The Dynamic Signature Service enables Forefront Endpoint Protection to improve its ability to identify (or rule out) potential threats. Using this service, Forefront Endpoint Protection checks for the latest signatures, which enables it to verify in real-time, whether a possible threat is an actual threat, and if it is, Forefront Endpoint Protection attempts to clean the threat. It also enables the program to determine "false-positive" situations on detected items that are not actually threats, and if a false positive is found, fix it.