The MITRE ATT&CK Enterprise Round 7 (ER7) evaluation, released in December 2025, has exposed critical gaps in the cybersecurity industry's ability to defend against modern adversaries. The evaluation, considered the most demanding in the program's history, tested nine vendors against real-world attack chains from Scattered Spider and Mustang Panda. The results were stark: the highest protection score among participants was 31%, achieved by CrowdStrike and Cybereason. Notably, all nine vendors scored 0% on identity attacks—the exact techniques used by Scattered Spider in the MGM Resorts breach. Cloud attack blocking rates ranged from 0% to 7.7%. Three major vendors—Microsoft, SentinelOne, and Palo Alto Networks—withdrew before the evaluation, citing various reasons including internal innovation focus and criticism of the evaluations as PR-driven.
In contrast, VectorCertain LLC, a smaller AI safety and governance firm, claims its SecureAgent platform blocked 100% of attacks in an internal evaluation using the same MITRE methodology. The company ran 14,208 tests across three adversary scenarios (including Volt Typhoon) and reported zero failures. SecureAgent's architecture relies on a four-gate governance pipeline that evaluates AI agent actions before execution, rather than detecting threats after the fact. This approach, VectorCertain argues, addresses the structural limitations of traditional detect-and-respond platforms. The company has enrolled in MITRE's Enterprise Round 8 (ER8), which will introduce a standardized composite scoring framework.
The implications of these findings are significant. The ER7 results suggest that even the best cybersecurity platforms leave organizations vulnerable to sophisticated attacks, particularly those targeting identity systems. The withdrawal of major vendors from the evaluation raises questions about transparency and the effectiveness of widely deployed security solutions. VectorCertain's claims, if verified by independent testing, could signal a paradigm shift toward prevention-focused AI governance. However, the company's results are self-reported and await third-party validation in ER8. The broader economic impact is underscored by reports of global fraud losses reaching $485.6 billion in 2023 and AI-specific cyberattacks costing $15 billion in 2024. As Carl Manion of Gartner noted, 'DR-based cybersecurity will no longer be enough to keep assets safe from AI-enabled attackers.'
