It's the type of bug that could have visited a world of hurt on a sizable number of people using Google Apps to manage business e-mail and calendars. A cross-site scripting (XSS) flaw in https://admin.google.com/ made it possible for attackers to force Google Apps admins to execute just about any request on that subdomain. Forced actions included creating new users with "super admin" rights, removing two-factor authentication and other security controls from existing accounts and modifying domain settings so e-mail is redirected to addresses controlled by the attacker.

But instead of causing disaster for businesses using Google Apps or generating headlines of an alarming new zero-day vulnerability, the bug was privately reported to Google on September 1 and fixed 17 days later. In exchange for the report, Google paid application security engineer Brett Buerhaus $5,000.

The speed and lack of fuss contrasts sharply with vulnerability travails that have recently visited Microsoft. Twice this month, the software company has been shamed when Project Zero, the vulnerability research team sponsored by Google, has publicly reported unfixed bugs that threaten the security of Windows users.

Project Zero policies call for all vulnerability reports to be made public 90 days after they are privately reported to the software developer. The deadline can be particularly tough on companies like Microsoft, which have a large number of customers in large organizations and support multiple software products that run on many different types of hardware. To make matters easier on administrators responsible for tens of thousands of servers and desktop computers, Microsoft releases patches on the second Tuesday of each month. And to ensure security fixes don't unintentionally break things that work—or worse, completely brick a fleet of mission-critical machines—Microsoft engineers extensively test the updates before releasing them.

The Project Zero deadline takes no account of such internal patching routines. It operates under the principle that 90 days is a reasonable amount of time to develop a software fix and distribute it to users. The principle largely makes sense, but there's no denying it favors companies patching holes in websites and apps used predominantly by end users rather than programs that large businesses run on all kinds of different types of computers and servers. That in a nutshell explains how Google can squash a potentially catastrophic XSS vulnerability on its website while Microsoft struggles to explain why it hasn't fixed a Windows bug three months after it was reported.

Microsoft has some reason to complain, but it's hard to feel too much sympathy. For one thing, the company until recently has mostly eschewed bug bounties that have become a cornerstone of most other companies' security, and the company still doesn't regularly pay rewards for most vulnerabilities reported in Internet Explorer, Office, and Windows. But mainly Google's advantage is a matter of evolution in a world of rapidly accelerating vulnerability discovery. The patch development model that has mostly served Redmond well over the past decade isn't likely to be nearly as effective in the next 10 years. Somehow, engineers must find a technical solution to this growing problem.

For now, the sad fact of life for Microsoft is that it's at a disadvantage to the Googles of the world—the sad reality of Android patching notwithstanding.

Post updated to add details about Microsoft bug bounty programs.