Reply to thread

Message

<blockquote data-quote="ForgottenSeer 95367" data-source="post: 1004906">SAC is still alpha\early beta release. In its current state it is obviously not intended for a production system.Microsoft wants SAC to be a broader system-wide implementation of the Windows 10 S Mode security concept (extended to all processes and file types):[URL unfurl=&quot;true&quot;]https://support.microsoft.com/en-us/windows/windows-10-and-windows-11-in-s-mode-faq-851057d6-1ee9-b9e5-c30b-93baebeebc85[/URL]The AI part of that model is the massive sensor array and telemetry, the analysis and classification. The AI part is to tell you what is malicious or potentially malicious (warn). Because Microsoft literally owns the entire Windows ecosystem, SAC is driven by a giant AI-driven file and process reputation system.SAC target market are those who are not inclined to make decisions and\or create manual allow-block decisions. But whatever solid security SAC would offer will be undone by user demands of full control over SAC and they&#039;ll simply turn off SAC and install whatever they wish - no different than current security. Done with security first and foremost, SAC would deliver superb security just like S Mode. But that&#039;s not going to happen because of users being users. Microsoft will eventually relent and give-into users. It has already stated it expects those that want best security to utilize MDAC\WDAC (and implicitly GPO, AppLocker, SRP).In the end, Microsoft will implement SAC in a way that will leave the fringey app installers to their own devices, which is as it should be.The observed expectations coming from people about this SAC release is rather entertaining. For whatever reason I expected people to know how M$ does it - Microsoft introduces &quot;the next best thing in security&quot; with all of the typical M$ hooplah and poor execution.</blockquote>

[QUOTE="ForgottenSeer 95367, post: 1004906"] SAC is still alpha\early beta release. In its current state it is obviously not intended for a production system. Microsoft wants SAC to be a broader system-wide implementation of the Windows 10 S Mode security concept (extended to all processes and file types): [URL unfurl="true"]https://support.microsoft.com/en-us/windows/windows-10-and-windows-11-in-s-mode-faq-851057d6-1ee9-b9e5-c30b-93baebeebc85[/URL] The AI part of that model is the massive sensor array and telemetry, the analysis and classification. The AI part is to tell you what is malicious or potentially malicious (warn). Because Microsoft literally owns the entire Windows ecosystem, SAC is driven by a giant AI-driven file and process reputation system. SAC target market are those who are not inclined to make decisions and\or create manual allow-block decisions. But whatever solid security SAC would offer will be undone by user demands of full control over SAC and they'll simply turn off SAC and install whatever they wish - no different than current security. Done with security first and foremost, SAC would deliver superb security just like S Mode. But that's not going to happen because of users being users. Microsoft will eventually relent and give-into users. It has already stated it expects those that want best security to utilize MDAC\WDAC (and implicitly GPO, AppLocker, SRP). In the end, Microsoft will implement SAC in a way that will leave the fringey app installers to their own devices, which is as it should be. The observed expectations coming from people about this SAC release is rather entertaining. For whatever reason I expected people to know how M$ does it - Microsoft introduces "the next best thing in security" with all of the typical M$ hooplah and poor execution. [/QUOTE]

Verification