It reminds me of when Tavis broke Sophos [1]. For those who weren't around, Sophos antivirus was the leading "enterprise-strength" security software around. W

It reminds me of when Tavis broke Sophos [1]. For those who weren't around, Sophos antivirus was the leading "enterprise-strength" security software around. When I started at Google in 2009, all corp-issued Windows laptops had it. Sometime in 2011, we got an internal email to immediately install a critical system update and reboot our machines. When they rebooted, they didn't have Sophos anymore. Then came another e-mail that said that Windows laptops would only be renewed for critical business exceptions, and everybody else was supposed to switch over to Mac or Linux laptops instead. Note that the first Chromebooks started shipping 3 months later. A couple days later the full report came out, and a partial version was released to the public. The tl;dr was that Tavis Ormandy (then Google's lead security researcher) had done some cursory pentesting on Sophos, and found that it had so many security holes that it was architecturally impossible to make secure. Rather than attempt to bandage the problem, the company decided it was better to give up on Windows entirely. [1] https://www.forbes.com/sites/andygreenberg/2011/08/04/google-researcher-exposes-flaws-in-sophos-software-slams-antivirus-industry/ https://www.forbes.com/sites/andygreenberg/2011/08/04/google...