Sixty-two thousand threats

The mistake

An endpoint protection tool is deployed in default-deny mode, quarantining any binary whose signature or hash it can't match against a known-good reputation database. In-house software has no vendor signature and no install base, so the company's own storefront scores as unknown and gets removed on sight. Restoring from backup doesn't help, because the restored files are just as unrecognised as the originals — the fix is to code-sign the build and add an exclusion for it, not to keep putting the files back.