Maybe you can convince him with the following arguments: "Thinking that a huge program, written in C, with a code base from the 90ies, running as root or, even

Maybe you can convince him with the following arguments: "Thinking that a huge program, written in C, with a code base from the 90ies, running as root or, even worst, in kernel space and parsing untrusted inputs by definition can improve security is kind of crazy." From what I've seen in the Linux world, Anti-virus software tends to be pretty bad. I've already posted something about the TrendMicro one here: https://news.ycombinator.com/item?id=10883777 https://news.ycombinator.com/item?id=10883777 The Kaspersky one, last time I checked, looked a little better (proper packaging and integration) but it seemed somewhat neglected (no 64bits version, no support for newer debian/ubuntu/RedHat releases). The only commercial one which seems to be properly maintained on Linux was Sophos, it even has an open sourced working kernel module for realtime scanning (and it also supports the dnotily API). But it had some scary security flaws in the past: https://community.sophos.com/kb/en-us/118424 https://community.sophos.com/kb/en-us/118424 If you really have to use an AV, the least worst option is ClamAV, at least it's Open Sourced and packaged in most distributions. With the dnotify kernel API it can do realtime analysis.