Reply to thread

Message

<blockquote data-quote="Trident" data-source="post: 1078585" data-attributes="member: 99014">There is no hunt, Webroot for years has been heavily invested in reputation-based detection mechanisms (Infrared), similarly to Symantec/Norton Insight and there is a maximum setting that serves as a default-deny. This setting will eventually block 100% of malware in PEEXE formats and for many, it may be enough. But it may produce many FPs and will not take care of other forms of malware — whether or not one will be affected by such malware depends on many factors, including user behaviour.Note: this will improve soon.Second area of expertise with Webroot is behavioural blocking — there are almost no settings there. Relying too much on behavioural blocking à-la Sophos InterceptX is a rather dangerous approach, in many cases by the time malware is blocked, it has already snatched credentials. Yes, there is the Privacy Protection, but that is centred around reputation as well, so if there is code injection or LOLBin abuse, that will fail. Third area of expertise at Webroot is anti-phishing — they do use domain/IP intelligence + real time page analysis to block unknown phishing pages and they do a good job. Again, there are no settings there to configure.</blockquote>

[QUOTE="Trident, post: 1078585, member: 99014"] There is no hunt, Webroot for years has been heavily invested in reputation-based detection mechanisms (Infrared), similarly to Symantec/Norton Insight and there is a maximum setting that serves as a default-deny. This setting will eventually block 100% of malware in PEEXE formats and for many, it may be enough. But it may produce many FPs and will not take care of other forms of malware — whether or not one will be affected by such malware depends on many factors, including user behaviour. Note: this will improve soon. Second area of expertise with Webroot is behavioural blocking — there are almost no settings there. Relying too much on behavioural blocking à-la Sophos InterceptX is a rather dangerous approach, in many cases by the time malware is blocked, it has already snatched credentials. Yes, there is the Privacy Protection, but that is centred around reputation as well, so if there is code injection or LOLBin abuse, that will fail. Third area of expertise at Webroot is anti-phishing — they do use domain/IP intelligence + real time page analysis to block unknown phishing pages and they do a good job. Again, there are no settings there to configure. [/QUOTE]

Verification