Acronis Cyber Platform earns maximum score in AV-TEST Advanced Threat Protection test

Author: Alexander Ivanyuk

Advanced attacks often use trusted Windows components and legitimate-looking files to conceal malicious activity. A manipulated DLL can run through a signed executable, while a scheduled task can launch PowerShell to load harmful code. These techniques make independent testing valuable because a security product must recognize the attack chain, not only a suspicious file.

On September 24, 2026, AV-TEST published the results of its May / June 2026 Advanced Threat Protection test under Windows 11. Acronis Cyber Platform (formerly Acronis Cyber Protect Cloud) earned the maximum protection score of 35 out of 35 points. AV-TEST reported that Acronis detected and disabled the infostealers and ransomware in all 10 attack scenarios.

Acronis also received AV-TEST's Advanced Approved Endpoint Protection certification. For customers and service providers, the result provides independent evidence from a focused third-party test: Acronis stopped all 10 tested ransomware and infostealer attack chains before they could progress further.

Each product faced 10 attack scenarios designed to reproduce the methods used in current malware campaigns. Five scenarios used infostealers and five used ransomware.

The scoring reflected the different consequences of the two threat types. A product could receive up to four points in each infostealer scenario and up to three points in each ransomware scenario. That produced a maximum of 20 points for protection against infostealers and 15 points for protection against ransomware, or 35 points in total. AV-TEST deducted full or half points when a product failed to stop part of an attack chain.

AV-TEST also documented the scenarios with MITRE ATT&CK technique and sub-technique IDs. This makes the evaluation more transparent than a simple malware detection count. Readers can see how each attack started, which techniques it used and how far it progressed before the security product intervened.

One technique in the test was DLL sideloading. AV-TEST placed a manipulated DLL beside vulkaninfo.exe, a legitimate and digitally signed executable. When that trusted program searched for its library in the working directory, it loaded the malicious DLL. This type of attack chain tests whether protection can identify harmful behavior even when a legitimate executable is involved.

The second highlighted technique used Windows Task Scheduler for persistence and execution. In AV-TEST's example, a scheduled task started PowerShell, which then loaded a harmful DLL. Task Scheduler and PowerShell are legitimate administrative tools, making the surrounding behavior and sequence of events important to the security decision.

Stopping these attacks at initial access limits their opportunity to progress. An infostealer that continues through its attack chain can reach data collection and exfiltration, while ransomware can progress to its impact stage and encrypt systems.

Acronis Cyber Platform (formerly Acronis Cyber Protect Cloud) was one of 10 corporate endpoint products that received the full 35-point protection score. According to AV-TEST, those 10 products detected and disabled the infostealers and ransomware in every scenario.

The detailed Acronis results show the same outcome across all five infostealer and all five ransomware scenarios: detected and blocked at initial access. None of the tested chains advanced to execution, persistence, defense evasion, discovery, command and control, data collection or impact.

For businesses, this result provides a useful data point when evaluating endpoint protection for systems that hold operational and customer data. Ransomware can interrupt operations by encrypting systems, while infostealers can expose credentials and other sensitive information. In this AV-TEST evaluation, Acronis stopped al 10 tested attack chains.

For MSPs, independent results help support customer conversations with measurable evidence. The 35 out of 35 score demonstrates how Acronis Cyber Platform (formerly Acronis Cyber Protect Cloud) performed against documented attack chains, including techniques that use trusted executables and built-in Windows tools. MSPs can use this result alongside practical guidance for preventing and responding to ransomware across client environments.