From 7f7fc3023f71f333f68b3a8d151ac6ecc24d5562 Mon Sep 17 00:00:00 2001
From: Jacek Chmielewski <jacek@defguard.net>
Date: Wed, 27 May 2026 11:14:18 +0200
Subject: [PATCH] fix anti-virus posture report

---
 src-tauri/src/enterprise/inspector/windows.rs | 13 +++----------
 1 file changed, 3 insertions(+), 10 deletions(-)

diff --git a/src-tauri/src/enterprise/inspector/windows.rs b/src-tauri/src/enterprise/inspector/windows.rs
index d5c56a04..30539e32 100644
--- a/src-tauri/src/enterprise/inspector/windows.rs
+++ b/src-tauri/src/enterprise/inspector/windows.rs
@@ -109,16 +109,9 @@ pub(super) fn disk_encryption_status() -> Result<bool, UnavailableReason> {
 pub(super) fn anti_virus_status() -> Result<bool, UnavailableReason> {
     let conn = WMIConnection::with_namespace_path("root\\SecurityCenter2")?;
     let products: Vec<AntiVirusProduct> = conn.query()?;
-    for product in products {
-        let enabled = (product.product_state & 0x0001_0000) != 0;
-        let realtime = (product.product_state & 0x0002_0000) != 0;
-        // let up_to_date = (product.product_state & 0x0004_0000) != 0;
-        if enabled || realtime {
-            return Ok(true);
-        }
-    }
-
-    Ok(false)
+    Ok(products
+        .iter()
+        .any(|product| (product.product_state & 0x0000_F000) == 0x0000_1000))
 }
 
 /// Check if this machine is part of an Active Directory domain.