Protecting Symantec Customers on the Endpoint through Network Protection

Marketing and malware both thrive on misdirection. With malware it’s called social engineering.  With marketers it’s labeling the competition.  For example: referring to certain security vendors as AV vendors. It is meant to be derogatory, painting them as dinosaurs still struggling to provide protection to their customer with ancient, file scanning technology.  They also like to label themselves “next gen”.  You can see my thoughts on that here.

As one of those “AV vendors” I refuse to say that file-scanning is dead.  It’s still an important part of Symantec’s protection story. In fact, I can put a number on it. Signature based file-scanning (what our competitor’s marketing teams have labeled as AV) is responsible for 10% of all our detection.  That’s based on our analysis of all proactive and reactive detections we made on Symantec endpoints in 2020. 

Behavioral, Heuristic and Machine Learning technologies are all important parts of our endpoint protection story and contribute to detection.  Those technologies catch unknown threats.  And once we know them – we add signatures for them. Because customers want to know the name of threats attacking them.  So even that 10% number above is artificially high.

But the dominant technology protecting our customers on the endpoint is Network Protection - otherwise known as IPS (Intrusion Prevention Systems).  It stops 70% of all threats.  It’s truly protection technology, stopping threats before they even get on an endpoint.  It’s been an incredible success story for Symantec and our customers.

So, you can understand the labeling from competitors.  When we stop a threat on the network, before it gets on a machine 70% of the time, marketers without that kind of technology want to focus only on AV.  We are pretty proud of our AV technology, but don’t be misdirected from seeing the whole picture.