Microsoft's security team is killing it: Not one product on Kaspersky's top 10 vulnerabilities list
Security firm Kaspersky has released its latest IT Threat Evolution report. There were some interesting findings in the report, as always, but the most interesting thing that stuck out was all the way at the bottom:
Context & Ripple Effects
Kaspersky's IT Threat Evolution report lands two days after the Windows 8 launch window opened for Microsoft, and its headline finding is an absence: not one Microsoft product appears on the top 10 vulnerabilities list. That caps an arc the corpus has tracked since August 2011, when a Windows security wrap-up praised Vista's turnaround and noted a historic first for the platform.
It also extends a deliberate posture: Microsoft has spent the past year quietly finding and reporting holes in rivals' software, including Apple and Google products, so a clean sheet from a third-party auditor like Kaspersky functions as independent validation. The pickup breadth — Neowin, Forbes, BetaNews and Slashdot all ran the same story within a day — suggests the 'Microsoft is now good at security' framing has real traction beyond security trade press.
First-order effects
- Microsoft gets an auditor-backed security credential at the exact moment it is asking consumers and enterprises to adopt Windows 8, while the vendors whose products do fill Kaspersky's top 10 absorb the reputational cost.
- Kaspersky's report hands Microsoft's security team public proof its SDL-era investment is measurable, strengthening the argument Redmond made when it began disclosing flaws in competitors' products rather than staying silent.
Second-order effects
- Attackers and researchers follow the path of least resistance: if Microsoft's patching cadence keeps its software off the list, exploit attention concentrates on the third-party applications that dominate it, raising pressure on those vendors to match Microsoft's disclosure-and-fix rhythm.
- Enterprise buyers gain a benchmark for vendor selection — a top-10 absence becomes a selling point Microsoft can cite against rivals still appearing on Kaspersky's list, shifting procurement conversations toward measured patch performance.
Third-order effects
- If the pattern holds, the industry's vulnerability center of gravity shifts from operating systems to cross-platform applications, forcing security budgets and patch-management priorities to follow the same migration.
- Independent threat reports from firms like Kaspersky become de facto scorecards that shape platform reputation, giving auditors outsized influence over which vendors are trusted with enterprise deployments.
The trend: Platform-level security hardening is pushing exploit economics away from operating systems and toward third-party applications, with independent threat reports serving as the public scoreboard.