Reply to thread

Message

<blockquote data-quote="bazang" data-source="post: 1114141" data-attributes="member: 114717">Internal government statistics. The US NIST and UK NCSC are not going to ever publish the results lest they be sued by the antivirus companies. There are also tests performed by the US DoD and UK MoD which produce essentially the same results.If no one had ever guessed (probably not, who here actually reads government cybersecurity frameworks and regulations), the reason that you will never see &quot;Active Directory&quot; or &quot;BitLocker&quot; in any government framework is because the agencies and programs do not want to name a specific technology as it will be interpreted as endorsement of that technology.In the same manner, government agencies that perform tests never publish them as a reported poor result will almost always create outcry and a reported very good result would be interpreted as endorsement.The range 40% to 60% is widely accepted within the AV industry. Most of that type of data is derived from internal AV industry group studies and is behind paywalls. 10,000 Euro paywalls.There is not a single AV out there that consistently performs at the 90% level against highly skilled malware campaigns (these are directed at enterprises, governments, and home users; anyone that can be infected). All AV falter to the 40% to 60% range when subjected to highly skilled malware campaigns.To properly test AV&#039;s capabilities, the tester has to have the ability to create all kinds of different types of new malware on-the-fly. Then throw them at AV test boxes in real-time. Harvesting malware from abuse.ch and other sources is not permitted. Youtube testing is not very indicative of AV effectiveness. Malware packs with 1000 samples is not permitted. As you already know, the only organizations that have those kinds of capabilities are nation state, government agencies.</blockquote>

[QUOTE="bazang, post: 1114141, member: 114717"] Internal government statistics. The US NIST and UK NCSC are not going to ever publish the results lest they be sued by the antivirus companies. There are also tests performed by the US DoD and UK MoD which produce essentially the same results. If no one had ever guessed (probably not, who here actually reads government cybersecurity frameworks and regulations), the reason that you will never see "Active Directory" or "BitLocker" in any government framework is because the agencies and programs do not want to name a specific technology as it will be interpreted as endorsement of that technology. In the same manner, government agencies that perform tests never publish them as a reported poor result will almost always create outcry and a reported very good result would be interpreted as endorsement. The range 40% to 60% is widely accepted within the AV industry. Most of that type of data is derived from internal AV industry group studies and is behind paywalls. 10,000 Euro paywalls. There is not a single AV out there that consistently performs at the 90% level against highly skilled malware campaigns (these are directed at enterprises, governments, and home users; anyone that can be infected). All AV falter to the 40% to 60% range when subjected to highly skilled malware campaigns. [B]To properly test AV's capabilities, the tester has to have the ability to create all kinds of different types of new malware on-the-fly. Then throw them at AV test boxes in real-time. Harvesting malware from abuse.ch and other sources is not permitted. Youtube testing is not very indicative of AV effectiveness. Malware packs with 1000 samples is not permitted. As you already know, the only organizations that have those kinds of capabilities are nation state, government agencies.[/B] [/QUOTE]

Verification