Hacker News Reader

Comment by awakeasleep | Hacker News Reader

McAfee, like Symantec, has a Compliance driven sales cycle. No one likes the software, few think it's useful, but businesses must buy it due to their regulatory burdens.

The name doesn't matter. The marketing doesn't matter. The features don't matter. The performance doesn't matter. Laws and Industry Groups matter.

View on HN

Perhaps there is a market for antivirus software that literally does nothing.

- Enterprise ready - runs on premise

- Vastly faster than the competition

- Huge profit margins due to minimized developer costs

A bit like http://vanilla-js.com the Javascript framework of 0 bytes (25 bytes compressed), but that antivirus would have the upside of having exactly 0 added risk, which distinguishes it from the rest of its industry.

That's true. Compliance - we went with clamav for what we do - it was easy to set up on cloud.

Compliance to what? I’m genuinely curious about who would mandate antivirus.

Any regulated industry where money or lives are at stake. An example is finance where regulations specifically state that you must have antivirus installed, even on servers.

what class software as antivirus for the legislator?

Doesn't Defender qualify as satisfying the regulatory burden?

Even for smaller companies, when doing financial audit (required by law in many places) - consultant firms do highly encourage use of “endpoint protection across organization”. So in case of some IT screwup and financial losses, the auditors can say- “Well, they had Industry standard antivirus, so this shouldn’t have happened. Our financial risk assesment was still correct.”

ISO 27001 specifically mentions it

PCI-DSS pretty much requires a malware protection solution. In practice - an antivirus.

Why Not Windows Defender? It’s really quite competent and it’s pretty lightweight.

That is just fine for PCI-DSS. Not a problem at all.

Reply on news.ycombinator.com