Microsoft, SentinelOne, and Palo Alto Withdraw from MITRE 2025 Evaluation

Three of the cybersecurity industry’s most prominent players, Microsoft, SentinelOne, and Palo Alto Networks, have chosen to skip the 2025 edition of MITRE Engenuity’s ATT&CK Evaluations: Enterprise, a widely followed annual test of endpoint detection and response (EDR) solutions.

Their exit follows Microsoft’s announcement in June and was confirmed by the other two vendors on September 12.

All cited a desire to reallocate resources toward product development and innovation.

However, experts suggest that deeper issues are influencing the decisions, from rising test complexity to concerns about the test’s perceived promotional slant. With results of the 2025 edition due in December, MITRE is now working to rebuild trust with vendors by reinstating its annual industry forum and planning changes for the 2026 edition.

Why It Matters: The MITRE ATT&CK Evaluations were once considered a gold standard for assessing real-world cybersecurity performance. The withdrawal of three major vendors, including the industry’s largest EDR provider, raises questions about the test’s relevance and practicality. These shifts could reshape how buyers and developers view product validation and comparative security assessments.

• Three Major Exits in One Year: Microsoft, SentinelOne, and Palo Alto Networks all withdrew from the 2025 MITRE ATT&CK Evaluations, citing a desire to focus on innovation and customer-centric product development. Industry insiders suggest the real reasons may include test fatigue, complexity, and diminishing ROI from participation.

• Test Complexity and Resource Strain: MITRE CTO Charles Clancy acknowledged that each year’s test is designed to be harder than the last, which may have pushed some vendors beyond what they consider a worthwhile investment. The 2025 test includes cloud exploitation and hybrid attack scenarios that require deeper technical readiness.

• Criticism Over Value and Direction: Several security professionals expressed concern that the focus on alert volumes and endpoint-specific metrics has moved the test away from simulating real-world threats.

• Industry Dialogue to Restart in 2026: MITRE plans to revive its vendor forum to bring stakeholders back into the design process. Clancy admitted the forum had “fallen off” in recent years but emphasized the need to align the evaluation program with industry needs. The goal is to increase vendor engagement and trust for future tests.

• New Entrants Still See Value: Despite the pullbacks, other vendors like ManageEngine are preparing to enter the 2026 Evaluations with their upcoming EDR solution. The company sees participation as both a technical validation and a means to build customer trust through third-party assessments.

Go Deeper -> Major Cyber Threat Detection Vendors Pull Out of MITRE Evaluations Test – Infosecurity Magazine