Microsoft quietly finding, reporting security holes in Apple, Google products
Summary: Since July 2010, Microsoft's vulnerability research team has identified and responsibly disclosed 109 different software vulnerabilities affecting a total of 38 vendors.
Context & Ripple Effects
Microsoft spent a decade as the internet's most-patched vendor; the notable reversal here is that its vulnerability research team is now the one filing the reports. Per the confirmed tally, since July 2010 the team has responsibly disclosed 109 vulnerabilities spanning 38 vendors — with Apple and Google products explicitly among the targets.
First-order effects
- Apple's and Google's security teams now hold Microsoft-authored flaw reports that must be fixed on their own release schedules, not Microsoft's Patch Tuesday rhythm.
- Microsoft converts its hard-won defensive expertise into public proof of research capability, burnishing its security credibility at rivals' expense.
Second-order effects
- Apple and Google face pressure to stand up equivalent in-house discovery teams, since their product security reputations are now partly adjudicated by a competitor's researchers.
- Vendors receiving outside reports from a rival have an incentive to formalize coordinated-disclosure timelines, because quiet handling of a Microsoft finding signals maturity while a leaked one signals dysfunction.
Third-order effects
- If the pattern holds, cross-vendor bug hunting becomes institutionalized among the major platform companies — vulnerability research shifts from ad hoc outsider reporting to permanent corporate programs that police each other's code.
The trend: Major platform vendors are turning vulnerability research into a standing corporate function that audits competitors' products, making responsible cross-company disclosure a norm of the platform era.