Acronis Cyber Platform once again earns perfect score in AV-TEST ATP evaluation

In the March / April 2026 AV-TEST Advanced Threat Protection evaluation, Acronis Cyber Platform (formerly Acronis Cyber Protect Cloud) once again earned Advanced Approved Endpoint Protection certification with a perfect 35 out of 35 protection score. The result was achieved in testing against advanced ransomware and infostealer attacks on Windows 11, where Acronis successfully defended against all 10 attack scenarios evaluated by AV-TEST.

The March / April 2026 ATP test evaluated 17 security solutions in total: eight consumer products and nine corporate endpoint solutions. The corporate endpoint products were tested on Windows 11 and exposed to realistic attacks designed to show whether the products could defeat active ransomware and infostealer behavior.

The result highlights the strength and consistency of Acronis Cyber Platform (formerly Acronis Cyber Protect Cloud) in independent testing against modern cyberthreats. Ransomware and infostealers remain among the most damaging threats facing organizations, and attackers increasingly rely on legitimate tools, trusted-looking files and multistage techniques to bypass traditional defenses.

The test included 10 real-world scenarios: five involving ransomware and five involving infostealers. Each product needed to provide reliable defense in every scenario. For ransomware, the critical outcome is whether the attacker is prevented from encrypting data. For infostealers, the critical outcome is whether the attacker is stopped before collecting and stealing targeted information.

This matters because modern attacks rarely depend on a single obvious malicious file. They often unfold in stages, using scripts, loaders, injection methods and legitimate tools to move from initial execution to final impact. A product may recognize an early indicator, but AV-TEST’s ATP evaluation checks whether the protection chain can actually stop the attack before damage is done.

The latest evaluation placed special focus on attacker abuse of AutoIt, a legitimate Windows automation tool. According to AV-TEST, AutoIt is used to automate Windows tasks such as clicks, keystrokes, window manipulation and simple installation or administrative routines. Because AutoIt is a known and legitimate tool, its presence does not automatically look malicious.

That makes it attractive to attackers. AV-TEST states that attackers use AutoIt to create and distribute malicious scripts. In the March / April 2026 ATP test, AV-TEST used AutoIt-based scripts that acted as shellcode loaders. These scripts were designed to decode and execute malicious code directly in system memory, simulating ransomware or infostealer behavior on the target system.

This is a meaningful test for enterprise endpoint protection because attackers often try to hide malicious behavior behind tools and processes that appear normal. The challenge is not only to identify a suspicious file, but also to understand behavior, interrupt execution and prevent the attacker from achieving the objective. Acronis Cyber Protect successfully met that challenge in all 10 scenarios.

AV-TEST’s Advanced Threat Protection evaluation is not a basic static-detection test. The methodology is built around realistic attack scenarios that require security products to use their broader protection capabilities. The lab uses different attack methods either individually or in combination, including injection attacks, PowerShell-based activity and, in this evaluation, abuse of a legitimate Windows automation tool.

Each attack scenario is documented according to the MITRE ATT&CK framework. AV-TEST maps the individual stages of an attack to recognized techniques and sub-techniques, such as spearphishing attachment under the MITRE ATT&CK technique catalog. This gives the evaluation a structured way to show how an attack progresses and where a protection product detects, blocks or fails to stop it.

The scoring model reflects the different risk and impact of the two threat categories. A product can receive up to 3 points for each ransomware scenario and up to 4 points for each infostealer scenario. With five ransomware scenarios and five infostealer scenarios, the maximum possible score is 35 points: 15 points from ransomware scenarios and 20 points from infostealer scenarios.

AV-TEST can also apply deductions, including half-point deductions, when a product has issues protecting the test system. This means the final score reflects not only whether an attack was initially detected, but whether the solution ultimately protected the system from the ransomware or infostealer objective.

To receive Advanced Approved Endpoint Protection certification, a corporate endpoint solution must achieve at least 75% of the maximum protection score. In this ATP test, that means at least 26.5 out of 35 points. AV-TEST also requires regular participation in its bimonthly Windows tests. Acronis exceeded the certification threshold with a perfect score.

The result is straightforward: Acronis Cyber Platform (formerly Acronis Cyber Protect Cloud) stopped all 10 attack scenarios, earned the full 35 / 35 protection score and received AV-TEST Advanced Approved Endpoint Protection certification for the March / April 2026 ATP evaluation.

The March / April 2026 result builds on Acronis’ stable performance in recent AV-TEST Advanced Threat Protection evaluations. In the January / February 2026 ATP evaluation, AV-TEST reported that Acronis was one of the corporate endpoint solutions that identified attackers in all 10 scenarios and earned the full 35 points.

Acronis also achieved a maximum 35/35 protection score in the May / June 2025 ATP evaluation, where corporate endpoint solutions were tested against ransomware and infostealer scenarios under Windows 10. AV-TEST reported that Acronis was among the products achieving error-free performance and the full score.

The same pattern was visible in the November / December 2024 ATP evaluation, where AV-TEST tested products against 10 real-life attack scenarios involving five ransomware variants and five infostealers. Acronis was again among the corporate endpoint products that stopped attackers in all 10 scenarios and received the full 35-point protection score.

Across these recent evaluations, Acronis has repeatedly demonstrated strong protection against ransomware and infostealer scenarios in AV-TEST’s ATP methodology. The latest March / April 2026 certification continues that record and reinforces the stability of Acronis Cyber Platform (formerly Acronis Cyber Protect Cloud) in independent advanced-threat testing.

Attackers continue to change their methods, including by abusing legitimate tools and executing malicious code in ways that are harder to detect. AV-TEST states that its ATP evaluation adapts every two months and incorporates attack methods used in current campaigns and recent tactics observed by experts.

That makes consistent performance especially important. A strong result in one evaluation shows effective protection against a specific set of attacks. Repeated strong results across multiple ATP evaluations show that a product can keep pace as test scenarios change and attacker techniques evolve.

For Acronis Cyber Protect, the March / April 2026 AV-TEST result is clear: perfect 35 / 35 protection score, all 10 ransomware and infostealer scenarios successfully stopped, and AV-TEST Advanced Approved Endpoint Protection certification. Combined with previous full-score ATP results, this latest certification reinforces Acronis’ stable performance in independent testing and its ability to protect organizations against advanced cyberthreats.