One of your assumptions (that exploits come from reverse engineering the patches) is not necessarily true. The logical conclusion to that would be that systems would stay most secure by never patching the vulnerabilities, as in that case there wouldn't be exploits and thus no threat. This isn't true, though; many researchers choose not to release the exploit until a patch is also released (though there's no requirement on them to do so), and there are exploits frequently published before exploits are available, even for Microsoft products. With all that, I'm curious why Microsoft takes so much longer than most other vendors (including Free/open source software) to release patches. Testing is one thing, but sometimes a vulnerability is know for six months or longer before it's patched. The window of vulnerability begins way before the patch is released, no matter what the party line may be, and so this is a disservice to customers (including myself, as I'm a security architect for a multinational telecom). All that notwithstanding, this is the first time I've run across your blog, and I've subscribed to it as it looks interesting and worthwhile.