Question

A security analyst is evaluating the endpoint protection deployed across the organization. The current solution relies exclusively on a database of known malicious file hashes and byte patterns that must be updated daily. During a recent incident, a newly compiled variant of a known malware family bypassed the endpoint tool entirely, even though the family had been documented for months. Which characteristic of this detection technology best explains why the variant went undetected?

Accepted Answer

Signature-based detection can only identify threats that match a previously defined pattern, so a recompiled variant with a different hash evades it until a new signature is written

Answer

The tool uses behavioral analytics that ignore file hashes, so it failed to flag the process activity

Answer

Predictive AI models require labeled training data and cannot detect variants of known families

Answer

Sandbox detonation was disabled, so the file was allowed to execute without dynamic analysis