Stonesoft released Evader, the first software-based testing tool that empowers organizations to test their network security solutions’ ability to withstand advanced evasion techniques (AETs).

Evader launches a set of AETs against a tester’s own next generation firewall (NGFW), Intrusion Prevention System (IPS) and Unified Threat Management (UTM). As a result, organizations can understand whether these AETs pose a threat to their own networks and digital assets.

AETs are used to attack networks by combining several known evasion methodologies to create a new, previously unknown and dynamically changing technique that is delivered over several layers of a network simultaneously. This allows the attacker to successfully deliver any exploit, malicious payload or code to a target host without detection.

The recent spate of successful cyberattacks against major organizations exposes fundamental design flaws in network security products, the same design flaws used by AETs. An AET-disguised exploit looks normal to security products, which allows it to move inside the network without leaving a trace.

Despite most security vendors promising 100 percent protection against evasion attacks, hackers are still breaching some of the world’s most secure networks using more advanced methods like AETs.

Evader ensures that corporations and government agencies do not have to rely on lab-based, third-party testing and vendor promises to know whether their own security solutions can withstand AET attacks. As a simple test, it gives users the ability to take an easy assessment of anti-evasion readiness with their own configurations and security policies.

Evader is a ready-made test lab that includes a set of AETs. It enables an organization to run manually or automatically a variety of AET combinations that hide well-known MSRPC (vulnerability from 2008) and HTTP (2004) exploits, and then deliver them through the tested network security devices to a vulnerable target host image.

The Evader includes a set of AETs that has gone through the CERT vulnerability coordination process that began two years ago. The purpose of Evader is to provide hard facts about AET readiness of an organization’s own security devices, support decision-making and raise an organization’s security level.

“Network security solution vendors have not taken AETs seriously enough, and organizations are paying the price through data breaches that put companies, federal agencies and customers at risk,” said Ilkka Hiidenheimo, founder and CEO of Stonesoft. “Customers and the whole security community have been asking us to provide deeper knowledge about AETs and demanding products that test for them. We’re answering that need with Evader. By providing the tool for free, we’re giving organizations the same level of knowledge that today’s sophisticated hackers have and the ability to test their own environments for this risk.”