Comparing all the Windows platforms that came out between June 1 of 2002 and May 31 of 2003 with all variants Red Hat, MandrakeSoft, Debian and SUSE, Forrester has concluded that Microsoft is better at patching vulnerabilities than the Linux folk.

Microsoft averaged 25 days "at risk"- in other words, the number of days between a vulnerability becoming public and the first patch - while Red Hat and Debian tied for second place at 57 days and Mandrake dragged in at 82 days.

Microsoft also did a better job than Linux in the thoroughness of patching vulnerabilities. Red Hat was good for 99.6% and Debian for 96.2%.

However, Microsoft had more serious flaws than Red Hat or Debian. Sixty-seven percent of Redmond vulnerabilities were rated high severity compared to 56% for Red Hat and 57% for Debian.

Of course, numbers don't tell the whole story. A lot depends on a customer's alacrity in applying patches and the ease of deploying them. Forrester's analysis of nine highest-profile Windows security incidents revealed that although Microsoft's patches predated the outbreaks by an average of 305 days, most firms had failed to apply the patches