Not having your system locked down would be the first problem that needs solving if you want to combat malware.

Forget regulatory compliance, we didn't get safe http traffic or disk encryption by listening to policy makers. That isn't a general indictment, they just are too slow and their motivation is compromised on the topic of surveillance.