Ah, that time when my job required me to write an executable scanner, and all the AVs got jealous I was honing in on their turf.

AV running in kernel mode charges its CPU cycles to the process being monitored, instead of the AV doing the monitoring.

I got a whole bunch of “your program is slow” support tickets which were resolved by telling the client to follow the AV exclusion instructions.