Every endpoint product on the market claims 99%-plus protection, and they're all telling the truth. That is exactly why independent testing exists. Thomas Uhlemann of AV-Comparatives, the Innsbruck lab that has spent two decades trying to make "does it work?" a question with a defensible answer, walks through what each test actually does, what it deliberately doesn't measure, and how to read a report without being led by a vendor's cherry-picked chart.Disclosure: Broadcom participates in AV-Comparatives testing. Thomas runs communications, not testing, and this conversation is about methodology. No results or placements are discussed.What's inside: why the Real-World Protection Test runs products at default settings, online and offline, with USB and web-borne attack paths; why certification demands zero false positives on common business software ("malware might break your productivity, false positives will"); how vendors try to buy detection rates with false positives and why bi-monthly testing exposes it; why the EDR Detection Validation test disables blocking to measure signal-to-noise, and why failing vendors are anonymized; how the EPR test folds downtime and man-hours into total cost of ownership and refuses to name a winner; and a defender's checklist for reading any test report, starting with the methodology, not the chart.Chapters00:00 – Why independent testing exists, and who AV-Comparatives is06:24 – Real-World Protection: default settings, online, offline, USB09:40 – Malware Protection and the zero-false-positive rule14:53 – How vendors try to game tests, and why bi-monthly runs matter18:24 – EDR Detection Validation: signal-to-noise and anonymized vendors24:12 – EPR test: TCO, the quadrant, and why no winner is declared28:40 – How to read a report, and what tests can't measure34:21 – A defender checklist and healthy paranoia36:57 – AI in testing: faster, not newLinksAV-Comparatives: https://www.av-comparatives.orgMore episodes: https://www.youtube.com/@symantec/podcastsMore research and expert perspectives: https://www.security.comGuest: Thomas Uhlemann, Cybersecurity Evangelist, AV-Comparatives.Host: Dan Mellinger.SECURITY.COM The Podcast — In-depth intel. Real talk. Human factor.

The channel isn't dying. The traditional reseller model is. Alan Maxwell, who leads Broadcom's Catalyst partner business internationally, puts the number on it: fewer than 15–20% of partner sales engineers could pass an unscripted, hands-on XDR architecture exam today, and the partners winning right now are the ones who stopped selling licenses and started selling outcomes.Alan just wrapped a six-part series on SECURITY.COM called The Resilient Channel. This conversation pulls it together for the VARs, MSSPs, distributors and integrators who sit between the vendor and the SOC: which structural force partners are underestimating most (regulation and cyber insurance, not AI), what separates a services-led partner from one with services language bolted on (revenue mix, hiring, comp plans), a 24-month plan to flip from 80% resale to 50/50, why MDF reform is finally real, a one-question test for whether a vendor's "agentic SOC" is agentic at all, and the liability gray area nobody in the industry has solved: when an autonomous agent knocks production offline, who holds the bag?

Chapters00:00 – Who this episode is for: a 4-minute primer on the channel05:10 – Three things vendors and customers get wrong about partners06:44 – The partner's new burden: regulation, insurance, AI-speed threats11:38 – Architecting for margin: real services partners vs. fake ones17:23 – Technical enablement: why most SEs can't pass an unscripted exam22:38 – MDF reform, co-marketing that converts, compliance as an edge28:59 – Agentic AI claims, marketing math, and the liability gray area34:57 – One thing every partner CEO should do next quarter

Read the seriesThe Resilient Channel, Part 1: https://www.security.com/expert-perspectives/resilient-channel-series-part-1Part 2: https://www.security.com/expert-perspectives/resilient-channel-series-part-2Part 3: https://www.security.com/expert-perspectives/resilient-channel-series-part-3Part 4: https://www.security.com/blog-post/resilient-channel-series-part-4Part 5: https://www.security.com/blog-post/resilient-channel-series-part-5Part 6: https://www.security.com/expert-perspectives/resilient-channel-series-part-6

Symantec Threat Hunters found malware that turns a legitimate document-security platform into its own exfiltration channel. Infostealer.Speagle hijacks Cobra DocGuard to chase Chinese ballistic missile documents — then uses the platform's own driver to delete itself. A look at the Runningcrab activity cluster. Listen in.