New Dell partnership throws doubt on traditional antivirus programs

The PC giant has partnered with Cylance, an Irvine, California-based company that specializes in detecting and blocking attacks on endpoint computers.

Early next year, Dell will wrap Cylance's Protect product in its Data Protection Endpoint Security Suite, said Brett Hansen, Dell's executive director of data security solutions. The suite is an integrated package with encryption capabilities, authentication features and malware detection.

Many antivirus programs still rely in part on systems that require identification of a piece of malware, which is then further identified by security products once a "signature" is pushed to a PC's security application.

But most security experts have agreed that signature-based detection is fairly ineffective these days since what is essentially the same malware can be changed to avoid detection.

Other technologies in antivirus suites can detect strange behavior and block malware, but often only after it has already infected a machine and done something bad.

"Our customers have been telling us the same thing: it is just not working," Hansen said.

Cylance doesn't use signatures. Instead, it uses an algorithm that analyzes seven million characteristics of files and programs and scores those elements on the likelihood of them being malicious, and can block them.

It's a lightweight agent that runs on a computer, and it only occasionally needs updating. Two or three times a year, Cylance send out an update to fine tune the algorithm. 

That also means Protect doesn't need a consistent network connection to work, which is also appealing to those frustrated by daily or even hourly downloads of new signatures.

Finding a satisfactory product took Dell security experts more than a year. There are a lot of new companies that are trying different approaches to stopping malware and advanced attacks, and Dell looked at products from more than 60, Hansen said.

Most were the same, using a combination of cloud computing, heuristics and behavioral analysis. They couldn't guarantee that a computer wouldn't get infected, but did say they could detect and remediate it, Hansen said.

That wasn't good enough, and Dell was looking for something that would prevent machines from getting infected in the first place. One of the common complaints from Dell customers is that they spend an inordinate amount of time answering helpdesk calls about infected computers.

Cylance's Protect was tested by Dell's SecureWorks, the company's crack security division. SecureWorks put about 200 samples of the most effective malware and exploits together on a USB stick and was impressed with how Protect handled it, Hansen said.

Dell used a signature-based antivirus product in the first version of Data Protection Endpoint Security Suite, which Hansen declined to name. The second version of the suite, which will be released early next year, will still have that kind of product, along with Cylance's.

But Hansen said he expects over time that as customers see how Protect works, they'll be "more than happy" to drop signature-based malware detection.