Tekspace Research

See how the products you’re considering actually perform.

We test security products against the same benchmarks. Three are published in full, and all twenty categories shape the advice we give.

Get startedGet new research first
20
categories researched
3
benchmarks published
1,700+
features compared

As featured in

  • IT Brief
  • SecurityBrief
  • ChannelLife

Published benchmarks

Three categories, tested and published in full.

Latest benchmark · Vol. 07

Browser security

Can you see what your people do inside the browser, AI tools included?

Protects where your people actually work: the browser, its extensions and the AI tools in it.

What we found

Visibility inside the session is what no other layer gives you. It tells an approved AI tool apart from sensitive data pasted into a personal account.

Checked with Parabellum, Byte and CodeBlue New Zealand.

What we tested

  • In-session, not at the network edge
  • AI and shadow SaaS governed
  • Agentless, BYOD included

Same tests on every product. The full scores are in the benchmark.

Read the benchmark

1 / 3

Vendors assessed

The market, shortlisted and tested head to head.

We shortlist the leaders and the strong emerging players in each category, then put every one through the same tests.

Browser security

  • Acium
  • Akamai LayerX
  • Apozy
  • Conceal
  • CrowdStrike Seraphic
  • DefensX
  • Harmony
  • KeepAware
  • ManageEngine
  • Menlo Security
  • Push Security
  • Red Access
  • SquareX

Security awareness training

  • Adaptive Security
  • Barracuda
  • Boxphish
  • CyberHoot
  • Hacker Rangers
  • Hoxhunt
  • Huntress
  • ID Agent
  • Immersive Labs
  • Infosec IQ
  • KnowBe4
  • MetaCompliance
  • Mimecast
  • Ninjio
  • Phished
  • Proofpoint
  • Riot
  • SANS Institute
  • SoSafe
  • usecure

Email security

  • Abnormal
  • Barracuda
  • Check Point Harmony
  • Cloudflare
  • Darktrace
  • Graphus
  • Hornetsecurity Vade
  • Ironscales
  • KnowBe4 Egress
  • Material
  • Mesh
  • Mimecast
  • Paubox
  • Proofpoint
  • Sophos
  • SpamTitan
  • Sublime

How we test

Every product faces the same tests.

  1. 01

    Same tests, every tool

    Each product runs through an identical set of tests, so the results compare like for like.

    • One test plan per category
    • The same criteria for every vendor
  2. 02

    Scored on outcomes

    We measure what a tool prevents, catches or eases, not the length of its feature list.

    • Weighted to ASD threat data
    • Mapped to the frameworks you answer to
  3. 03

    Published in full

    We publish what we find, including where a tool falls short, so you can see the reasoning.

    • Methodology and sources with every benchmark
    • No vendor pays for a place

Research is step three of the Tekspace Fit Method: it decides which options deserve your time.See the Fit Method

Validated outside Tekspace

Checked by people who do this for a living.

Before we publish, we interview practitioners outside Tekspace: offensive security testers on the threat, and the people who run these tools on the outcomes.

Threat context · Parabellum

  • Martin Dybalski Director
  • Stuart Shanahan Director of Technical Services
  • Kris Bowen Senior Offensive Security Consultant

Security outcomes

  • Matt Flack Chief Services Officer, ASI Solutions
  • Francisco Vera Managing Director, Securelogic Solutions
  • Stacy Gurrie Chief Executive Officer, Byte
  • Mathew Jose Chief Information Security Officer, CodeBlue New Zealand

No vendor pays for a place in our research.

Internal research

Seventeen more categories shape our advice before they’re published.

Get new research first

In the lab now

Updated 5 Oct 2026

Vulnerability orchestration

The layer between your scanners and your fixes: one queue of findings, the noise cut, each fix routed to the team that owns it.

  1. Threat research
  2. Product data
  3. Write-up
  4. Expert interviews
  5. Published

  • What we’re testing

    • 24/7 managed detection (MDR)
    • Correlates identity and cloud
    • Automated containment

    Vendors in scope

    • Bitdefender
    • CrowdStrike
    • Huntress
    • Microsoft Defender
    • Palo Alto Cortex XDR
    • SentinelOne
    • Sophos
    • Trend Micro

  • What we’re testing

    • Default-deny allowlisting
    • Ringfencing trusted apps
    • Maintained known-good catalogue

    Vendors in scope

    • Airlock Digital
    • Carbon Black App Control
    • Ivanti Application Control
    • ManageEngine
    • Microsoft App Control
    • ThreatLocker
    • Trellix Application Control

  • What we’re testing

    • Third-party apps, not just OS
    • Staged rollout in rings
    • Essential Eight patch windows

    Vendors in scope

    • Action1
    • Adaptiva
    • Automox
    • Ivanti
    • ManageEngine
    • NinjaOne
    • Patch My PC
    • PDQ

