Game of Clones: Sophos and the MITRE ATT&CK Enterprise 2025 Evaluations
Sophos, Monday, December 29th, 2025
Winter is coming - so it must be time for Sophos X-Ops' report on this year's MITRE ATT&CK Enterprise Evaluations
Each year, several security solution providers - including Sophos - sign up for MITRE's ATT&CK Enterprise Evaluations, a full-scale cyber attack emulation covering one or more scenarios based on real-world threat actors and their tactics, techniques, and procedures (TTPs).
The evaluation is designed to provide a realistic (and transparent - the results are publicly available) appraisal of security solutions' performances, based on end-to-end attack chains which include initial access, persistence, lateral movement, and impact. Emulations typically include a multi-device 'customer' environment, complete with endpoints, servers, domain-joined devices, and Active Directory-managed users.