The point is that it offers absolutely no defense against an APT -- who can simply include a binary that won't match any known exploit pattern. It is not a mea

The point is that it offers absolutely no defense against an APT -- who can simply include a binary that won't match any known exploit pattern. It is not a meaningful technical barrier. It's the equivalent of storing a big table of mean things people said in a chat and suggesting this could prevent a capable person from insulting someone. Any moderately competent person can think of a way to communicate without using previously blocked phrases with minimal effort. The AV databases are known - it is trivial to test against them to ensure a binary won't match. AV is a crude tool, good only for blocking the most basic of efforts. It has no utility against a nation state.