The MITRE ATT&CK Enterprise Evaluations, often called the Olympics of cybersecurity, published results for Round 7 (ER7) in December 2025, revealing a stark protection gap. The nine participating vendors achieved a maximum block rate of 31%, with zero identity attack blocking and near-zero cloud attack blocking. Three major vendors—Microsoft, SentinelOne, and Palo Alto Networks—withdrew before the evaluation. VectorCertain LLC, a Portland-based AI safety company, responded by running its own evaluation against the same adversary emulations, achieving 100% protection across 14,208 tests with zero failures.
ER7 was the most demanding evaluation in MITRE's history, incorporating cloud adversary emulation, identity-centric attacks, and cross-environment lateral movement for the first time. The adversaries were real: Scattered Spider, responsible for the MGM Resorts and Caesars Entertainment breaches, and Mustang Panda, a PRC state-sponsored espionage group. According to MITRE's published data, the industry's best protection rate was 31%, with identity attacks completely unblocked. Lex Crumpton, Principal Cybersecurity Engineer at MITRE, noted that the emulations provided a comprehensive view of today's cyber landscape.
VectorCertain's SecureAgent platform, built on a four-gate governance pipeline, blocked all adversarial techniques. The company extended the evaluation beyond ER7's scope by adding Volt Typhoon, a third adversary targeting U.S. critical infrastructure, and testing behavioral and memory governance. Joseph P. Conroy, VectorCertain's founder, emphasized that the architecture prevents actions before execution, unlike traditional detect-and-respond systems. The results include a 0% false positive rate and governance decision latency under 100 milliseconds.
The industry's protection gap has macroeconomic consequences, with global fraud and cybersecurity losses totaling $485.6 billion in 2023. IBM's 2025 Cost of a Data Breach Report finds that AI in prevention workflows saves an average of $2.22 million per breach. VectorCertain has enrolled in MITRE's Enterprise Round 8 (ER8) for independent verification. The company's full methodology and reproducibility data are available for review. For more information, visit vectorcertain.com.
