Once Microsoft moved into the anti-virus market, we all suspected that vendors would have to improve service and quality to just stay in the game; to succeed they'd need to move to higher margin services like risk management consulting. The results of the ESG report make it look even worse than that.

Security vendors all look the same to many customers and these customers are ready to consider Microsoft Forefront in spite of the fact Microsoft's anti-virus performed so miserably in objective tests. What gives?

It's a combination of factors. First, there are real differences in PC security products as demonstrated by head-to-head comparisons. Customers don't see that though. If you can check off anti-virus on your compliance check list, that is good enough. There are too many other problems to worry about than digging into academic debates about the best methods for detecting polymorphic viruses.

Second, management is big headache. If someone can deliver a security management system that delivers single point of access management to multiple security tools organizations will beat down the door to get their hands on it. If it works well that's a bonus.

Network administrators want security problems to go away, one way or another. They have enough to deal with beside security. If Microsoft can reasonably claim to offer a solution that does that, it will be used. Security vendors should take note of the low barriers to entry in this market.

It seems PC security doesn't have to be good, it just has to look plausible.