The sheer amount of incompetence and neglect displayed by AV vendors has made me strongly question third-party AV's being a net positive.
The sheer amount of incompetence and neglect displayed by AV vendors has made me strongly question third-party AV's being a net positive.
Every company has vulnerabilities. How they respond when told about these vulnerabilities is much more important, and, at least by this account, Symantec is pretty responsible when it comes to responding to the discovery of these vulnerabilities.
And, to be clear, in the past year so, Symantec has been investing heavily into their own security. You can say "They should have done it before" all you want, but the fact that they're doing it speaks to, at the very least, the current leadership's competence.
Especially with the purchase of Blue Coat, they seem to want to bolster their offerings in a more meaningful way than "we give you virus definitions". Given Blue Coat CAS did and continues to use third party virus engines, even post purchase by Symantec, that would imply that Symantec is trying harder to improve their product.
EDIT: Full disclosure, I work heavily with Symantec products, but I do not work for them directly. It's my job to provide _support_ for Symantec products, not to sell them to people.
How about eliminate the attack vector in the first place? No third-party AV, no problems.
The more they extend their offerings, the more features they add, the more they extend the attack surface. And the attack surface of an average AV product is HUGE.
Considering the raw amount of incompetence displayed, not having a third-party AV in the first place seems like a reasonable choice. Want something scanned? Run it through Virus Total or something. Done.
EDIT: I also think you're misunderstanding. Symantec Endpoint Protection isn't the one that has multiple AV engines. Their (well, Blue Coat's) CAS appliance uses them.