Virtually every Windows PC at risk, says Secunia

More than 98 percent of Windows computers harbor at least one unpatched application, and nearly half contain 11 or more programs at risk from attack, a Danish security company said Wednesday.

According to Secunia ASP, 98.1 percent of the PCs on which its Personal Software Inspector (PSI) utility was installed during the last week sport one or more applications that have security updates available for downloading.

[ Learn how to secure your systems with Roger Grimes' Security Adviser blog and newsletter, both from InfoWorld. ]

PSI scans Windows systems for installed applications, then compares their version numbers to the most up-to-date; if they're different, it makes note, then provides a link to the patch update. To gather its numbers, Secunia tracked the results of each user's first PSI scan.

Since Nov. 25, when PSI left beta and entered Version 1.0, more than 120,000 people downloaded the utility, said Thomas Kristensen, Secunia's chief technology officer. The company randomly selected 20,000 of those installations, then tallied the number of unpatched applications PSI found.

"Most people keep Windows up to date," said Kristensen, "because it's so easy to use Windows Update. Adobe Reader and Flash and Apple QuickTime are like that, too, as are browsers. But a lot of third-party [browser] plug-ins don't have any [update mechanism] and so people don't keep them updated."

The PSI data showed that while fewer than 1.9 percent of the users had a completely clean PC, 30.3 percent of the machines contained between one and five unpatched programs, 25.1 percent had between six and 10 at-risk applications, and 45.8 percent of the systems boasted 11 or more insecure programs.

Wednesday's numbers were even more dismal than those Secunia collected last January, when it surveyed a similar number of PCs that had just installed PSI. Then, approximately 4.5 percent of the machines were free of unpatched programs, more than twice as many as in the newest survey.

Kristensen explained the decline. "We've had a change in the user base, and managed to reach a much broader group of users," he said. PSI's early adopters were mostly tech-savvy types, Kristensen argued, but as word has spread about the utility, "it's reached a completely different group of users, many who never patch their PCs," he added.

Since Secunia brought the free utility out of beta test, the Copenhagen-based company claims about 900,000 users have downloaded the program. "We should clear 1 million around the first of the year," Kristensen said.

PSI runs on Windows 2000, XP, Vista, and Server 2003 and can be downloaded from the Secunia site.

Computerworld is an InfoWorld affiliate.