Microsoft’s upcoming marketing nightmare

The other day, I was listening to NPR (i think it was “Marketplace”) in the car and for some reason they were talking about Vista. I can’t remember the exact context, but one of the gentleman being interviewed raised an interesting point – he said (paraphrasing here, since my memory is not so good), “Microsoft has so much riding on Vista that if they can’t control the spyware/malware problem, it won’t be very good for them.” Of course he was right, and it’s something that quite a few of us have been commenting on in the security space for quite some time; however, what really struck me about this particular discussion was the fact that it was on NPR – meaning, in my opinion, that the interest in this has been raised significantly (it seems to me that something has to be particularly entrenched in our collective discourse if it gets coverage on the radio – even if it is NPR.) So in my opinion, this means that all sorts of individuals who would otherwise be less than interested are now watching Vista to see how it plays out from a security perspective.

Now, in my opinion, Microsoft has painted themselves into a corner; they’ve written a number of checks that I don’t think any product could possibly cash. Here’s what I mean: They’ve made the claim that it’s the most secure MSFT product to date. Couple this with a perception on the part of many that they are seeking to “own” security going forward (I don’t think they are, by the way – but there is that perception.) Now throw in the recent press that the SDL has received and the vocal message that they’ve put forth about the security features built into the product (this is from BusinessWeek, for Pete’s sake). All those things combined and you have some very high expectations on the part of consumers. At the end of the day, Microsoft will have to eat some major crow if it turns out that the security is not perceived to be significantly better than previous operating systems. And for the crux of the matter, notice that I didn’t say “is significantly better” in that last sentence but instead “perceived to be significantly better”… in actuality, it doesn’t really matter all that much whether the security actually is better or not – it just has to be seen as being better by the community at large.

And that won’t happen. Period.

Why not? First, Microsoft has to fight the marketing of other firms with a vested interest in painting the OS as insecure. Don’t believe me? Does “I’m a Mac” ring any bells? If Mac doesn’t spin the security issue, how about the AV software vendors? How many millions of dollars in “Microsoft is insecure” marketing dollars do you think will get spent to herald in the age of Vista? I’m thinking quite a few. Second, there are a ton of researchers chomping at the bit to test their mettle against Vista. It is going to be “target #1″ for the foreseeable future for bug-finders, vulnerability researchers, tool makers, spyware manufacturers, etc. Batten down the hatches, because a squall is a-brewin’. Not to mention that they’re fighting the natural order – it is the nature of software products to have bugs. And Vista will – I guarantee it. And last but not least, Microsoft is up against a bias in the marketplace the extent of which they have no conception. In other words, they have a matter of weeks – maybe a few months – to change everyone’s mind about their software. I think it’s pretty unlikely, don’t you?

So what happens if Vista is not perceived as secure? I’m not sure, but I’m thinking nothing good (for Microsoft) can come of it when it doesn’t happen.