"That is, until they discovered that Cylance also had whitelisted certain families of executable files to avoid triggering false positives on legitimate software."
Surprised to see this way down in the article. No wonder that when they manually whitelisted false positives, researchers could just append code from those to malware and it'd rank it harmless. Isn't the proper answer to not have manual whitelisting of entire programs, but to train it better to exclude them?
Surprised to see this way down in the article. No wonder that when they manually whitelisted false positives, researchers could just append code from those to malware and it'd rank it harmless. Isn't the proper answer to not have manual whitelisting of entire programs, but to train it better to exclude them?