4 ms·

I have used their home offering Cylance Smart Antivirus, and I essentially concluded that machine learning is just not enough to detect malware. It's nice signa

I have used their home offering Cylance Smart Antivirus, and I essentially concluded that machine learning is just not enough to detect malware. It's nice signature is small and works even when you do not have latest signature, but there are a lot of false positives. (and it's generally identify the threat just by class of its threat, and not by specific identify of a threat, so there's no way to assess its impact.) This combined with Cylance's attitude to treat games as its own class of malware (they would tell their user "just add the file to exclusion list" and there's no way to add the file by class -- mind you, this is a "home" product.) I've tried Sophos Home, which also features machine learning based detection (on their paid premium version), but they use it to supplement the signature / behavior based detections -- which I feel is a more modest approach. For most of "known" threats it get caught by the signature engine by their identity ("EOF97/EicarDrp-A"), if not, it'll identify the threat by its class ("ML/PE-A"). Oh, also, EOF97/EicarDrp-A is actually a EICAR test file embedded in PDF file, I think this type of file is where Cylance's approach would struggle. (I don't think Cylance's engine even look at anything other than executables, anyways, however.)

jm4 7y ago
You're in for a bad time trying to run Cylance or something similar at home. I generally have a positive opinion of Cylance having run it for 3 years. I think where those types of products shine is in larger environments where the end user is your biggest risk, you have layers of security and it's worthwhile to invest the effort in getting your AV config right. I would never put that thing on my home machine. I know what I'm doing and I know what's on my own machine. My usage patterns at home are much different than at work so I'm not worried about phishing emails, fileless malware, PDF and .doc exploits or whatever. I'm more concerned about my webcam, known malware, casual drive by stuff, some basic parental controls and something low maintenance that will stay out of the way. I keep my machine patched, installed BitDefender and called it a day.
- unsignedint 7y ago
  Well, I'm talking about the specific version of the Cylance PROTECT intended for homes, which I believe similar engine sans memory protection and other controls in their management dashboard. I guess it's bad execution on their end, too, not necessarily their engine itself, perhaps. I guess their engine is more appropriate for corporate IT environment where what goes inside gets more vetting on what goes in. The reason I looked at Cylance was part curiosity, and other that that I do manage machines beyond my own use; so "end user is your biggest risk" actually applies to me as far as malware vector goes. In any case, I'm not really sure how Cylance's trying to position for their home offering; seems to allow very little control over its configuration and while protection is inadequate. I haven't use their enterprise version but I'm assuming it gives you a lot more configuration options...

jm4 7y ago

You're in for a bad time trying to run Cylance or something similar at home. I generally have a positive opinion of Cylance having run it for 3 years. I think where those types of products shine is in larger environments where the end user is your biggest risk, you have layers of security and it's worthwhile to invest the effort in getting your AV config right. I would never put that thing on my home machine. I know what I'm doing and I know what's on my own machine. My usage patterns at home are much different than at work so I'm not worried about phishing emails, fileless malware, PDF and .doc exploits or whatever. I'm more concerned about my webcam, known malware, casual drive by stuff, some basic parental controls and something low maintenance that will stay out of the way. I keep my machine patched, installed BitDefender and called it a day.

unsignedint 7y ago
Well, I'm talking about the specific version of the Cylance PROTECT intended for homes, which I believe similar engine sans memory protection and other controls in their management dashboard. I guess it's bad execution on their end, too, not necessarily their engine itself, perhaps. I guess their engine is more appropriate for corporate IT environment where what goes inside gets more vetting on what goes in. The reason I looked at Cylance was part curiosity, and other that that I do manage machines beyond my own use; so "end user is your biggest risk" actually applies to me as far as malware vector goes. In any case, I'm not really sure how Cylance's trying to position for their home offering; seems to allow very little control over its configuration and while protection is inadequate. I haven't use their enterprise version but I'm assuming it gives you a lot more configuration options...