  • What we’re testing

    • Ranked by exploitability, not raw CVSS
    • OS and third-party patching automated
    • Essential Eight remediation tracked

    Vendors in scope

    • Action1
    • Automox
    • HCL BigFix
    • Ivanti Neurons
    • ManageEngine
    • NinjaOne
    • PDQ Connect
    • Qualys VMDR
    • SecOps Solution
    • Tanium
    • Tenable One
    • Vicarius vRx

  • What we’re testing

    • App-level access, no VPN
    • Web gateway and CASB in one
    • One agent, one policy

    Vendors in scope

    • Cato Networks
    • Check Point
    • Cisco
    • Cloudflare
    • Fortinet
    • Netskope
    • Palo Alto Prisma Access
    • Zscaler

  • What we’re testing

    • Zero-knowledge encryption
    • Shared admin logins controlled
    • Passkeys and secrets vaulted

    Vendors in scope

    • 1Password
    • Bitwarden
    • CyberArk
    • Dashlane
    • Delinea
    • Keeper
    • LastPass
    • NordPass

  • What we’re testing

    • Phishing-resistant SSO and MFA
    • Joiner-mover-leaver automation
    • Access reviews and governance

    Vendors in scope

    • CyberArk
    • JumpCloud
    • Microsoft Entra
    • Okta
    • Ping Identity
    • SailPoint
    • Saviynt

  • What we’re testing

    • Discovery across every CA
    • Automated renewal (ACME)
    • Crypto-agility for post-quantum

    Vendors in scope

    • AppViewX
    • CyberArk Venafi
    • DigiCert
    • GlobalSign
    • Keyfactor
    • Sectigo

  • What we’re testing

    • Agentless misconfig scanning
    • Attack paths ranked by risk
    • Runtime workload protection

    Vendors in scope

    • CrowdStrike
    • Microsoft Defender for Cloud
    • Orca Security
    • Palo Alto Cortex Cloud
    • SentinelOne
    • Sysdig
    • Upwind
    • Wiz

  • What we’re testing

    • Agent and MCP discovery
    • Prompt injection blocked
    • Least-privilege agent identity

    Vendors in scope

    • Check Point Lakera
    • CrowdStrike Falcon AIDR
    • Microsoft Entra Agent ID
    • Noma Security
    • Palo Alto Prisma AIRS
    • SentinelOne Prompt Security
    • Zenity

  • What we’re testing

    • Sensitive data found, labelled
    • Excess permissions removed
    • Copilot data exposure checked

    Vendors in scope

    • BigID
    • Cyera
    • Lepide
    • Microsoft Purview
    • Netwrix
    • Securiti
    • Varonis

  • What we’re testing

    • Noise filtered before ingest
    • Routing to low-cost storage
    • Data normalised at source

    Vendors in scope

    • Cribl
    • CrowdStrike Onum
    • DataBahn
    • Edge Delta
    • Google SecOps
    • Microsoft Sentinel
    • SentinelOne Observo AI
    • Splunk

  • What we’re testing

    • Controls mapped to frameworks
    • Evidence collected automatically
    • Third-party risk tracked

    Vendors in scope

    • 6clicks
    • Archer
    • AuditBoard
    • Drata
    • OneTrust
    • ServiceNow
    • Vanta

  • What we’re testing

    • Autonomous internal pentesting
    • Controls tested by simulation
    • Fixes retested automatically

    Vendors in scope

    • AttackIQ
    • Cobalt
    • Cymulate
    • HackerOne
    • Horizon3.ai
    • Pentera
    • Picus Security
    • SafeBreach

  • What we’re testing

    • Leaked credentials flagged
    • Impersonation sites taken down
    • Dark web chatter monitored

    Vendors in scope

    • Bitsight
    • Cyble
    • Flashpoint
    • Google Threat Intelligence
    • Group-IB
    • Recorded Future
    • ZeroFox

  • What we’re testing

    • Coverage mapped to MITRE ATT&CK
    • Broken or silent rules flagged
    • Config drift from baseline

    Vendors in scope

    • Anvilogic
    • CardinalOps
    • Nagomi Security
    • Reach Security
    • SOC Prime
    • Tidal Cyber

  • What we’re testing

    • Drift from baseline reverted
    • Least-privilege delegated admin
    • Tenant config and data backed up

    Vendors in scope

    • AvePoint
    • CoreView
    • Inforcer
    • ManageEngine
    • Nerdio
    • Syskit
    • Veeam

All twenty categories

Browse everything we research.

Open any category to see what we assess. Published benchmarks link to the full research; for the rest, join the waitlist to get it first.

3 published · 1,700+ features compared

  • Vol. 01 · Published benchmark

    Email Security

    Catches what Microsoft 365 and Google let through, before and after it reaches the inbox.

