You are very right, the correlation feature certainly does need to come after they tune and optimize the detection engine. I wasn\’t saying those features are needed now. Rather, they are an innovation that should be added only after they have a successful detection engine that isn\’t as easily evaded.

And for your second question, if we have 10% of our user base infected, that\’s a pretty big outbreak. My response is the same regardless of the total workstations but it depends on the type of bug that did the compromise. If its a network scanning worm I\’d have the IT folks burn CDs with all the necessary remediating tools then physically unplug the compromised hosts for repair.

If the compromise impacted security software like disabling AV scanners or it installed a backdoor/bot, I\’d recommend a complete rebuild. Its a lot of work but sometimes necessary when you have a deep compromise.

In cases like these, its always good to have draconian egress filters on your firewalls. Many times that will block and alert you to the program trying to phone home.