...according to AV-TEST
Moral of the story - AV is one piece of the pie and a "clean" AV scan does not a clean system make. They simply cannot keep up with that type of volume.
In my current role I'm doing SIEM monitoring as part of my job. For the most part our internet is wide open and even with AV, HIPS, host-based firewall, physical firewalls, a mature proxy, and a very mature IDS I still see multiple PC and server compromises daily. Often times I'll see C2 traffic via an IDS alert, only to find out every other layer of security failed. Additionally I'm more than certain our IDS is also failing in some respects and there are a bunch of owned hosts in our environment that we don't know about yet.
Definitely a bleak outlook for the average user who might not even have AV installed at home.
AV-TEST Maps Dramatic Increase In Malware -- Dark Reading
