Neither you nor Mr. Ormandy is taking into account realistic threat models. I also suspect you're lumping traditional AVs with modern EDRs. If you anticipate

Neither you nor Mr. Ormandy is taking into account realistic threat models. I also suspect you're lumping traditional AVs with modern EDRs. If you anticipate targeted attacks you need an EDR solution of some sort (even if that meand cooking up your own with sysmon or auditd). If you anticipate crimeware, depending on your technical sophistication you need an EDR. If you're confident in yourself,consider the financial and data loss risks and you might be well off with only hardening your system and being careful. If the security company is considered a possible threat,try and come up with at lesst some sort of aggressive behavioral log monitoring. I have no idea why your comment is #1 on HN. Does no one here at least occadionally stumble upon malware and threat intelligence write ups? I thought I saw the post of krebsonsecurity on here last week or so where he exposed a member of Gandcrab after they retired the affiiate network ransomware after supposedly raking in $2B? You think EDRs can't catch that easily? I suspect you and even possibly Mr. Ormandy might be suffering from availability bias. Just because you don't see the prevalance and dynamic nature of the threat landscape,your threat model(or lack of one) might not be well informed. Patches and keeping up to date prevents vulnerabilities. Malware and hackers alike do not depend on software vulnerabilities,even if they did you can't defend against a zero by hardening against exploits alone(at least on windows)