The Myths of Security

Chapter 8. Why Most AV Doesn’t Work (Well)

In this chapter, we are going to take a closer look at the bedrock of the industry—antivirus (AV). I’ll focus on why it has a reputation for not working well and why that reputation is well deserved. In the next chapter, we’ll look at why AV is slow. Note that many companies have been trying to fix these problems, but for most vendors, the going is slow. I’ll talk about the timeline for improvement near the end of this book.

Almost everybody runs AV, or at least they think they do. On Windows, over 90% of all people are running AV, and the number of people who think they are is even higher. It’s far more pervasive than any other end user technology, and is far more common in people’s lives than the only other security technology with fairly widespread ubiquity—the firewall.

It amazes a lot of people that AV technology is so ubiquitous, because it is so widely reviled. Technical people will often claim that AV doesn’t work, and that it causes stability problems. And almost everyone will claim that it slows your machine down.

I can’t argue. When I was first at McAfee (I was away from McAfee for a brief period and have since returned), I was responsible for the core AV engine development (not the products that consumed the engine). I inherited it. I learned all about it and I studied all the competitors. There were lots of brilliant people in many AV companies around the globe. Yet, I can say pretty unabashedly that most AV products live up to ...