This is a weird story, since professional security people would have told you the same thing back in 2007.<p>Windows wasn&#x27;t originally designed to be secure. Even NT, which is a serious multi-user kernel, was a product of 1990s C programming style. And while that&#x27;s true of the Unices of the time as well, none of them had Microsoft&#x27;s absurd user base, and so none of them had the same terrible malware incentives.<p>This all came to a head around 2001-2003, when the Internet worm phenomenon got so bad that Microsoft was routinely on the front page of CNN, and serious talk of congressional action began.<p>From what I understand, there was a dramatic top-down response, led by Gates and Ballmer, requiring software security training for developers, giving product managers the power to slip release dates to ensure bugs were caught, and funding what I believe is probably the largest 3rd-party software pentesting program in the industry. Several well-known software security firms (my old firm, Matasano, not really among them) were basically bootstrapped out of Microsoft contracts.<p>Today, Google probably does a better job on software security than Microsoft does, but it&#x27;s hard to come up with another rival. Tellingly, Google&#x27;s security efforts were also a top-down reaction to a major security incident.