Virus scanners give a sense of security - but their detection methods have inherent limitations. Signatures rely on what’s known, while heuristics rely on what stands out. Anyone who circumvents both remains invisible.

It’s not a question of “if,” but of “why”: Malicious code that neither signatures nor heuristics can detect can be reliably generated - and remains undetectable. The evidence is uncomfortably concrete: a custom-written piece of malware that has not been detected by any of the 72 VirusTotal scanners for over a year. The key is inconspicuousness - “Living off the Land”: Anything that simply mimics what administrators do on a daily basis leaves no signature and no anomaly.

The presentation is intentionally a wake-up call for security teams, explicitly without a s ...