Dive Brief:

• A Google security expert recently exposed several critical vulnerabilities in Symantec and Norton security products, Fortune reports.
• The vulnerabilities live in a “decomposer engine,” used in all Symantec’s products, which can allow hackers to infiltrate machines simply by sending users emails or links, even if those emails are never opened and links are never clicked, said Tavis Ormandy, the expert who discovered the vulnerabilities.
• Ormandy is a member of Google’s security team.

Dive Insight:

Millions of people and businesses use Symantec’s endpoint security and antivirus software. Tests conducted by Ormandy found all 17 Symantec enterprise products and eight Norton consumer and small business products vulnerable to attack.

The issue underscores the fact that enterprise security should be composed of multiple levels and types of protections and not left to just one product or system.

“Network administrators should keep scenarios like this in mind when deciding to deploy Antivirus, it’s a significant tradeoff in terms of increasing attack surface,” wrote Ormandy in a Google blog.

Symantec does not appear to disagree with Ormandy’s findings. The company issued advisories of its own and credited Ormandy with reporting the vulnerabilities. Symantec also said it has “verified these issues and addressed them in product updates.”