Why TRAPS sets new processes as Unprotected by default

[Gediminas]

Hello,

Why does TRAPS set a newly discovered process as Unprotected by default?

Basically:

1. a person runs some exploitable application.

2. TRAPS determines that it is a benign application.

3. This application is not in default application list so is set as Unprotected.

4. Attacker exploits this application.

Scenario is basically is a benign dropper.

Is there a way to set all proesses Protected by default?

Because I can create a EPM, MPM with everything on and still new things can be exloited.