Kevin BeaumontKonto zweryfikowane

Genuine fear: If you look at supply chain attack targets, #1 = Microsoft. They good. #2 = antivirus and InfoSec companies. Risky business.

Until very recently one AV used just HTTP for updates and didn't check signatures. Big targets + InfoSec issues = red flag.

Usually orgs only have one AV per system + they allow fully automated updates, inc code, as that's how AV updates work. No barrier.

This is what I've been trying to say w.r.t. why Kaspersky is such a big risk. Automatic updates, phone-home telemetry, SYSTEM permissions...

That's a different thing, 'how much do you trust the AV companies themselves re the countries they operate in', as opposed to attackers.