Researchers developed an evaluation framework for autonomous defense agents using commercial endpoint detection and response (EDR) products. The framework was tested in a simulated environment with three commercial EDR systems: Microsoft Defender XDR, CrowdStrike Falcon, and SentinelOne Singularity. The study found that EDR telemetry is designed for human analysts, not for measuring policy effectiveness, and that per-policy attribution is necessary to distinguish between defense agent and EDR actions. The results also showed that EDR behavior varies between runs due to containment and accumulation of actions. This research highlights a gap between simulated and real-world performance of autonomous defense agents and emphasizes the need for benchmarking evaluation methodologies for black-box, autonomous tools in enterprise defense.