‘win’ MITRE on a regular basis, using whatever criteria they could to achieve this,” Edwards noted.

In a public statement, Edwards also rejoiced that “the world’s biggest and best organizations choose to test their critical cyber solutions in the UK rather than in the US.”

“It’s a landmark moment for British cybersecurity,” he claimed.

The program’s launch also comes amid the development of the British Cyber Security and Resilience Bill, which will mandate designated essential services and digital service providers to report incidents within 24 hours to the regulator and the UK’s National Cyber Security Centre (NCSC) and a full report within 72 hours, widen regulatory scope and promote cross-border information sharing with EU authorities under NIS2.

Image credits: bluestork / Michael Vi / Sundry Photography / Shutterstock.com

Read now: How CISOs Should Navigate a Growing UK-EU Cyber Compliance Squeeze