It isn't software at that point as you would normally think of it - it would be a dedicated hardware piece that simply cross-references signatures with a known detection library and reports to the Intel chip.

And you think end users have any grasp of how to implement "real" security measures? Oh hell no. Joe Schmoe at XYZ web design corp is inevitably gonna download that porn at work and get some worm.