News

Analysis: Trial Balloons Continue on Anti-Virus

• By Scott Bekker
• June 21, 2004

Speaking to a group of reporters, Microsoft's corporate vice president for the security business and technology unit, Mike Nash, said Microsoft will probably sell its own anti-virus solution.

Nash was talking about Microsoft's year-old acquisition of Romanian anti-virus company GeCAD Software Srl. At the time of the acquisition in 2003, Microsoft said publicly that it hadn't decided precisely how to use GeCAD's assets. But it floated trial balloons then that it would create its own low-cost, anti-virus solution and possibly integrate the technology into the "Longhorn" Windows release. With a 2006 tentative release date, Longhorn still is a piece of software so far off that any feature can be put on or taken off the table.

Microsoft basically has four choices. None is particularly good.

Microsoft's initial approach has been to use the GeCAD assets to improve hooks for A-V vendors in the marketplace and develop Windows and Office to be less prone to virus attacks. This is the approach the anti-virus vendors would like to see most, as it preserves their market. The biggest problem with the approach is that it does little to counter one of the strongest security arguments against Microsoft. Critics say that Microsoft's monopoly obligates the software giant to take responsibility for the threats its ubiquitous platform poses. On anti-virus, this means Microsoft bears some responsibility for naïve or cheap Windows users who don't subscribe to anti-virus software, allow their systems to become compromised and then serve as launching pads for Internet-based attacks.

That argument leads to another option -- Microsoft could bundle an anti-virus solution for free with Windows. It seems like a no-brainer. Every user who is up to date on the latest version of Windows is automatically protected against viruses. In theory, no user action would ever be required to get some virus protection. Antitrust red flags are all over this option, however. In its current settlement mode, Microsoft is unlikely to want to unintentionally crush a number of mature anti-virus firms and bring regulatory attention down on itself.

The other problem with this approach is more subtle. Even if regulators are understanding of Microsoft's awkward position here, it's still likely to hurt us all. Microsoft's anti-virus software is not going to be the best. Microsoft has not proven to be blindingly fast in answering security threats. The company's security responses are measured in days, sometimes months. Anti-virus vendors put up new virus signatures in hours. Microsoft may, I repeat, may, become that good someday, but dedicated anti-virus vendors will remain quicker for a long time.

Nonetheless, a free product that is perceived as close to good enough will wipe the mature anti-virus vendors out of the consumer space and narrow the choices in the corporate market as well. And once that market dries up, the incentive for Microsoft to improve or even maintain its virus response time evaporates.

Many of the same problems apply to the decision Microsoft is leaning toward -- a low-cost anti-virus solution. But this may be the least bad option, because it could drive down the cost of using anti-virus software. This is an admittedly ironic argument, since it is built on Microsoft abusing its own monopoly with Windows to offer anti-virus software at predatory prices. Nonetheless, if anti-virus software costs $9.99, $19.99 or $29.99 rather than $49.99, more users might subscribe and save us all from their zombie machines. Charging less means Microsoft's software doesn't have to be as good, but it still has to be good enough for people to pay something for. That gives Microsoft incentive to put effort into it. At the same time, it gives the competition options -- either lower prices to compete or provide a product so much better that it's worth $10 or $15 more.

There is, of course, one other option. Microsoft can offer its own anti-virus product at a similar price point to other products. There is no reason for Microsoft to match competitors' prices. The cheap shot is to say that it would force Microsoft to compete on the merits, so the product would die a quick death. A fairer assessment takes into account the fact that Microsoft obviously has no desire to get into the virus protection market. The company feels cornered into offering some solution to the massive problem of users who don't protect themselves. Offering a solution at the same price as the competition would do nothing to get more users subscribed to virus protection solutions.

The difficulty of the issues facing Microsoft has got to be a big reason the company is taking such a long time coming out with a strong public stance on the question. What do you think Microsoft should do? E-mail me at [email protected].