An AV that alarmed on unpatched vulnerabilities might be better. Attackers will resignature their code to evade everything on VT, then spam the world to hit who

An AV that alarmed on unpatched vulnerabilities might be better. Attackers will resignature their code to evade everything on VT, then spam the world to hit whoever hasn't patched. For ransomware anyway. If they're targeting you specifically they'll find out what you're running and customize against it.