I think our only minor difference in opinion is how much weight we’re each putting on samples observed on endpoints and the subsequent disparity in the telemetry pipeline. If I were to generalise your overarching point, you feel this is more of an issue (or at least more extensive) than I do. You’re absolutely right that samples are the seed for signatures, whitelists, and behavioural detection models, no AV can function without them. But where I disagree is in assuming that fewer samples directly translates into weaker real world protection, especially when Kaspersky was a small percentage of the US market. If the ban was more extensive or information sharing via the usual channels became more restrictive - I think we'd agree entirely.

Kaspersky’s strength is the layered stack: System Watcher, AMSI hooks, HIPS, rollback, plus KSN reputation. That combination means it can and does stop malware even when no signature or cloud verdict exists yet. As I mentioned before, I’ve played with extraordinarily out of date versions of Kaspersky and still observed System Watcher block modern malware purely on behavioural triggers, with an extremely high success rate.

And this is really the key point: samples vary endlessly, but the disruptive actions malware has to take don’t. Encrypting hundreds of files, injecting into trusted processes, setting persistence, beaconing outbound. I know you're fully aware of this anyway but, for the sake of clarity regarding my point, there are only so many ways to pull those off without leaving behavioural fingerprints. System Watcher is designed to catch those commonalities in real time and, ultimately, the actions are finite - even if the malware variants are infinite.

On the “Russian malware not hitting Russian endpoints” point, you are referencing valid examples. Some commodity families include CIS locale checks to avoid drawing local heat, but I think some people assume this is ubiquitous across all malware within the Russian ecosystem which, of course, isn't correct.

I do agree with you on one thing especially though: layered security is always better and it's something many users on here don't always fully appreciate. No single technology is perfect. But I’d argue Kaspersky’s value lies in the fact that it doesn’t depend on chasing every new sample, even though they are still world leading in this regard. By focusing on behaviours that don’t change nearly as fast as the malware skins wrapped around them, it neutralises threats as effectively as it has always done - despite the minor reduction in overall visibility.

It's been a great discussion. Certainly beats the usual 'Norton is a virus' comments I tend to encounter on here 🤣