PIVOT: New test program to evaluate defense against the most dangerous cyber attacks

SE Labs Launches PIVOT: Independent Testing to Evaluate Cybersecurity Solutions Against Advanced Attacks

SE Labs, a British provider of cybersecurity testing and consulting, has launched the PIVOT program, a new initiative for independent evaluation of enterprise security solutions. The project, announced on September 15, aims to measure the effectiveness of products in countering the most dangerous hacking groups and the most sophisticated attack techniques, providing CISOs with concrete data to assess the performance of solutions in real scenarios.

Quick Answer

An Innovative Approach to Security Evaluation

PIVOT stands out for its testing method: instead of just checking if a product detects malicious activity, it evaluates the entire cycle of an attack. SE Labs' ethical hackers impersonate state groups and other advanced threats, replicating ransomware attacks, malware, phishing, and other techniques. This approach provides detailed information on where protection worked, where it failed, and what the concrete results were.

The Participating Vendors and the Program Schedule

Confirmed participants include Broadcom (Symantec and Carbon Black), CrowdStrike, Fortinet, Palo Alto Networks, and Sophos. The testing phase, which began in July, will focus on relevant scenarios such as AI-based autonomous attacks, which have targeted platforms like Hugging Face, and large-scale ransomware campaigns, such as the JLR incident that had an economic impact of £19 billion in the UK.

The testing phase will conclude in October, while the results will be published in January 2027. Before disclosure, Gartner and Forrester analysts will examine the data to provide an independent assessment, strengthening the program's credibility.

PIVOT in the Context of Security Testing Evolution

The launch of PIVOT comes at a time of change for independent security testing. The MITRE Engenuity ATT&CK Evaluations, considered the reference standard, have seen a decline in participation in recent years, dropping from 30 vendors in 2023 to just 11 in 2025. Some major players like Microsoft, SentinelOne, and Palo Alto Networks have withdrawn their participation, criticizing the testing approach.

The Differences Between PIVOT and MITRE ATT&CK Evaluations

According to Simon Edwards, CEO of SE Labs, PIVOT offers a different approach compared to MITRE evaluations. While MITRE focuses on the ability of products to detect attacks, PIVOT analyzes the entire lifecycle of an attack, providing information on how far an attacker can progress, what defense teams see, and how results compare between competing products.

Edwards also highlighted that MITRE evaluation results are often unclear, allowing marketing departments to interpret them in a distorted way to promote their products. PIVOT aims to overcome this confusion, providing structured data and third-party verified.

The Regulatory Context and Impact for the UK

The launch of PIVOT coincides with the development of the British Cyber Security and Resilience Bill, which will impose new reporting obligations for essential and digital service providers. The law will require notification of incidents to authorities within 24 hours, with a complete report within 72 hours, also promoting cross-border information sharing with EU authorities under the NIS2 directive.

Edwards emphasized that the program represents a significant moment for British cybersecurity, with major organizations choosing to test their critical solutions in the UK rather than the United States.

The Importance of PIVOT for Cyber Insurance and Compliance

For companies seeking cyber insurance, PIVOT results could significantly influence risk assessments and premiums. With the rise of advanced threats, underwriters may require concrete proof of the effectiveness of security solutions. Similarly, for companies that need to comply with the NIS2 directive or the DORA regulation, PIVOT data could provide a solid basis for demonstrating compliance.

Integration with Other Cybersecurity Services

Companies participating in PIVOT may also consider integrating with other cybersecurity services such as a managed SOC or an MDR service to further strengthen their defenses. Test results could highlight specific areas of weakness that require a more proactive response, such as implementing an advanced SIEM or adopting a Data Loss Prevention to protect sensitive data.

To learn more about how independent tests can influence cybersecurity strategies, explore our penetration testing guide and see also how a SIEM can improve your security posture.