Microsoft partner: Vista less secure than XP
Security company Kaspersky claimed that Vista's User Account Control (UAC), the system of user privileges that can be used to restrict users' administrative rights, will be so annoying that users will disable it.
Context & Ripple Effects
Kaspersky's warning lands in the middle of a year-long Microsoft campaign built on security as Vista's headline reason to upgrade: Jim Allchin told buyers in January 2006 to choose Vista for its security, and by June 2006 Microsoft was billing it as the most secure operating system ever, later opening up to outside security researchers ahead of launch.
What makes this sting is who is saying it: Kaspersky is a Microsoft partner, not a rival vendor, and its argument targets UAC — the specific privilege-restriction mechanism carrying much of that security claim. It also follows days after a reported activation-bypass that let Vista run a year without activation, another dent in the OS's control mechanisms.
First-order effects
- A Microsoft partner publicly contradicts the company's core Vista sales pitch, handing press and enterprise evaluators a credible counter-narrative that Vista may be less secure than the XP it replaces.
- UAC's default configuration becomes the immediate flashpoint: if users disable it as Kaspersky predicts, Vista ships effectively without the privilege model its security claims rest on.
Second-order effects
- Security vendors have an incentive to keep Vista's built-in defenses looking incomplete — Kaspersky sells protection software — so expect more partner-vendor critiques framing third-party tools as still essential despite Microsoft's marketing.
- Microsoft faces pressure to tune or soften UAC's prompting rather than defend it, since every annoyed user who clicks it off converts a marketing asset into a demonstrated vulnerability.
Third-order effects
- If the pattern holds, desktop OS security becomes a contest over prompt fatigue: whoever designs privilege warnings users actually tolerate wins, because a technically stronger model that gets disabled loses to a weaker one people leave on.
- The episode shows vendor ecosystems cutting both ways — partners amplify a platform's message when it suits them and undermine it when their own products depend on the gap, making 'most secure ever' claims harder for any OS maker to police.
The trend: Operating-system security is shifting from a vendor-marketed feature into a test of whether protective mechanisms survive real user behavior, with partners and security vendors increasingly willing to challenge flagship claims.