To detect unknown malware, organizations need a new approach that doesn’t rely on malware signatures and learning from what past malware looks like and how it behaves. This Negative Security Model approach that detects “the bad” falls short because it can’t keep up with a practically infinite number of new malware samples. A Positive Security Model that focuses on understanding a finite set of legitimate system behavior offers more foolproof detection. When behavior isn’t following a normal path, the Positive Security Model assumes it’s “bad” and prevents it from executing, no matter what attack vector or method is being used.