Microsoft Security Intelligence Report (SIR)

The Microsoft Security Intelligence Report (SIR) provides an in-depth perspective on the changing threat landscape including software vulnerability disclosures and exploits, malicious software (malware), and potentially unwanted software. Using data derived from hundreds of millions of Windows computers, and some of the busiest online services on the Internet, this report also provides a detailed analysis of the threat landscape and the changing face of threats and countermeasures and includes updated data on privacy and breach notifications. The seventh volume of the report is now available:

SIR Volume 7 (January through July 2009) and Key Findings Summary (available in 10 languages)

Latest Highlights


Malicious software infection rates differ significantly for different versions of the Microsoft Windows operating system. Windows Vista was less infected at any service pack level than Windows XP. Comparing the latest service packs for each version, the infection rate of Windows Vista SP1 is 61.9 percent less than that of Windows XP SP3.

SIR V7 – Infection Rate by Operating System and Service Pack

The following map illustrates the infection rates of locations around the world, expressed in a metric called CCM that represents the number of computers cleaned per thousand executions of the Malicious Software Removal Tool.

SIR V7 – Infection Rate by Global Location

Despite the global nature of the Internet, there are significant differences in the types of threats that affect users in different parts of the world. Infection data from several Microsoft security products for some of the more populous locations around the world demonstrates the highly localized nature of malware and potentially unwanted software.

The figure below shows the relative prevalence of different categories of malware and potentially unwanted software in the eight locations with the most computers cleaned in 1H09, expressed as percentages of the total number of computers cleaned in each location. (The sum of the infection rates for each location may exceed 100 percent because some computers have more than one category of threat removed from them during each time period.) See page 40 in the Security Intelligence Report for an explanation of the categories used in this figure.

SIR V7 – Malware Prevalence by Type