What's the graphic? VirusTotal detections over a 24 hour period, ranked by the number of times each engine detected a submission.
Why should you care?
I read the Wall Street Journal every morning. Most mornings (depending on time) I also read USA Today and a bunch of security news. USA Today isn't as much on my required reading as the WSJ, primarily because much of USA Today's news comes from the Associated Press, and that many of the other papers available use the same news services. The WSJ also uses some of them, but as well, provides their own reporting. There is a small overlap in reporting but I've got to read two papers, plus my security reading to feel like I have enough information.
The same holds true with cyber intelligence.
We're partnered with Anomoli, and we like them --for the most part, but one thing struck me yesterday as we were looking at their marketplace. We were dropped in the middle of the app marketplace pack, our logo sat next very close to one antivirus vendor that we'd recently tested our indicators against, and I thought it odd.
Why? Because when tested, they detected only 14% of our indicators of compromise! You read that right... 14%!
You see, we've been testing our finished intel against some of the AV and endpoint companies, and here's what we found.. Their words not ours:
- We tested 3000 lines with a global AV vendor over two weeks during the holidays last year. They detected only 18% of our feed.
- In June, we tested a sample of data that was almost two years old with another company --a California based AV and Endpoint company.. In this two year old sample, they detected only 7% of what we'd provided them.
- And when they didn't believe our stuff was real, we pulled fresh information, straight off the wire and tried it again. They detected 14%.
Look, friends don't let friends by junk. Give us a shout. Let me show you how we're different.
Want to get a feel for what we write about? Have a look at the Wapack Labs blog. Every technical report shown in the blog has indicators that were derived by us for a customer. We share them out so others may benefit.
OK folks. I've got a Sleep Number bed to return. My back is killing me.
It's not going to take itself apart!
Have a great weekend!