    Assessed on efficacy, not reputation.

    Vendors assessed include Abnormal, Barracuda, Check Point Harmony, Cloudflare, Darktrace, Graphus, Hornetsecurity Vade, Ironscales, KnowBe4 Egress, Material, Mesh, Mimecast, Paubox, Proofpoint, Sophos, SpamTitan, Sublime.

    What it answers: which capabilities matter, where products differ, and what to test in a proof of value.

    Read the researchSee every vendor

  • Vol. 02 · Published benchmark

    Security Awareness Training

    Turns staff from the easiest way in into people who spot the lure and report it.

    Assessed on efficacy, not reputation.

    Vendors assessed include Adaptive Security, Barracuda, Boxphish, CyberHoot, Hacker Rangers, Hoxhunt, Huntress, ID Agent, Immersive Labs, Infosec IQ, KnowBe4, MetaCompliance, Mimecast, Ninjio, Phished, Proofpoint, Riot, SANS Institute, SoSafe, usecure.

    What it answers: which capabilities matter, where products differ, and what to test in a proof of value.

    Read the researchSee every vendor

  • Vol. 03 · Internal research

    Endpoint Detection and Response (EDR/XDR)

    Spots and stops attacks on laptops and servers, with someone watching around the clock.

    Assessed on efficacy, not reputation.

    Vendors assessed include Bitdefender, CrowdStrike, Huntress, Microsoft Defender, Palo Alto Cortex XDR, SentinelOne, Sophos, Trend Micro.

    What it answers: which capabilities matter, where products differ, and what to test in a proof of value.

    Internal research. Informs our advice, not yet published.

  • Vol. 04 · Internal research

    Application Control

    Stops unapproved software running, and limits what approved apps can touch.

    Assessed on efficacy, not reputation.

    Vendors assessed include Airlock Digital, Carbon Black App Control, Ivanti Application Control, ManageEngine, Microsoft App Control, ThreatLocker, Trellix Application Control.

    What it answers: which capabilities matter, where products differ, and what to test in a proof of value.

    Internal research. Informs our advice, not yet published.

  • Vol. 05 · Internal research

    Patch Management

    Gets operating system and app updates onto every device quickly, without breaking things.

    Assessed on efficacy, not reputation.

    Vendors assessed include Action1, Adaptiva, Automox, Ivanti, ManageEngine, NinjaOne, Patch My PC, PDQ.

    What it answers: which capabilities matter, where products differ, and what to test in a proof of value.

    Internal research. Informs our advice, not yet published.

  • Vol. 06 · Internal research

    Vulnerability and Exposure Management

    Closes the gap between finding vulnerabilities and fixing them, worst first.

    Assessed on efficacy, not reputation.

    Vendors assessed include Action1, Automox, HCL BigFix, Ivanti Neurons, ManageEngine, NinjaOne, PDQ Connect, Qualys VMDR, SecOps Solution, Tanium, Tenable One, Vicarius vRx.

    What it answers: which capabilities matter, where products differ, and what to test in a proof of value.

    Internal research. Informs our advice, not yet published.

  • Vol. 07 · Published benchmark

    Browser Security

    Protects where your people actually work: the browser, its extensions and the AI tools in it.

    Assessed on efficacy, not reputation.

    Vendors assessed include Acium, Akamai LayerX, Apozy, Conceal, CrowdStrike Seraphic, DefensX, Harmony, KeepAware, ManageEngine, Menlo Security, Push Security, Red Access, SquareX.

    What it answers: which capabilities matter, where products differ, and what to test in a proof of value.

    Read the researchSee every vendor

  • Vol. 08 · Internal research

    Secure Access (SASE/ZTNA)

    Connects staff to apps from anywhere, without a VPN that opens the whole network.

    Assessed on efficacy, not reputation.

    Vendors assessed include Cato Networks, Check Point, Cisco, Cloudflare, Fortinet, Netskope, Palo Alto Prisma Access, Zscaler.

    What it answers: which capabilities matter, where products differ, and what to test in a proof of value.

    Internal research. Informs our advice, not yet published.

  • Vol. 09 · Internal research

    Password Management

    Keeps every password, passkey and admin login in a vault only you can open.

    Assessed on efficacy, not reputation.

    Vendors assessed include 1Password, Bitwarden, CyberArk, Dashlane, Delinea, Keeper, LastPass, NordPass.

    What it answers: which capabilities matter, where products differ, and what to test in a proof of value.

    Internal research. Informs our advice, not yet published.

  • Vol. 10 · Internal research

    Identity and Access Management

    Gives people the right access, and takes it away the day they leave.

    Assessed on efficacy, not reputation.

    Vendors assessed include CyberArk, JumpCloud, Microsoft Entra, Okta, Ping Identity, SailPoint, Saviynt.

