AV is still software, special kind of software but still software. If you look at how "normal" software updates are handled around the world, you will see a re

AV is still software, special kind of software but still software. If you look at how "normal" software updates are handled around the world, you will see a recurring pattern: - updates are first done in test envs and then in production. - large production envs are updated in "waves". - critical updates may go directly into production, but when it happens they need extra authorization and awareness Please tell me why this pattern cannot be applied to AV updates? > Now, as for virus protection: AFAIK nobody ever gated AV updates. What happened today tell us that it is a bad practice, and btw I'm aware of some customer of mine that didn't incur any issue in production because they first updated the test env and spotted the problem. > The Crowdstrike should be held accountable for this fiasco and not the individuals We agree that crowdstrike should be held accountable, but they are not the only one. What happened today tell us that there is a big hole to be plugged. And it can be fixed only but single companies. Crowdstrike, if survives, can improve it's QA process, but who will guarantee you that it won't happen again? What about other vendors? You should always assume that everything can fail and adopt processes that help prevent and mitigate these failures. Again, think just for a minute, what would be the consequences of the today fiasco if instead of a bad file they would have push a cryptolocker or troian? Solarwinds tells us that this is not a hypothetical scenario but a real risk.