🧠Humans of Cyber | Tomasz Kojm
ClamAV, founded by Tomasz Kojm in 2002, is a globally maintained open source malware engine under Cisco Talos stewardship.
Some of the most important security controls are built into systems long before an incident ever occurs. One of those controls is ClamAV, the open source antivirus engine that has quietly powered malware detection across mail gateways, Linux servers, cloud workloads, and enterprise pipelines for more than two decades.
Behind it is Tomasz Kojm, a university student in Poland who in 2002 released version 0.10.0 of ClamAV to address a practical gap in the Linux ecosystem: the lack of a free, embeddable, and reliable malware detection engine suitable for mail servers.
The Origin: Academic Need, Global Impact
ClamAV was publicly released on May 8, 2002. Kojm’s goal was precise: create a malware scanner that could be integrated directly into mail servers and Unix environments where commercial antivirus solutions were either impractical or restrictive.
The name reflected the design philosophy. Just as a clam filters contaminants from water, ClamAV was engineered to filter malicious content from digital traffic, especially email flows. Community response was immediate and intense, with rapid contributions and widespread adoption across server environments.
From Independent Project to Institutional Stewardship
In August 2007, ClamAV was acquired by Sourcefire, marking a transition from a community-led academic project to an enterprise-supported security component.
In 2013, Cisco Systems acquired Sourcefire for 2.7 billion dollars. ClamAV then became part of Cisco’s broader security portfolio, maintained by Cisco Talos, which continues to develop the engine and deliver signature intelligence globally.
This institutional backing ensured:
Continuous signature updates
Engine evolution and performance optimization
Integration into enterprise-grade security ecosystems
Technical Identity: More Than a Basic Antivirus
ClamAV is architected around libclamav, the core scanning engine that powers multiple utilities:
clamscan for on-demand scanning
clamd for high-throughput, memory-resident scanning
freshclam for optimized signature updates using CDIFF differential patches
ClamOnAcc for real-time scanning on Linux via fanotify
Detection methods evolved from simple hash and string matching to:
Hash-based signatures
Body-based and logical signatures
Phishing signature detection
Heuristic analysis of malformed ELF headers and suspicious macros
Bytecode signatures executed via an internal interpreter or LLVM JIT
The introduction of bytecode signatures was a major inflection point. It allowed complex detection logic to be deployed without requiring a full engine update, enabling faster response to emerging threats.
Legal Resilience and Open Source Defense
In 2008, ClamAV became part of a broader open source legal battle when Trend Micro asserted patent claims regarding gateway-based virus scanning. Barracuda Networks challenged those claims, and the relevant patents were invalidated following reexamination.
This episode reinforced ClamAV’s position as a defensible and auditable open source engine suitable for integration into commercial security products without proprietary constraints.
Cross Platform and Cloud Adaptation
ClamAV’s footprint extends across:
Linux and BSD distributions
Windows with native installers
macOS integrations and third-party wrappers such as ClamXAV
Containers via official Docker images
Serverless pipelines such as AWS Lambda and Azure container workflows
Its lightweight design and open license have made it a default scanning layer in cloud object storage ingestion pipelines and email security gateways worldwide.
2025 Signature Retirement Initiative
By 2025, the signature database had grown substantially, increasing distribution costs and RAM requirements. Cisco Talos initiated a large-scale signature retirement effort to remove outdated or low-value signatures.
Projected impact by December 2025:
main.cvd reduced by approximately 50 percent
daily.cvd reduced by over 60 percent
RAM usage reduced by up to 25 percent
This optimization improves suitability for constrained environments such as IoT systems and low-resource cloud instances.
Forward Looking Development
ClamAV’s modern evolution includes:
Gradual integration of Rust for memory safety in security-critical components
FIPS-compatible signature verification using external .cvd.sign files
Enhanced JSON metadata reporting with categorized detection indicators
Expanded contextual metadata such as URI extraction from PDF and HTML files
These updates position ClamAV not just as a legacy antivirus engine, but as a continuously evolving threat intelligence component.
Why Tomasz Kojm Matters
Tomasz Kojm did not build a product. He built an ecosystem component.
ClamAV is rarely visible to end users. It does not dominate marketing campaigns. It operates quietly inside mail servers, file gateways, storage buckets, and container pipelines. Yet for over 20 years, it has functioned as a foundational filter layer in global infrastructure.
In a security landscape often driven by proprietary black boxes, ClamAV represents transparent defensive architecture: auditable code, community collaboration, and institutional backing working together.
That is the essence of Humans of Cyber.
Not only the incident responders and headline makers, but the engineers who build the invisible foundations that keep digital ecosystems clean.
Subscribe and Comment.
Copyright © 2026 911Cyber. All Rights Reserved.
Follow 911Cyber on: