Works great for new exploited packages. Not so great for already compromised software getting hit by a worm.