Krebs’ study spans the last three years (2003 - 2005) of Microsoft critical security patches. Microsoft considers a patch "critical" if it fixes a security hole that attackers could use to break into and take control over vulnerable Windows computers. His study was very thorough and well documented, with detailed data about all of the security patches involved in the study.

Krebs reports that, “Over the past three years, Microsoft has actually taken longer to issue critical fixes when researchers waited to disclose their research until after the company issued a patch. In 2003, Microsoft took an average of three months to issue patches for problems reported to them. In 2004, that time frame shot up to 134.5 days, a number that remained virtually unchanged in 2005.”

The Microsoft team has a long way to go if it ever hopes to catch the open source community which normally issues critical security patches inside of a month, many times in just days. I understand the delay in patches and fixes for an operating system. But “critical updates” are just what they say, critical; and I would hope that a patch could be made inside of 30 days, not in more than 4 months.