Why malware wins the host race

Practically every corporation has its own internal team of malware experts tasked with preventing infections and dealing with the consequences of a successful compromise.

Depending upon the size of the organization and its propensity for being targeted by professional hackers, the skill sets of these internal malware investigation teams can vary greatly. Regardless of their technical skills, many experts struggle to understand how malware is able to successfully breach their perimeter and host-based defenses, despite their deep understanding of how each layer of defense is meant to cope with the threat.

The delivery method of most concern — largely due to its repeated success in breaching anti-malware defenses — is "drive-by-downloads." In such an attack scenario, the victim is drawn to a website hosting some malicious hidden code. How that malicious code got there, and why the victim was drawn to the website, doesn't really matter. What matters, though, is that upon the victim's web browser rendering the content of the page, vulnerabilities are exploited, malware is downloaded and installed, and host-based security products are either subverted or rendered inoperable.