Personally, after working on threat intelligence for almost a year I think the traditional indicator-based approach will be dead soon, as there are just too man

Personally, after working on threat intelligence for almost a year I think the traditional indicator-based approach will be dead soon, as there are just too many ways to evade detection by mutating the indicators. Currently it's still a bit of a hassle to register new domains and IP addresses, but with the advent of IPv6 it will be easy to have hundreds of thousands of addresses for e.g. a C&C server -possibly even a unique one for each malware payload- which will render IP-based blocking very ineffective. A similar trend can be seen in malware analysis, where already today hashsum-based approaches are only able to catch commodity malware, and are nearly useless to detect anything more sophisticated. I thereforethink the future of content-security will rely on behavior-based methods and flow analysis, as those are harder to fake or mass-produce. On the other hand, Google is in a unique position as they see a very large fraction of both the Internet traffic and e-mails being sent, which should allow them to detect new types malware much faster and more efficiently than almost anyone else. Really makes me wonder why they don't have their own anti-virus product yet (which seems to be a good way to spy on people's computers and gather more user data as well).