So my company is investigating whether it’s worth it to use ThreatDown (the corporate version of Malwarebytes) for endpoint-protection.

However, recently (October 9th) a critical vulnerability in Firefox was reported by Mozilla: CVE-2024-9680.

The “strange” thing is that there was no mention of this vulnerability in ThreatDown when I checked after the weekend (October 14th):

(screenshot shows issues that ThreatDown did find, sorted from worst to least bad.

Even though the version of Firefox did contain the vulnerability:

And Locize did run several scans on this endpoint in the mean time:

We contacted ThreatDown about this and the next day the vulnerability suddenly shows up in ThreatDown:

To me it feels like we had to notify ThreatDown about the vulnerability, instead of them notifying us, which is the exact opposite of what we are paying them for, right?

Is this a strange conclusion? What is your experience with them? Any other comments/ideas/things we are missing?