Microsoft’s Security U-Turn: Ovum

Microsoft will provide free malware protection to consumer PCs and mobile Windows devices in 2H09 under a project called 'Morro' it announced last week. This will mean the end of both Windows Live OneCare and the new Microsoft Equipt product.
Microsoft launched Equipt, an attractive package embracing Office and security products, in the US in mid July 2008 and in the UK on 20 October 2008. Its withdrawal four weeks later is surprising and leaves Microsoft’s Office strategy in the consumer market without a subscription offering.

Morro will turn Microsoft’s core anti-malware functionality into a free anti-malware product for PCs, stripped of OneCare’s more extraneous features. Microsoft says this has been precipitated by a rise in malware incidences and the failure of users to install basic security, particularly in developing countries. However, these long-standing problems are not new.

This move is also surprising because Microsoft has been reporting substantial improvements in countering malware on Windows with each new version of Windows and with every service pack. The largest single improvement occurred with XP SP2 and progress has been maintained through more recent releases. No single strategy will solve the malware problem, but there is no longer the urgency that we faced back in 2002/03 at the start of the Trustworthy Computing project.

Will Morro impact the occurrence of malware? Microsoft intended OneCare to extend the take-up of anti-malware products rather than to grab market share from competitors, and its current small market share indicates that it has not succeeded. Morro will not be built into Windows – a move that would bring major anti-trust battles for Microsoft – but Microsoft could install it on new PCs, as other anti-malware products are today. As most new PCs in developed markets are already shipped with anti-virus installed, the main impact would be to help overcome user inertia when the free subscription expires. Morro should help but its success will depend on how it adapts to changing attack strategies.

The consumer sector is secondary to the business market for most security vendors. However, a free Microsoft offering will impact their overall viability, leading to accelerated consolidation in the industry.

Few consumers will opt to buy an anti-malware product when there is a free alternative available from a well-known supplier. The market is largely commoditised already.

Information security is a 'market for lemons' – a term used by Akerlof in 1970 in the context of the used car market. The buyer has less knowledge of the product than the seller, and consequently bases their purchasing decision solely on price. In the case of IT security, the consumer has no way of understanding what is under the hood and has little technical understanding.

A free product is unbeatable – except by another free product. Revenue could come from value-added components, but the total revenue opportunity will be less than it is today.

Vendors could vacate the consumer and small business sector entirely, as Sophos did successfully several years ago. However, this would involve scaling down operations and would accelerate industry consolidation.

Microsoft will make Morro suitable for mobile Windows devices with a small-form factor. Businesses are free to use it on their PCs. The main restriction is that Morro will not provide any central deployment or management capability, making it unsuitable for larger organisations. Morro will address a large slice of the anti-malware market.

The danger is that a monopolistic situation will impede innovation. The current generation of anti-malware products react to threats and struggle to cope with the explosion in the number of variations of malware. Morro will likely follow the lead of Trend Micro in moving malware scanning into the cloud to allow it to work on smaller devices, but this does not surmount the fundamental limitations of a reactive approach. Proactive forms of defence may render today’s products obsolete within five years. In the case of consumer devices, this could come from improvements in the Wintel architecture, and Morro may come to be seen as a stepping stone to eliminate commercial and political opposition to these developments.