Also, after reading the documentation and looking at the architecture, I still have a few questions because some of the marketing statements appear stronger than the technical implementation being described.
For example, phrases such as:
* "Protects you against all malicious software, including ransomware"
* "Threat Prevention"
* "Real-time multi-engine protection"
* "Stop threats before they act"
suggest capabilities similar to a traditional antivirus or EDR product.
At the same time, the notes explain that Polar should be used alongside Kaspersky, ESET, Norton, etc., and that VirusTotal and Kaspersky Threat Intelligence are mainly used as secondary reputation sources.
Could you clarify a few technical points?
1. Does Polar include any kernel-mode components (minifilter drivers, callbacks, etc.), or is the entire protection stack implemented in user mode?
2. I noticed that PolarProtectionService.exe does not appear to run under NT AUTHORITY\SYSTEM. Is there any self-protection or anti-tamper mechanism preventing malware with administrative privileges from terminating the protection processes?
3. When you refer to "multi-engine protection", is Polar actively using the actual scanning engines of those vendors, or simply consuming VirusTotal reputation reports that aggregate their verdicts?
I think these clarifications would help users better understand the actual security model of Polar and set appropriate expectations.
From my perspective, Polar seems like an interesting companion security tool and second-opinion scanner. I just believe it's important to clearly distinguish between reputation-based assistance and the capabilities typically expected from a full antivirus or EDR solution.
