4 ms·

> I guess it's still popular because It’s still popular because, A) it largely prevents malware, B) some security policies mandate it

gruez 6y ago
>A) it largely prevents malware compared to what? nothing at all? nowadays there's windows defender which is free so any antivirus product that doesn't do noticeably better is probably junk.
- Beached 6y ago
  defender is an antivirus product. and yes AV largely prevents malware compared to nothing. defender is a damn good one, but doesn't meet enterprise needs. central administration and logging are nessecary when managing a fleet of tens of thousands of workstations. AV isn't perfect, partial prevention is more common than people think, partial prevention is also partial infection. I have seen countless incidents that started with their av product catching the malware half way through execution but they never knew because they don't receive central logs. defender ATP solves some of these issues, but osx and linux capabilities are meh at best, and still very new. (linux at least) so still not ready for most enterprises. third party av exists because enterprises need centralized av across multiple OS that works ok. no one is fooling themselves thinking av prevents all malware, but it prevents a lot, and more importantly allows you to get visibility into your endpoints activities so a human can be alerted to what needs to be investigated further. just because an av solution doesn't prevent things as much as others, doesn't make it completely useless, many many enterprises knowingly trade prevention and or performance for visibility, and cost, and that's ok.
SahAssar 6y ago
> it largely prevents malware Most antivirus has been shown to open more security holes than it fixes. > some security policies mandate it That's only because the people behind those policies think that A is true.

gruez 6y ago

>A) it largely prevents malware compared to what? nothing at all? nowadays there's windows defender which is free so any antivirus product that doesn't do noticeably better is probably junk.

Beached 6y ago
defender is an antivirus product. and yes AV largely prevents malware compared to nothing. defender is a damn good one, but doesn't meet enterprise needs. central administration and logging are nessecary when managing a fleet of tens of thousands of workstations. AV isn't perfect, partial prevention is more common than people think, partial prevention is also partial infection. I have seen countless incidents that started with their av product catching the malware half way through execution but they never knew because they don't receive central logs. defender ATP solves some of these issues, but osx and linux capabilities are meh at best, and still very new. (linux at least) so still not ready for most enterprises. third party av exists because enterprises need centralized av across multiple OS that works ok. no one is fooling themselves thinking av prevents all malware, but it prevents a lot, and more importantly allows you to get visibility into your endpoints activities so a human can be alerted to what needs to be investigated further. just because an av solution doesn't prevent things as much as others, doesn't make it completely useless, many many enterprises knowingly trade prevention and or performance for visibility, and cost, and that's ok.

SahAssar 6y ago

> it largely prevents malware Most antivirus has been shown to open more security holes than it fixes. > some security policies mandate it That's only because the people behind those policies think that A is true.