To be fair, they mention it in one of their blog posts

Third Question:
This question is actually a set of three.

1 – What is your relationship with Kaspersky Labs – do you in fact incorporate some of their engines?

2 – It is well known that your software includes the Kaspersky scan engine. Do you create signatures for the Kaspersky engine or do you wait for the signature updates that come from Kaspersky Labs?

3 – I believe you get definitions from Kaspersky as you use the KAV engine in addition to others. Do you spend some time checking those before adding them to the update mechanism?

—–

It seems some of the details are more well known to some than to others. Let’s sum it up.

Our products use a multiple engine approach and we have partnerships with a number of other vendors – Kaspersky is one of them. When we have an urgent case, the detection is added to our own proprietary engine. Any detection that is added to one of our products, whether our own engine or a partner’s is throughly tested by our Database Update Publishers before it is released.

We think this process works pretty well for us – see the previous post on our detection rates.

Speaking of Kaspersky… They’re an important partner of ours and we recently celebrated the tenth anniversary of that relationship. And so we had the Kaspersky management team here for a visit yesterday and today.

although, as i understand it, f-secure also have their own engine which they use in addition to kaspersky’s (i think they called it orion)… they also used to have the f-prot engine in there too, but i don’t think they do anymore…