Are you really saying that a 35% risk increase is an acceptable price to pay for a small reduction in overall risk?

You can't just pull numbers out of thin air to make your point.

Experience has shown us that antivirus software does not do what it says on the tin.

> Experience has shown us that antivirus software does not do what it says on the tin.

Whose experience?

I built WildFire at Palo Alto Networks[1]. We analyzed a few tens of millions of new potential threats daily, including the VirusTotal firehose.

As part of our internal efficacy and competitive monitoring, we took the top 5 enterprise antivirus products and ran everything coming into WildFire through them.

The delta between ground truth and what the antivirus engines caught using only static scanning and emulation was about a third, i.e. better than the pessimistic estimate of half I threw out. (In the real world, antivirus actually does better because malware is easier to catch after it starts running.)

The danger of antivirus, on the other hand, is wildly overstated in this thread. A small fraction of attacks use vulnerabilities to begin with, and in the scheme of things, very few antivirus vulnerabilities have been found. 1% is just a nice, round number chosen for illustrative purposes; it's orders of magnitude greater than the real risk.

Now, this will surprise exactly no one who works in security, since most new malware is a minor variant of existing malware and exploits are relatively uncommon, but for the less experienced folks reading these comments, I implore you: Don't listen to people who say antivirus is useless or, worse, makes you less secure.

It isn't. It doesn't. They're wrong.

1. It's the biggest ATP product out there, took the crown from FireEye c. 2015. https://www.paloaltonetworks.com/products/secure-the-network...

But AV vulnerabilities sit on the top of the attack class pyramid. They often are remotely executable, run with kernel privileges and do not require user interaction.

You can't lump that together that with malware that requires tricking a user into downloading an installer, clicking through it and granting it elevated privileges.

Off the top of my head, users of Bitdefender.

You're right of course, my point is that without some evidence you're just making up numbers to prove your point and any jerk with a keyboard (like say, me) can do the same thing. Thanks for providing some background to those numbers.

If you're talking about something else, I've stated that antivirus detects around two-thirds of new malware on any given day. In case it wasn't already clear, two-thirds is terrible.

Your claim is far more extreme, though. You said "You're better off not using an antivirus". That's wrong. Antivirus won't keep you safe, but you're still safer with it than without it.

If you're saying cookies shouldn't be flagged by antivirus, that's wrong. Cookies can be associated with malware in any number of ways[1], although grayware (especially adware), which antivirus also flags depending on configuration, is a more likely culprit.

1. Check out PyExfil, for example: https://github.com/ytisf/PyExfil. Cookies for data exfiltration. DNS controls on firewalls are there for similar reasons.

Rather, I run antivirus software to prevent vulnerabilities due to human error and known threats, and in this regard it functions admirably. Think of it as one of the latter lines of defense in a multi-layer strategy. We are human; we trust our family, friends, and colleagues innately; and even the best of us makes mistakes. One tiny mistake, one shortcut---maybe not even by ourselves but by someone inside our circle of trust---and even security experts can end up running malware. Antivirus acts as a backstop, a last ditch defense predicated on the likelihood that the malicious code in question is well known.

I don't know where you got your numbers from, but I've run enterprise antivirus for about 15 years now. I haven't seen anything target the scan engine. I have hundreds of thousands of instances where someone ran malware and the scan engine caught it, sometimes even just using heuristic signatures. So you do you. I'm going to continue running it even though I know it's reactive.

Antivirus has it's place of course but they are not all created equal. There's a lot of marketing B.S. associated with AV products, especially consumer versions.

A lifetime ago I worked in IT support and AV was a constant pain point. For me it was a lot of energy wasted cleaning up PCs that were "protected" by the likes of Symantec and Norton. I hope the state of the industry has improved since then.

AV is unlikely to do that well against new malware.