This still seems to ignore the real time case of protection from the zero-day introduction of something maliciously executing - where is the whitelist management of allowable executables?