Kevin BeaumontKonto zweryfikowane

Genuine fear: If you look at supply chain attack targets, #1 = Microsoft. They good. #2 = antivirus and InfoSec companies. Risky business.

Did you get down to the level of asking the AV companies for their processes of how they Devops updates etc?

I'm actually working on that

I think it's a legit concern. AV companies are installed on billions of devices. They're going to get targeted.

Yes as much as any other 3rd party software provider but I do agree generally

I think some vendors, more so. E.g. free/cheap AV providers likely have... LARGE install bases. Compared to say ME Doc.

I won't go into details right now but there are indicators that Avast was compromised even back in August and abused to spread Locky.