Check out this graph - comparison of scan times across 500 endpoints.

So they published a fancy graph showing "50% faster scans" with their new cloud-based engine. Great.

I ran the numbers from our pilot group of 500 mixed Linux/Windows endpoints. The "improvement" is because they're now skipping archive files over 100MB by default. Of course it's faster when you're not actually scanning things. Our existing on-prem setup, boring as it is, catches malware in nested archives their new engine now ignores. Had to revert the configs to match the old behavior, which wiped out the performance "gain."

Here's the config snippet they quietly changed in the policy template:

```json
"scanSettings": {
"archiveScan": {
"enabled": true,
"maxSizeMB": 100,
"maxRecursionLevel": 10
}
}
```

Becomes:

```json
"archiveScan": {
"enabled": true,
"maxSizeMB": 100,
"scanArchivesOverMaxSize": false,
"maxRecursionLevel": 5
}
```

`scanArchivesOverMaxSize: false` is the killer. And they buried it. The graph is marketing, not engineering.