It would be horrifically expensive, one admin told me, and convincing the board of the value of such an investment would be impossible he added. Part of the reason for this can be summed up in a McAfee sound bite from the FOCUS 2011 announcement: "McAfee Deep Defender is capable of detecting nearly all kernel-mode malware." Nearly all is not a great selling point in security terms. It's a bit like trying to flog an underwater camera that is 99 per cent waterproof.
It all but suggests, nay announces, not all kernel-mode malware can be detected by the product, does it not? In which case, where is the real value? And that's before the bad guys, who might not have quite the financial clout of Intel but seem to do pretty well in keeping one step ahead of the information security marketplace as a rule nonetheless, catch up and manage to work out how to cloak their malware from DeepSAFE eyes.
I suspect it will not be too long before that happens, and then we are back to square one. No wonder savvy enterprises are going to play a waiting game here, seeing how the rest of the security industry (on both sides of the legal fence) respond to these developments in terms of competing products coming to market.
In the meantime, the average enterprise would probably be best advised to invest in education and getting the basics right when it comes to security. Not least the small matter of keeping everything patched and up to date, and not allowing untrusted software and devices to access the network.