    What it answers: which capabilities matter, where products differ, and what to test in a proof of value.

    Internal research. Informs our advice, not yet published.

  • Vol. 11 · Internal research

    Certificate and Machine Identity Management

    Finds every certificate you own and renews it before an expiry causes an outage.

    Assessed on efficacy, not reputation.

    Vendors assessed include AppViewX, CyberArk Venafi, DigiCert, GlobalSign, Keyfactor, Sectigo.

    What it answers: which capabilities matter, where products differ, and what to test in a proof of value.

    Internal research. Informs our advice, not yet published.

  • Vol. 12 · Internal research

    CNAPP

    Finds and fixes the risky settings, exposures and live threats across your cloud accounts.

    Assessed on efficacy, not reputation.

    Vendors assessed include CrowdStrike, Microsoft Defender for Cloud, Orca Security, Palo Alto Cortex Cloud, SentinelOne, Sysdig, Upwind, Wiz.

    What it answers: which capabilities matter, where products differ, and what to test in a proof of value.

    Internal research. Informs our advice, not yet published.

  • Vol. 13 · Internal research

    Agentic AI Security

    Keeps AI agents in check: what they can reach and what they can do.

    Assessed on efficacy, not reputation.

    Vendors assessed include Check Point Lakera, CrowdStrike Falcon AIDR, Microsoft Entra Agent ID, Noma Security, Palo Alto Prisma AIRS, SentinelOne Prompt Security, Zenity.

    What it answers: which capabilities matter, where products differ, and what to test in a proof of value.

    Internal research. Informs our advice, not yet published.

  • Vol. 14 · Internal research

    Data Governance and Access Control

    Finds your sensitive data and makes sure only the right people can open it.

    Assessed on efficacy, not reputation.

    Vendors assessed include BigID, Cyera, Lepide, Microsoft Purview, Netwrix, Securiti, Varonis.

    What it answers: which capabilities matter, where products differ, and what to test in a proof of value.

    Internal research. Informs our advice, not yet published.

  • Vol. 15 · Internal research

    SIEM Data Optimisation

    Cuts what you pay to collect and store security logs, without losing what matters.

    Assessed on efficacy, not reputation.

    Vendors assessed include Cribl, CrowdStrike Onum, DataBahn, Edge Delta, Google SecOps, Microsoft Sentinel, SentinelOne Observo AI, Splunk.

    What it answers: which capabilities matter, where products differ, and what to test in a proof of value.

    Internal research. Informs our advice, not yet published.

  • Vol. 16 · Internal research

    Governance, Risk and Compliance

    Shows where you stand against the Essential Eight, ISO 27001 and other frameworks.

    Assessed on efficacy, not reputation.

    Vendors assessed include 6clicks, Archer, AuditBoard, Drata, OneTrust, ServiceNow, Vanta.

    What it answers: which capabilities matter, where products differ, and what to test in a proof of value.

    Internal research. Informs our advice, not yet published.

  • Vol. 17 · Internal research

    Penetration Testing and Exposure Validation

    Proves which weaknesses an attacker could actually use, and that your fixes worked.

    Assessed on efficacy, not reputation.

    Vendors assessed include AttackIQ, Cobalt, Cymulate, HackerOne, Horizon3.ai, Pentera, Picus Security, SafeBreach.

    What it answers: which capabilities matter, where products differ, and what to test in a proof of value.

    Internal research. Informs our advice, not yet published.

  • Vol. 18 · Internal research

    Threat Intelligence and Digital Risk Monitoring

    Watches outside your network for leaked data, fake sites and attackers naming you.

    Assessed on efficacy, not reputation.

    Vendors assessed include Bitsight, Cyble, Flashpoint, Google Threat Intelligence, Group-IB, Recorded Future, ZeroFox.

    What it answers: which capabilities matter, where products differ, and what to test in a proof of value.

    Internal research. Informs our advice, not yet published.

  • Vol. 19 · Internal research

    SOC Drift Management

    Catches when your detections and security settings quietly stop working as intended.

    Assessed on efficacy, not reputation.

    Vendors assessed include Anvilogic, CardinalOps, Nagomi Security, Reach Security, SOC Prime, Tidal Cyber.

    What it answers: which capabilities matter, where products differ, and what to test in a proof of value.

    Internal research. Informs our advice, not yet published.

  • Vol. 20 · Internal research

    M365 Management

    Keeps your Microsoft 365 tenant securely configured, backed up and tidy as it changes.

    Assessed on efficacy, not reputation.

    Vendors assessed include AvePoint, CoreView, Inforcer, ManageEngine, Nerdio, Syskit, Veeam.

    What it answers: which capabilities matter, where products differ, and what to test in a proof of value.

    Internal research. Informs our advice, not yet published.

Short reads

Quick answers between benchmarks.