You must remember the new Cylance AV is in Beta if I remember. For example, Voodooshield uses AI plus looks for a valid sig and also runs the file by VirusTotal. The samples I looked at this morning would have been flagged by 27 AV's on VT and so VS would have blocked them even if they were FP's by 27 AV's. With the Cylance Protect portal, When I used CP, it allowed you to run the files by VT also but I don't think CP did that with it's scan on your computer. I have not noticed a section in Cylance AV portal where you can submit the files to VT.