I mean yes, but one of the issuess with "state of the art av" is they are trying to roll out updates faster than bad actors can push out code to exploit discovered vulnerabilities.

The code/config/software push may have worked on some test systems but MS is always changing things too.

the smart ones probably do

Companies don't like to be beta testers. Apparently the solution is to just not test anything and call it production ready.

That's certainly what we do in my workplace. Shocked that they don't.

When I worked at a different enterprise IT company, we published updates like this to our customers and strongly recommended they all have a dedicated pool of canary machines to test the update in their own environment first.

I wonder if CRWD advised their customers to do the same, or soft-pedaled the practice because it’s an admission there could be bugs in the updates.

I know the suggestion of keeping a stage environment was off putting to smaller customers.

This was not the driver, it was a config file or something read by the driver. Now having a driver in kernel space depending on a config on a regular path is another fuck up

What about the Mac and Linux PCs? Did Microsoft sign those too?