(1) We do think digital signature screening (done properly - see next point) is the future in endpoint security because legacy approaches are totally overwhelmed by a professionalised cybercrime, but we do also check for known virus signatures as a first filter. Let's be clear, with virus polymorphism enabled by mutation engines available cheaply in the dark web, a defense based on a blacklist of virus signatures is just a lost battle. It's probably still around due to legacy inertia... Further, behavioural analytics, even if AI powered, always suffers from false positives and negatives. This is unavoidable because there are behaviours that are only malicious if done by malware but that are totally legitimate in themselves (e.g., creating executable files, encryption). And let's not forget that hackers can dry run their malware against behavioural analytics tools in the market before releasing, to ensure they adjust their behaviour and they manage to fly under the radar. This has led to the emergence of security operation centre (SOC) service providers to deal with this deluge of alerts, but this is not an economically feasible option for consumers and small businesses due to its cost.
(2) What we do is a bit more complex that what VodooShield (or Windows SmartScreen frankly) do, which is checking the digital signature of an executable file at load time and take a go/no-go decision. Problem with that is that you are missing two very common scenarios: i) injected DLLs on the fly and ii) the loading of compromised system DLLs, plus SmartScreen also gives the user the option to proceed anyway, and then all bets are off. Our product does not check the digital signature when an executable file is launched, but when a process memory space is created by the operating system and also for each image loaded into such process' memory space continuously, not just at launch time. This catches the aforementioned scenarios of DLL injections.
Further, because the real-time sandboxing we operate on every process, if a user decides to 'proceed anyway', they are still protected. Say a teenager downloaded a free game from the web that unfortunately also brings some adware, or worse, some malware payload. Well, in our real-time sandbox the free game will work, but the behind the scene attempts to drop the payload will fail. Not a go/no-go decision at launch, but an ongoing monitoring.
All that is a bit more complex to handle than just checking a file hash against a database of virus signatures, and can cause operating system/applications instability if something goes wrong. Part of our original product issues were due to this complexity. You could say our unstable initial releases were our MVP
(3) We are fully aware that digitally signed malware is a problem, and so we have also built some behavioural analytics in our product, but we think that i) it matters how prevalent it is, ii) in the long run the industry is driving towards reducing that problem, and iii) the virus signature blacklists and the behavioural analytics do not seem to move towards a resolution of their limitations, quite the contrary. In our minds, this would be akin to countries completely giving up on passport checks at border controls because some criminals can get hold of counterfeit passports. It seems more sensible to do passport controls and at the same time, take collective actions to reduce the ease and prevalence of passport fraud. And that's exactly what the tech industry is doing.
Because we've been asked about this matter both by investors and customers a lot, we even have a slide in our deck:
... and will try to address some of the more conceptual pushbacks in earlier posts, like the fact that there is quite a bit of digitally signed malware out there or that products like VoodooShield already provide a filtering by digital signature. Apologies in advance for the lenghty post 
):
