This means that vendors work together to help codify true positives and false positives, so that overlapping vendor data has fewer false positives, thus improving the results of using multiscanning.Īlso, vendors share allowlist (trusted file) data. To further complicate the issue, false positives are often only reported by a few anti-malware vendors at a time, and they are not always consistent or reproducible during testing.įalse positive rates are reduced because many malware vendors work together through malware data sharing programs. The ability for multiscanning to dramatically reduce the exposure gaps of using one or a small number of anti-malware engines makes it a valuable approach for the early detection of emerging and actual outbreaks.įalse positives, where files are reported as malicious when they are not, surface as a side-effect of any malware scanning solution, and can adversely affect business operations. But months later, 24 engines still had not detected the Nemucod.KP threat. Within two days eleven anti-malware engines had detected the threat, and after one week sixteen engines had detected it. For example, the Nemucod.KP trojan was initially detected by three anti-malware engines on March 16th, 2016. These gaps in detection are cause for concern because they expose organizations that use only a single anti-malware engine that hasn't yet detected a specific threat.

By combining the results of multiple scanning engines, we can reduce outbreak exposure times and achieve virtually zero exposure. Even small changes in detection rates can add days, weeks or months to the time it takes for various anti-malware engines to respond to emerging threats.Ī conducted a test that shows that the detection mechanisms used by different anti-malware engines are faster at detecting certain malware compared to others. During malware outbreaks the time it takes to detect a new threat is critical.

Anti malware scanner