One Day Later: The Battle Begins Over Microsoft's Free AV

When Microsoft shipped its Windows Live OneCare security solution a few years back, traditional security vendors recoiled in horror and labeled the low-cost solution as ineffective and pointless. But then they began copying the product's holistic feature-set, most obviously in Symantec's Norton 360. This week, Microsoft shipped a free, stripped-down version of OneCare called Microsoft Security Essentials (MSE). And the competition is back, ridiculing Microsoft's security product once again.

But two questions emerge. First, are their complaints credible? And how will these companies compete with free?

As to the complaints, consider Jens Meggers, Symantec vice president of engineering. He noted this week that "Microsoft has a really bad track record in security." Meanwhile, Symantec's Mike Plante wrote on the Norton Protection Blog that MSE was a "little more than a bad rerun of Microsoft's infamous history of offering consumers incomplete and ineffective protection." (Speaking of reruns, remember that Symantec still sells a product called Norton 360 that was designed to copy OneCare's feature-set.)

Dispensing with the competitive silliness, investigating Microsoft's security track record is certainly worthwhile, if already well documented. More to the point, how well does MSE stand up to the benchmarks that define modern anti-malware solutions? Symantec provides their own rating, which we can safely ignore for obvious reasons. But an independent and trusted source has already chimed in as well. And according to AV-Test.org, MSE scored 98.4 percent accuracy, or "very good" on a comprehensive anti-malware test that involved over 545,000 different forms of attack. For anti-spyware, MSE scored 90.9 percent accuracy, spotting almost 13,000 forms of spyware out of a possible 14,222 samples.

According to AV-Test, this means that MSE is comparable to standalone, paid anti-virus applications from the major security vendors. (Norton Antivirus 2010, for example, retails for $40 per year, which is about $40 more per year than the cost of MSE.) And it does a fantastic job of removing found malware from PCs. What it lacks are the dynamic detection features only found in the more expensive security suites. (Norton Internet Security costs $70 per year.)

Speaking of cost, while it's worth noting that other security vendors have offered free products for some time, none have the market reach of Microsoft. Also, these free products are all designed to sell users on a paid version of the product or an even more expensive security suite that bundles other tools. MSE, by contrast, is the whole product, and there are no attempts at advertising or upsell. Silence is golden.

Too, MSE is based on the well-respected anti-malware engine that Microsoft uses in its Forefront family of products. Aimed at managed corporate environments, Forefront consists of various server products and a lightweight client that can be distributed to PC desktops. Unlike MSE, Forefront of course is not free, but is low-cost and available essentially as a subscription offering. Microsoft also uses this same anti-malware protection in its Hotmail web email service.

So how will Symantec, McAfee and other top-tier security vendors react to MSE once the sputtering is over? A clue may be found in the beta release earlier this year of Panda Cloud Antivirus, a free and lightweight version of Panda's anti-malware solution. Previously, Panda had never given away its products, and Cloud Antivirus provides basic protection while offering an upsell to the company's more complete solutions. Symantec, McAfee, and others may turn to a similar strategy to prevent Microsoft from eating away too much share from the low end of the market.

But even if these companies were to give away anti-virus, it's hard to imagine Microsoft not earning usage share over time. As has been the case in so many markets, and is the case right now with virtualization, Microsoft can open up a market simply by providing a solution of its own. And when that solution is free, all bets are off.

I'd also remind readers that the number one defense against online threats is you, the user. A little common sense goes a long way online, and while there are expensive and complex solutions you can use to prevent attacks, sometimes the simplest solution is to exercise a little discretion.

And for whatever its worth, I've been using MSE since an early Spring 2009 beta release and have never been hacked. I've found MSE to be lightweight and not anywhere as "chatty" and annoying as other security products. And from an end user's perspective, that is exactly what you're looking for.

You can read my review on the SuperSite for Windows.